INTRODUCTION

Protecting the confidentiality and security of personal information is integral to the way in which FinMark Capital Ltd. (“the Company”) conducts its business. We are committed to safeguarding the privacy of our data subjects and use the personal information in accordance with our privacy principles set out below. The following are major points from our Privacy Policy statement that will help to explain the data processing practices of the Company.

In accordance with the DIFC Data Protection Law, the Company being the data controller and processor, must provide you with information on how your personal data will be processed. Please take a moment to read this Notice so that you know and understand the purposes for which we may collect, use and/or disclose your personal data.

PURPOSES OF PROCESSING AND LAWFUL BASIS OF PROCESSING:

The personal data collected from you, provided by you or obtained from other sources on your behalf will be held, disclosed and processed by the Company for the purposes of maintaining a relationship with you.

We process personal data only for lawful purposes.

Presently, we collect, use and disclose your personal data for the following lawful purposes:

A. In case of your employment with us:

• processing of salaries and other payments to you
• processing of leave requests
• to communicate with you regarding the policies and processes of the Company
• using the information for opening bank accounts for the Company
• to perform or comply with the terms of the employee contract or equivalent
• compliance with any applicable rules, laws and regulations, industry codes of practice or guidelines and any directives or best practices issued or administered by any regulatory authorities or relevant trade bodies or to assist in law enforcement and investigations by relevant authorities;
• any purpose that is reasonable and incidental to our relationship with you.

B. In the case where you submit an application to us as a candidate for employment:

• for processing your application including the conducting of pre-recruitment checks, such as in relation to your credit standing and qualifications;
• for providing or obtaining references and for background screening/vetting from your referees, past employers, present or past colleagues and the staff of past academic institutions;
• for collecting information to assess your suitability for the position applied for;
• for communicating with you as is required to comply with our policies and processes, including for business continuity purposes;
• for maintaining our records where you have not been successful in your job application to us, to inform you should a suitable position which might be of interest to you be open in the future; or where you are subsequently employed by us and thereafter leave our employment, to provide you a reference, when so requested by your future prospective employer; and
• for any other purposes relating to the aforesaid

C. In case you are a Service Provider:

• for communication in order to perform the contract;
• for obtaining references and background checks before entering into a contract;
• bank account details for processing of payments;
• compliance with any applicable rules, laws and regulations, industry codes of practice or guidelines and any directives or best practices issued or administered by any regulatory authorities or relevant trade bodies or to assist in law enforcement and investigations by relevant authorities;
• any purpose that is reasonable and incidental to our relationship with you.

D. In case you are the Shareholder/Director of the Company:

• For processing any payments
• For communication, for onboarding or getting onboarded with any service providers, banks, etc.
• compliance with any applicable rules, laws and regulations, statutory filings, industry codes of practice or guidelines and any directives or best practices issued or administered by any regulatory authorities or relevant trade bodies or to assist in law enforcement and investigations by relevant authorities;
• any purpose that is reasonable and incidental to our relationship with you.

Legitimate Interests

The Company may use the personal data to further any legitimate interest of the business.

Please note that where personal data is processed for purposes of legitimate interests, you have a right to object to such processing and the Company will no longer process the personal data unless the Company can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.

CONSENT

Your consent is not required to process your personal data for the purposes referenced above.

However, we will seek your consent for processing the data for legitimate interests. You have a right to withdraw this consent at any time. Your withdrawal of consent will not affect the lawfulness of processing based on consent received before its withdrawal.

You can withdraw your consent by contacting the Company at the address given below:

FinMark Capital Ltd.

Unit Office 27-30, Level 27, Central Park Offices,
Dubai International Financial Centre,
Dubai, United Arab Emirates

DISCLOSURES TO DATA PROCESSORS AND / OR THIRD PARTIES:

Personal data relating to you which is collected from you or provided by you or on your behalf may be handled by the Company or their duly appointed agents, service providers and any of their respective related, associated or affiliated companies for the purposes specified above.

These data processors will handle your information in accordance with applicable Data Protection Legislation.

The Company may disclose your personal data to other third parties where required by law or for legitimate business interests. This may include disclosure to third parties such as auditors, regulatory bodies, taxation authorities and technology providers.

TRANSFER OF DATA OUTSIDE DIFC

Personal data collected from you or provided by you or on your behalf may be transferred outside of DIFC for processing including to companies situated in countries which may not have the same data protection laws. Such data transfers will only involve companies which are part of the same Corporate Group or acting as service providers to the Company.

RETENTION PERIOD

The Company will retain your personal information for as long as is needed to fulfil the purposes outlined in our Data Protection Policy, unless a longer retention period is required or permitted by law.

SECURITY MEASURES TO PROTECT YOUR DATA

We maintain reasonable and appropriate security measures to protect Customer Data from loss, misuse, and unauthorized access, disclosure, alteration, and destruction. Our information security controls ensure that personal and financial data is well protected and accessible only to authorized personnel.

YOUR DATA PROTECTION RIGHTS:

• You have a right of access to and the right to amend and rectify your personal data.
• You have the right to have any incomplete personal data completed.
• You have a right to be forgotten (right of erasure of personal data)
• You have a right to restrict processing.
• You have a right to data portability.
• You also have the right to object to processing where the Company is processing personal data for legitimate interests.

Additionally, you have a right to lodge a complaint with relevant supervisory authority, in the DIFC of the alleged infringement if you consider that the processing of personal data relating to you carried out by the Company is not as per the regulation in force.

You may use/enforce your rights as outlined above by submitting your written request to us at:

Unit Office 27-30, Level 27, Central Park Offices,
Dubai International Financial Centre,
Dubai, United Arab Emirates

Email: kunal.chawla@finmark.ae

Refusal to provide personal data:

The provision by you of personal data, as outlined in the section titled “Purposes of processing and lawful basis for processing” is voluntary and required by us to comply with the contractual, tax, legal and regulatory requirements referenced above. Where you refuse to provide such personal data or withdraw your consent, we may not be able to perform the contract we have entered into with you.

Please note:

• We do not track your online activities across the Internet.
• We do not use your personal information for automated decision making, including profiling.
• We do not sell or rent your personal information to third parties.