Arqam will only process and use the Client’s Information for the following purposes (“Processing Purposes”):

1. to the extent necessary to administer and operate services in accordance with any existing engagement documentation, (including without limitation authorizing or confirming transactions, retaining records of transactions and for billing purposes).
2. in the course of the operational support and development of Arqam’s businesses, including to evaluate customer service, efficiency and cost, as well as risk management purposes;
3. to carry out credit (where applicable), money laundering, conflict checks, for fraud, financial crime prevention purposes or other activity required under applicable laws;
4. in relation to any litigation, disputes or contentious matter Arqam or that of any Affiliate anywhere in the world are involved in and/or to assist with investigations, complaints, regulatory requests, litigation, arbitration, mediation or requests from individuals;
5. in order to comply with legal and regulatory requests made to Arqam or any Affiliate anywhere in the world;
6. for reporting, (including without limitation transaction reporting), to and audits by national and international regulatory, enforcement or exchange bodies and complying with court orders associated with Arqam or any Affiliate;
7. for Monitoring Purposes specified in Section e below; and
8. for direct marketing purposes specified in Section g below.

Arqam is not allowed to process the Client’s Information which consists of personal data if Arqam do not have a valid legal ground. Accordingly, Arqam, Arqam’s Affiliates and/or other persons acting on Arqam’s or their behalf will only process and use the Client’s personal data:

1. if necessary for Arqam’s legitimate interests, (in each case provided such interests are not overridden by the Client’s privacy interests). Arqam’s legitimate interests are described in Processing Purposes 1,2,7 and 8 above);
2. To exercise and defend Arqam’s legal rights anywhere in the world described in Processing Purposes 4 and 7 above;
3. If necessary to comply with legal obligations, (including any legal or regulatory guidance, codes or opinions), applicable to Arqam anywhere in the world as described in Processing Purposes 3, 5 and 6 above; and
4. necessary for the performance of a task carried out in the public interest as described in Processing Purposes 3, 5, 6 and 7

As a Processor of personal data, we abide by the following commitments to the Controller:

1. To notify of any request from a government authority or regulator to share personal data belonging to the Controller;
2. To notify of any requests to transfer data outside the DIFC and/or the UAE as applicable;
3. To ensure persons authorized to handle personal data are under a legally binding agreement or a confidentiality agreement;
4. To assist a relevant counterparty by providing appropriate technical and organizational measures for the fulfilment of the Controller’s obligation to respond to requests for exercising the Data Subject’s rights, having taken into account the nature of the Processing;
5. To delete or return all Personal Data to the Controller, at the Controller’s option, or make the same available for return to a relevant counterparty after the end of the provision of services relating to Processing, and delete existing copies unless Applicable Law requires storage of the Personal Data;
6. provide reasonable assistance with audits and inspections conducted by a relevant counterparty, an auditor mandated by a relevant counterparty or the Commissioner; and,
7. To make available to the Controller, relevant counterparty or the Commissioner all necessary information to demonstrate compliance with of commitments.

The Client’s Information includes the personal data the Client and/or the Client’s affiliated companies provide directly to Arqam and Arqam’s agents, as well as information Arqam obtain from Arqam’s service providers. The information Arqam obtain through these sources includes personal details, financial account information, and information relating to political affiliations, trade union membership or criminal convictions. Some of this information will be publicly accessible. When Arqam or Arqam’s agents ask the Client to provide personal data, Arqam will indicate whether providing the requested personal data is a statutory or contractual requirement or a requirement necessary to enter into a contract, as well as whether the Client are obliged to provide the personal data and the possible consequences of the Client’s failure to provide it.

Arqam’s processing and use of the Client’s Information includes disclosure of the Client’s Information between Arqam and Arqam’s Affiliates; to other persons processing the Client’s Information on Arqam’s or Arqam’s Affiliates’ behalf or otherwise providing Arqam or them with professional or other services; to third parties such as settlement agents, overseas banks or Exchange or Clearing Houses to whom Arqam disclose information in the course of providing the services; to credit reference, fraud prevention and other similar agencies, and other financial institutions, with whom information is shared for the Processing Purposes; to persons to whom Arqam assign or novate Arqam’s rights or obligations; and to national and international regulatory, enforcement or exchange bodies or courts anywhere in the world as required by applicable laws anywhere in the world or at their request. These disclosures involve overseas storage and other overseas transfer, processing and use of the Client’s Information, and disclosure to these third parties, including in or to countries or territories outside of the European Economic Area (“EEA”) where the laws may provide a different level of data protection.

Without limiting the foregoing, the Client’s data will be disclosed by Arqam to Arqam’s Affiliates and vendors which conduct operational, technology and customer service functions in various jurisdictions including Egypt, Gulf Cooperative Council (GCC) states, Oman, Jordan, Libya, Lebanon, Canada, China, Hong Kong, Hungary, India, Japan, Singapore, United Kingdom, the United States of America and other countries where Arqam and Arqam’s Affiliates do business with. When the Client’s Information is transferred to countries or territories outside of the EEA that are not recognized by the DIFC and the European Commission as offering an adequate level of data protection, Arqam puts in place appropriate data transfer mechanisms to ensure the Client’s Information is protected. The Client can obtain a copy of the relevant data transfer mechanism Arqam have put in place to protect the Client’s Information by contacting Arqam’s Data Protection Office at support@arqam-capital.com

Arqam retain the Client’s Information in an identifiable form in accordance with Arqam’s records and data management policies which establish general standards and procedures regarding the retention, handling and disposition of the Client’s Information. The Client’s Information is retained as long as necessary to meet legal, regulatory and business requirements. Retention periods will be extended if Arqam and/or Arqam’s Affiliates are required to preserve The Client’s Information in connection with litigation, investigations and proceedings. Upon request, Arqam and/or Arqam’s Affiliates will provide the Client with more information on the exact retention periods applying to the Client’s Information in each case. To the extent provided by applicable law, the Client have the right to request access to and rectification or erasure of the Client’s Information; to obtain restriction of the processing of the Client’s Information; to object to the processing of the Client’s Information (including direct marketing); and to data portability. If Arqam have collected the Client’s Information with the Client’s consent, please note that the Client have the right to withdraw this consent at any time, subject to applicable law. If the Client wish to exercise any of the Client’s data protection rights or if the Client consider that Arqam have processed the Client’s Information in violation of applicable law, please contact Arqam’s Data Protection Office at support@arqam-capital.com. If the Client consider that Arqam have processed the Client’s Information in violation of applicable law and failed to remedy such violation to the Client’s reasonable satisfaction, the Client may also lodge a complaint with a supervisory authority.

To the extent permitted by applicable law, Arqam, Arqam’s Affiliates or any other person on Arqam’s or its behalf will access, review, disclose, intercept, monitor and/or record (“Monitor”) (i) verbal and electronic messaging and communications with the Client or the Client’s agent (e.g., telephone, facsimile, SMS, instant message, email, Bloomberg and any other electronic or recordable communications) with the Client and the Client’s agent (“Communications”); and (ii) the Client’s use of technology owned by or made accessible by Arqam Capital, including but not limited to systems that facilitate such Communications with the Client or the Client’s agent, information processing, transmission, storage and access, as well as remote access (“Systems”).

Arqam, Arqam’s Affiliates or any other person on Arqam’s or its behalf will only Monitor Communications and Systems to the extent permissible under applicable law from time to time for the following purposes (“Monitoring Purposes“):

1. to establish the existence of facts (e.g., keeping records of transactions);
2. to ascertain compliance with regulatory or self-regulatory practices or procedures which relate to Arqam’s or Arqam’s Affiliates’ business;
3. to ascertain or demonstrating standards which are achieved or ought to be achieved by persons using Arqam’s Systems, including compliance with any terms of use associated use of Arqam’s Communications and Systems;
4. to prevent, detect or investigate crime, money laundering, fraud, financial crime and/or other breaches of applicable law;
5. to comply with applicable laws and regulations, any agreement Arqam have in place with the Client and any applicable policies and procedures;
6. to safeguard against the loss, theft, unauthorized and unlawful collection, use, disclosure, destruction or other processing or misuse of confidential and proprietary information;
7. to prevent, detect or investigate unauthorized use of Arqam Capital Communications, Systems and/or data (e.g., Monitoring to ensure compliance with Arqam’s policies and procedures, including without limitation those relating to information security and cyber security);
8. to ensure the effective operation of Systems (including telephones, email and internet) systems;
9. for security or health and safety purposes;
10. for support and administration purposes;
11. to assist with investigations, complaints, regulatory requests, litigation, arbitration, mediation or requests from individuals; or
12. in the course of the operational support and development of Arqam’s businesses, such as to evaluate the quality of customer service, efficiency, cost and risk management purposes;

Monitoring is conducted by Arqam, Arqam’s Affiliates or any other person on Arqam’s or its behalf using various methods, including: (i) the use of “intelligent” automated monitoring tools; or (ii) the IT filtering tools which randomly review Communications and Systems; or (iii) through random monitoring of Communications and Systems, e.g. by authorized supervisors randomly joining on-going telephone calls on the sales and trading floors or systematically via electronic communication recording tools; (iv) specific monitoring of key Communications and Systems e.g. in relation to investigations, regulatory requests, subject access requests, litigation, arbitration or mediation or; (v) data tracking, aggregation and analysis tools that pull data from various disparate data sources to draw linkages and/or detect behavioral patterns, interactions or preferences for analysis (including predictive analysis); and/or (vi) using other similar Monitoring technology that may become available from time to time.

Arqam, Arqam’s Affiliates or any other person on Arqam’s or its behalf also use cookies and similar technologies to collect information about the Client as part of and/or in connection with the Services. By accessing or using the Services the Client understand that Arqam will use such cookies and similar technologies as detailed in Arqam’s Privacy and Cookies Policy. The Client understands that if the Client chooses to reject Arqam’s cookies, some or all parts of the Services may not function properly or may not be accessible. To find out more about how Arqam use cookies and similar technologies, how Arqam process the information obtained through cookies and how to reject cookies, see Arqam’s Privacy and Cookies Policy at https://www.arqam-capital.com/privacy-policy/.

Any documentation or records relating to the Monitoring of Arqam Capital Systems shall be prima facie evidence of any orders or communications Monitored and the Client agree that such records shall be admissible as such in any legal proceedings. Furthermore, the Client confirm that the Client will not use, file, or cite as a reason for objecting to the admission of such records as evidence in any legal proceedings either that Arqam’s records are not originals, are not in writing or are documents produced by a computer. Where required under applicable law, a copy of records relating to telephone and electronic communications will be available to the Client upon request (provided that a charge may be payable), for a minimum period of 6 years, or longer if requested by a competent authority for a period greater than this. Arqam will retain such records in accordance with Arqam’s operational procedures which may change from time to time in Arqam’s absolute discretion. Please note that the Client should not rely upon Arqam to comply with the Client’s record keeping obligations and that the Client should keep adequate records in accordance with any applicable Rules to which the Client are subject.

Arqam seeks to adopt commercially reasonable security measures to assist in protecting against the loss, misuse, and alteration of personally identifiable information which is under its control. Unfortunately, no security system, or system of transmitting data over the Internet, can ever be guaranteed to be 100% secure. As a result of the foregoing, while Arqam undertakes commercially reasonable efforts to protect Client’s personally identifiable information, Arqam cannot guarantee the security of its servers, the means by which information is transmitted between a Client’s computer and Arqam Capital’s servers, or any information provided to Arqam or Arqam’s Affiliates or to any third party through or in connection with the relevant sites or electronic communication means. Clients provides all such information entirely at their own risk.

If there are any products or services that Arqam or Arqam’s Affiliates believe may be of particular interest to the Client, whether provided by Arqam, by Arqam’s Affiliates or by third party investment services providers (for example, a fund manager or insurance service provider not affiliated with Arqam), Arqam or Arqam’s Affiliates will contact the Client by mail, email, telephone, etc., including outside standard working hours or if the Client are travelling overseas. Where required by applicable law, Arqam will request the Client’s prior consent before Arqam or Arqam’s Affiliates use the Client’s Information for direct marketing purposes. If the Client do not wish Arqam to use or provide to Arqam’s Affiliates the Client’s Information for direct marketing purposes, the Client may notify Arqam at any time in accordance with section d above or as directed in any marketing materials Arqam send to the Client. Please note that if the Client do not wish Arqam or Arqam’s Affiliates to contact the Client for such purposes, Arqam or Arqam’s Affiliates may need to limit the range of products and services which Arqam or Arqam’s Affiliates will offer to the Client or Arqam or Arqam’s Affiliates may not be able to open an account for the Client or continue Arqam’s relationship with the Client.

Before providing Arqam, an Affiliate or any other person on Arqam’s or its behalf with or permitting any access to or processing of the Client’s Information which contains any personal data regarding an individual in connection with Arqam’s relationship with the Client, the Client should ensure that: (i) the individual understands that the Client will be providing their personal data to Arqam or the Affiliate; (ii) the individual has been provided with the information set out in this Notification regarding the collection, use, processing, disclosure and overseas transfer of their personal data, the use of their personal data for direct marketing purposes, and the possibility of monitoring or recording of their or their agent’s communications by Arqam, in each case as permitted by applicable laws; (iii) the individual has provided their consent to Arqam’s processing of their personal data or that another legal basis to process personal data is satisfied; and (iv) the individual is aware of their data protection rights and how to exercise these.

By dealing with Arqam, the Client acknowledge that any banking secrecy rules shall not apply where in the course of Arqam’s business dealings Arqam disclose information, including information relating to the Client, the Client’s investments and/or Arqam’s relationship with the Client to Arqam’s affiliates in terms of UAE and DIFC laws, outsourcing partners or other third parties (including, in each case, employees, representatives, consultants, external auditors and advisors), in any case, on a need to know basis, in order to evaluate, provide or audit the services offered to the Client or in the course of the operational support and development of Arqam’s business and always bearing in mind the Client’s legitimate interests. Arqam may also disclose the Client’s information if required by law, rule, regulation, order, directive or announcement in any jurisdiction, or if required or requested by a competent court or another competent legal, governmental, supervisory or regulatory authority or any self-regulating organization, exchange, clearing house or any other body having regulatory or enforcement responsibility in relation to any business conducted to the Client.