Legal

Privacy notice.

How Universal Asset Management Limited handles personal data under the DIFC Data Protection Law 2020. This notice is being finalised with counsel before it goes live.

Effective date: pending. Lawful bases, retention periods and international-transfer mechanism are being confirmed by counsel under the DIFC Data Protection Law 2020 (DIFC Law No. 5 of 2020). The structure below is published for review only and is not the final notice.

Controller

Universal Asset Management Limited, Dubai International Financial Centre, Dubai. The contact point for data-protection enquiries, and whether a Data Protection Officer is appointed, are to be confirmed.

What we collect and why

Account registration and identity verification by email and WhatsApp; Professional Client classification; KYC, source-of-funds and sanctions screening; investor onboarding and ongoing administration; communications; and any marketing, which proceeds on consent only.

Lawful bases

Each processing purpose is mapped by counsel to a lawful basis under the DIFC Data Protection Law 2020, including compliance with the DFSA AML Module and the DIFC AML Law where the processing is a regulatory obligation. The final bases and the governing articles are to be confirmed.

Processors and transfers

Named processors include the email sender (Amazon Web Services, Europe, Ireland), WhatsApp and Meta for messaging, the KYC and sanctions provider, and Cloudflare for delivery. The international-transfer basis for any processor outside the DIFC is to be confirmed by counsel.

Retention and your rights

Retention periods are set by counsel and the Money Laundering Reporting Officer, noting the minimum retention that AML and CDD records carry. Data-subject rights of access, rectification, erasure, restriction, objection and portability, and how to exercise them, are to be confirmed.