Privacy Notice

This privacy notice ("Notice") describes how GHATA collects and uses your Personal Data in accordance with the Personal Data Protection Law of the United Arab Emirates, being Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data and its implementing regulations (together, the "PDPL"), and any other applicable data protection legislation in the United Arab Emirates. It tells you what Personal Data GHATA collects, why we need it, how we use it, the legal bases on which we rely, and the protections we have in place to keep it secure.

Key terms

"GHATA", "we", "us" and "our" mean GHATA Consulting and Marketing Studies L.L.C S.P.C, a company registered in Abu Dhabi, United Arab Emirates, acting as the controller of your Personal Data.

"Personal Data" means any information relating to an identified natural person, or a natural person who can be identified, directly or indirectly, by way of linking that information, as defined under the PDPL.

"Processing" means any operation performed on Personal Data, including its collection, storage, use, disclosure, transfer and deletion.

"You" means the individuals whose Personal Data we process, including GHATA clients and client personnel, suppliers and supplier personnel, prospective clients, people with whom we have professional relationships, people we interact with in the course of our work, and people who visit this website.

How does GHATA obtain your Personal Data?

In some circumstances we obtain your Personal Data from you directly, including through your use of this website, through our lead form and our client portal, and through correspondence and meetings. More typically we obtain your Personal Data from a third-party source. For example, we may collect information from our clients and their personnel, agents and advisers, the organisation for whom you work, other organisations or persons with whom you have dealings, government and regulatory authorities, information and service providers, and publicly available records.

Personal Data that you provide about other people

If you provide information to us about someone else, such as one of your colleagues, directors, employees, or a person with whom you have business dealings, you must ensure that you are entitled to disclose that information to us and that, without our taking any further steps, we may process that information in accordance with this Notice. Where required under the PDPL, you should ensure that the relevant individual has been informed of the matters set out in this Notice.

What Personal Data does GHATA collect from and about you?

We collect and use different types of Personal Data about you, which will vary in type and detail depending on the circumstances and the purpose of processing. The following examples are illustrative and non-exhaustive:

• Personal Data about you, such as your name, address, date of birth, nationality, gender, preferred language, job title and professional background.
• Personal Data used to contact you at work or at home, such as your name, address, telephone numbers and email addresses.
• Personal Data that may identify you, such as photographs and video, passport or Emirates ID and driving licence details, and electronic signatures.
• Personal Data used to process any payment we might need to make to you or receive from you, such as bank account details and tax registration numbers and references, where applicable.
• Personal Data used to understand how this website is used, such as your IP address, traffic and location information, weblogs, cookie data and other communication information.

We do not seek to collect sensitive personal data through this website. Where the processing of any sensitive personal data is necessary, we will do so only in accordance with the requirements of the PDPL.

Why do we need to collect and use your Personal Data?

We collect and use your Personal Data for a number of reasons, the primary purpose being to provide marketing and communications consulting services to our clients. Our clients are typically business-to-business organisations, including group and portfolio companies and sovereign wealth funds, operating across commodities, distribution, maritime, shipping, logistics and industrial zones. Providing these services may involve the use of your Personal Data in the following non-exhaustive ways:

• to contact you where you are involved in the work we are undertaking for a client, whether in your professional or personal capacity;
• to develop, review and deliver strategy, content and communications on behalf of our clients, which may contain your Personal Data;
• to carry out marketing and communications activity on behalf of our clients; and
• to engage and instruct third parties on behalf of our clients.

We may also process your Personal Data for the effective management of our business, which may involve the use of your Personal Data in the following non-exhaustive ways:

• to engage and contact suppliers and supplier personnel;
• to carry out internal reviews, investigations and audits;
• to conduct business reporting and analytics;
• to recruit and hire staff;
• to measure and improve the performance of our services;
• for marketing, advertising and communications purposes relating to GHATA;
• for regulatory and legislative compliance and related reporting; and
• for the prevention and detection of unlawful activity.

What is GHATA's legal basis for processing your Personal Data?

Under the PDPL, GHATA must rely on a valid legal basis for processing your Personal Data. The basis we rely on may vary according to the type of Personal Data processed and the individual to whom it relates. The principal bases on which we rely are set out below.

Your consent. In some circumstances we process your Personal Data on the basis of your consent, for example where you submit an enquiry through our lead form or subscribe to receive communications from us. Where we rely on your consent, you may withdraw it at any time by contacting us at info@ghatastrategy.com, although this will not affect the lawfulness of any processing carried out before your withdrawal.

Performance of a contract with you. GHATA is entitled to process the Personal Data it requires in order to fulfil its obligations under a contract with you. This will be the relevant basis where you are an individual client or supplier, or another individual who has a direct contractual relationship with us.

The legitimate interests of GHATA or a third party. We process some of your Personal Data on the basis that it is necessary for our legitimate interests or the legitimate interests of a third party, provided that those interests are not overridden by your rights and freedoms. This primarily concerns the processing necessary to provide services to our clients, where our legitimate interest is the proper performance of our function as a provider of marketing and communications services, and our clients have a corresponding interest in receiving those services. Examples include contacting individuals relevant to our work, preparing and providing documents and correspondence that may contain Personal Data, instructing third parties on behalf of our clients, facilitating payments, and the secure management and storage of Personal Data within our systems and filing arrangements. We also rely on this basis for the effective running of our business, including engaging suppliers, keeping our systems and premises secure, recruiting personnel, marketing our own services, obtaining insurance, and making and receiving payments.

Compliance with a legal obligation. In certain circumstances we must process your Personal Data in order to comply with our legal obligations under the laws of the United Arab Emirates. This includes, but is not limited to, Personal Data required for tax and accounting purposes and to meet our compliance and reporting obligations under applicable legislation and regulation.

Further information about the legal bases for processing Personal Data is available from the UAE Data Office, or by contacting us at info@ghatastrategy.com.

How do we protect your Personal Data?

We have security arrangements in place to guard against unauthorised access, improper use, alteration, destruction or accidental loss of your Personal Data. We apply appropriate organisational and technical security measures, and we maintain rules and procedures designed to ensure that any Personal Data we hold is not accessed by anyone who is not authorised to access it. We maintain, and we abide by, an information security policy that sets out the standards used to protect your Personal Data.

Where we engage third-party organisations to process your Personal Data on our behalf, they are required to maintain appropriate security arrangements, to comply with our contractual requirements and instructions, and to comply with applicable data protection legislation in the United Arab Emirates.

Is your Personal Data transferred outside the United Arab Emirates?

In the course of providing our services we may transfer your Personal Data to organisations located outside the United Arab Emirates. Where we do so, we will ensure that the transfer is carried out in accordance with the cross-border transfer requirements of the PDPL. This means that we will transfer your Personal Data only where the destination country provides an adequate level of protection for Personal Data, or where appropriate safeguards are in place, such as contractual provisions that secure an adequate level of protection, or where another condition permitted under the PDPL applies, including your consent. You may request further information about the safeguards we use by contacting us at info@ghatastrategy.com.

How long will your Personal Data be retained?

It is our policy to retain your Personal Data for the length of time required for the specific purposes for which it is processed by us, as set out in this Notice. We may be obliged to keep your Personal Data for a longer period, for example where this is required by our legal and regulatory obligations, or in order to maintain effective back-up systems. In such cases we will ensure that your Personal Data continues to be treated in accordance with this Notice, that access to any archived Personal Data is restricted, and that all Personal Data is held securely and kept confidential.

What are your rights?

The PDPL affords you a number of rights in relation to your Personal Data. Subject to the conditions and exceptions set out in the PDPL, these include the right to be informed about how your Personal Data is processed, the right to request access to your Personal Data, the right to request the correction of inaccurate Personal Data, the right to request the deletion of your Personal Data, the right to restrict or stop the processing of your Personal Data, the right to request the transfer of your Personal Data, the right to object to processing carried out on the basis of legitimate interests, the right to object to automated processing that produces legal consequences or seriously affects you, and the right to withdraw your consent where processing is based on consent.

We have procedures in place to deal with requests to exercise these rights. A request of this kind requires us to provide you with details of the Personal Data we hold about you and a description of how we process it. Any questions or requests should be made in writing to us at info@ghatastrategy.com. We will respond to your request within the period required under the PDPL.

Cookies

This website uses cookies and similar technologies to help the site function, to understand how the site is used, and to improve your experience. Cookies are small text files placed on your device when you visit a website. Some cookies are necessary for the site to operate, while others are optional and are used only with your consent. When you first visit this website you will be presented with a cookie banner that allows you to accept or decline optional cookies, and you can change your preferences at any time through your browser settings. Where cookies collect information that constitutes Personal Data, that information is handled in accordance with this Notice.

How to make a complaint

If you are unhappy with the information provided in this Notice, or you have concerns about the way in which GHATA processes your Personal Data, you may in the first instance contact us at info@ghatastrategy.com so that we can seek to resolve the matter. You also have the right to lodge a complaint with the UAE Data Office, which is the federal authority responsible for supervising the application of the PDPL.

Changes to this Notice

We may update this Notice from time to time in order to reflect changes in our practices or in applicable law. Where we make material changes, we will take appropriate steps to bring them to your attention. The date at the top of this Notice indicates when it was last updated.

Contact us

If you have any questions about this Notice or about how we handle your Personal Data, please contact us at info@ghatastrategy.com, addressed to the attention of the GHATA data protection contact.