^{ADCB Privacy Notice} Abu Dhabi Commercial Bank PJSC – KSA Branch

1. Who We Are

1.1 Abu Dhabi Commercial Bank PJSC – KSA Branch (“ADCB”, “Bank”, “We” or “Our”)

1.2. Data Protection in ADCB is regulated by the Kingdom Of Saudi Arabia (“KSA”) Data Protection Law and the KSA Central Bank “SAMA” Consumer Protection Regulation and accompanying Consumer Protection Standards.

1.2 Our Contact Information

• National Address:Building No. 2239, Al-Urubah Road, Secondary No. 9597, Al-Olaya District, Postal Code 12214, Riyadh, Kingdom of Saudi Arabia), Short Address (RHOB2239)
• Email: [email protected]

2. Introduction - Purpose and Applicability of This Privacy Notice

ADCB is committed to protecting your privacy and your Personal Data. To do so, it follows general principles in accordance with applicable privacy laws.

This Privacy Notice (“Notice”) details:

• the Personal Data we Process about you;
• the legal basis and purpose of that Processing;
• if and whom we share your Personal Data with;
• how long we retain your Personal Data;
• your data privacy rights and choices regarding the Personal Data we process about you; and
• the various measures we have in place to protect the security of your Personal Data and minimise the potential for its unauthorised use, disclosure and destruction.

The terms of this Notice will apply to you when you use our products or services, banking channels, visit our online services at https://www.adcb.com and any of its ancillary pages and websites (the “Websites”), or provide us with your Personal Data.

ADCB may change this notice from time to time if required by law or where there are any changes to its business practices. Should you wish to contact us to discuss any questions, concerns and comments you may have regarding your Personal Data that we process, please reach us through our contact details provided in section “Our Contact Information” of this Notice.

3. Our Role as Controller and Processor

3.1 Controller

A Controller is an entity who solely, or jointly with others, determines the how and the why of Personal Data Processing. In most cases, we will act as the Controller when Processing your Personal Data.

3.2 Processor

A Processor is an entity who processes Personal Data on behalf of another entity, i.e the Controller, and does so solely on the basis of instructions provided by the Controller.

4. Understanding Personal Data and Processing

Personal Data and Processing have very specific meanings under Applicable Law. It is important that you understand these terms.

4.1 What is Personal Data?

Personal Data means any data which relates to a living individual (natural person) regardless of its source or form, who can be identified directly or indirectly from that data. The definition includes a wide range of personal identifiers that constitute Personal Data, including names, identification numbers, location data or online identifiers, contact numbers, license numbers, records, and personal property, bank accounts, still or moving images, and any other data of a personal nature., in line with data protection law, reflecting changes in technology and the way organizations’ collect information about people. Examples of Personal Data we may collect from you include:

4.2 What is Processing?

In this Notice the term “process or processing” explains how we collect, use, store, makes available, destroy, update, disclose, or otherwise deal with your Personal Data. As a general rule, we will only process your Personal Data if this is required to deliver or offer a product or service to you or comply to a regulatory requirement. The Bank respects customers’ privacy and ensures its duty of confidentiality is maintained throughout our relationship with you.

5. Personal Data We Collect About You and the Purposes for Which We Do So

When you choose ADCB to provide you with banking and other services we need to collect Personal Data from you in order to supply those products or services and comply with our legal and regulatory obligations. Where we are Processing your Personal Data based on your Consent, you have the right to withdraw your Consent at any time, and this will take effect within 30 calendar days. You can do this by contacting us at [email protected]. Please refer to section 14 ‘Marketing from Us’ for information in relation to withdrawing Consent for marketing communications.

We have set out in the table below why we process your Personal Data, what Personal Data we collect, and the legal basis for such Processing.

6. How We Collect Your Personal Data

6.1 Directly From You

We may collect your Personal Data directly from you in a number of ways, including:

6.2 Indirectly From Other Parties

We may obtain your Personal Data indirectly from third parties in the following ways:

Please be aware that if you are applying to us through a third party, then they should have provided you with their own privacy notice in order to inform you how they may process your Personal Data.

7. If you fail to provide personal data

In order to provide banking and other services to you, we may need to process your Personal Data in order to ensure we comply with our legal and regulatory requirements, for example we are obliged to verify the identity of our customers so we may need to process your national ID or passport information. If you fail or refuse to provide us with the requested Personal Data we need we may not be able to supply, or continue to supply, our services to you, and should this occur we will notify you. We will only ever process your Personal Data where we have a lawful right to do so.

8. How We Secure Your Personal Data

The security and protection of your Personal Data is important to us. We have designed and implemented appropriate and reasonable technical and organizational measures to prevent your Personal Data from being unlawfully used, accessed, disclosed, modified or destroyed in line with industry best practices. Our security measures address several dimensions of data security including:

9. How we secure you from data breaches

Whilst we take measures to secure your Personal Data and have a robust incident response plan in place, risks to data security do exist, and there is always a possibility of u nauthorized use, disclosure, modification and/or destruction of your Personal Data. In the event of a data breach, our robust data incident management process will be triggered and our incident management response team will be assembled. The incident will be assessed to identify whether a data breach has in fact occurred. Upon confirmation of an actual data breach, there are stringent protocols that we follow to ensure the efficient management of data breaches and compliance with our legal requirements. Our internal protocols enable the immediate containment, investigation and remediation of data breach through the implementation of corrective and preventative measures and an assessment of any regulatory reporting and disclosure requirements. We will communicate with affected parties in compliance with our legal obligations, where the circumstances of a data breach may reasonably pose a risk to their financial and personal security and/or where it may pose reputational harm to affected parties. We will ensure all notifications provide clear and concise information to you and contain all relevant information as required by law.

If you wish to report a data breach or would like further information on how we respond to and handle data breaches, please contact us at [email protected].

10. Your Data Privacy Rights

If you want to exercise any of your Data Privacy Rights, please submit a request to Data Protection Office (“DPO”) in writing at [email protected]. Your Data Privacy Rights in relation to our Processing of your Personal Data may differ based on your relationship with us. Your Data Privacy Rights are outlined in the table below:

Modalities to exercise your Data Privacy Rights: If you want to exercise any of your Data Subject Rights, please contact our DPO in writing at [email protected]. Please note, we may request an identity document from you in order to verify your identity.

Services at no charge: We will not charge you a fee for facilitating the exercise of your rights. In case of a repetitive or excessive request from you, we will either charge you a reasonable fee taking into account the administrative costs, or we may decide to not act on your request.

Notification to third parties if applicable: If you exercise your right to erasure, rectification or restriction of Processing, we will communicate this with applicable Processors or joint Controllers to ensure your wishes are communicated to all persons processing your Personal Data as applicable.

Notification of inaction if applicable: If we are unable to take action in response to your requests to exercise your rights, we will inform you along with the reasons for our inability to take action. We will also, in such cases, remind you of your right to lodge a complaint with the relevant Data Protection Regulator and seek a judicial remedy.

11. Cross-Border Personal Data Transfers

Throughout the course of your relationship with ADCB, we may need to share your Personal Data with its Processors, namely third parties or suppliers who process your Personal Data on behalf of ADCB. Under certain circumstances, as permitted by Applicable Law, this will involve us transferring your data outside the KSA.

If we need to transfer your Personal Data outside the KSA, we will (1) obtain your Consent for such Personal Data transfers; (2) comply with all relevant regulatory requirements and (3) provide you with any additional information (as and when required) for you to be able to make an informed decision.

In addition, we will ensure adequate level of protections are in place to protect your Personal Data as required under Applicable Law. Where we are permitted to transfer your Personal Data outside the KSA, one or more of the following transfer safeguard mechanisms will apply:

We require all third parties to respect the security of your Personal Data and to treat it in accordance with the law. We do not allow third parties who Process data on our behalf to use your Personal Data for their own purposes and only permit them to process your Personal Data for specified purposes and in accordance with our instructions. For more information on the third parties to whom we may disclosure your information, please refer to our Consumer Banking Terms and Conditions which is available on our website.

15. Changes to this notice

The latest version of our privacy notice is available on our website. We will amend our privacy notice from time to time or as required. Please ensure that you visit our website to view any changes to our notice.

16. Terms and Definitions