Abu Dhabi Commercial Bank PJSC (“ADCB”, “Bank”, “We” or “Our”)
Data Protection in ADCB is regulated by the United Arab Emirates (“UAE”) Data Protection Law and the UAE Central Bank Consumer Protection Regulation and accompanying Consumer Protection Standards.
Our Contact Information
ADCB is committed to protecting your privacy and your Personal Data.
This Privacy Notice (“Notice”) aims to help you understand what Personal Data we collect, store or process about you, the legal bases on which we do so, the purpose for which we do so, if and whom we share your Personal Data with. This Notice also describes how long we retain your Personal Data.
This Notice describes your rights and the choices you can make in relation to our collection, use and disclosure of your Personal Data.
Further this Notice explains the various measures we have in place to protect the security of your Personal Data and minimise the potential for its unauthorised use, disclosure and destruction.
The terms of this Notice will apply to you when you use our products or services, visit our online services at https://www.adcb.com and any of its ancillary pages and websites (the “Websites”), or provide us with your Personal Data.
Please review this Notice periodically as it will be reviewed and updated annually to reflect changes in our data practices.
Should you wish to contact us to discuss any questions, concerns and comments you may have regarding your Personal Data that we process, please reach us through our contact details provided in section “Our Contact Information” of this Notice.
Controller
A Controller is an entity who solely, or jointly with others, determines the purposes (“why”) and means (“how”) of Personal Data Processing. In most cases, we will act as the Controller when Processing your Personal Data – this means we will decide on how to collect, process and use Personal Data in this role.
Processor
A Processor is an entity who processes Personal Data on behalf of another entity, i.e the Controller, and does so solely on the basis of instructions provided by the Controller.
In some cases, ADCB will act as the Processor when Processing your Personal Data on behalf of another ADCB Group entity. In these cases, ADCB will perform the Processing of the Personal Data under the specific instructions from the ADCB Group entity acting as the Controller.
Personal Data and Processing have very specific meanings under Applicable Law. It is important that you understand these terms.
What is Personal Data?
Personal Data means any data which relates to a living individual who can be identified directly or indirectly from that data. The definition includes a wide range of personal identifiers that constitute Personal Data, including names, identification numbers, location data or online identifiers, reflecting changes in technology and the way organisations collect information about people.
Examples of Personal Data include the following:
What is Processing?
Processing means doing anything with Personal Data, e.g. viewing, collecting, using, storing, sharing, manipulating, printing, copying, archiving etc.
Processing activity means any task that involves doing anything with Personal Data.
ADCB obtains consent from you through the Terms and Conditions form to serve you with products and services, as per the UAE Central Bank’s Consumer Protection requirements. You should be aware that you have the right to withdraw your Consent at any time and this will take effect within 30 calendar days. You can do this by contacting us at dataprivacy@adcb.com. However, this will not affect the lawfulness of any processing carried out before you withdraw your Consent. Please refer to section 14 ‘Marketing From Us’ for information in relation to withdrawing Consent for marketing communications.
We have set out a description of why we process your Personal Data in the table below, including what personal data we collect, and the legal basis for such processing.
Processing Activities | Description | Legal Basis |
Account Opening |
Personal Data processed:name, contact details, address, Emirates ID details, passport details, date of birth, nationality, employment details, transaction pattern (no of credits/no of debits), source of income, and income details. Processing description: We process your Personal Data in order to consider and process your application for an account with us. This Processing is necessary in order for us to take regulatory steps at your request before we enter into an agreement with you and is also necessary for deciding whether or not we can offer you the product you have applied for. This type of Processing is required in order for you to enter into an agreement with us. Personal Data is also required as part of regulatory financial crime protection, including Know Your Customer (“KYC”) process mandated for account opening. We use your Personal Data to prepare KYC forms, CRS forms, W-8 and W-9 forms, application forms, and to evaluate your Customer profile. In respect of fraud searches and identity verification, this Processing is necessary for fraud prevention and to comply with our legal obligations. If you do not provide this information, then we cannot proceed with your application. Processing form: physical, digital platform, and ADCB mobile applications. |
Consent |
Account Closing |
Personal Data processed: name, account number, bank account number, bank statements, CID, credit card number, date of birth, debit card number, home address, Emirates ID details, passport details, phone numbers, contact details. Processing description: We process your Personal Data in order to consider and process your account closure request and to handle dormant/inactive accounts. Processing form: physical, digital platform, and ADCB mobile applications. |
Consent |
Credit Card |
Personal Data processed: name, Emirates ID details, passport details, date of birth, nationality, your mother's maiden name, banking details, home country address details, employment details, income details, name and contact of two friends. Processing description: We process your Personal Data in order to consider and process your application for a credit card. Such Processing may include credit assessment, Profiling, and cross sales. Your Personal Data may be shared with Authorities upon request. We will obtain Consent to check your credit score with Al Etihad Credit Bureau (“AECB”). We will obtain Consent to pull a statement from the UAE Central Bank. Processing form: physical and digital platform. |
Consent |
Debit Card Delivery | Only contact and delivery information is shared with a third party courier for debit card delivery. | Consent |
Personal Finance & Auto Finance |
Personal Data processed: name, Emirates ID details, passport details, date of birth, nationality, mother's maiden name, banking details, home country address details, employment details, income details, name and contact of two friends. Processing description: We will obtain Consent for checking your credit score with AECB. We will obtain Consent to pull a statement from the UAE Central Bank. Processing form: physical and digital platform. |
Consent |
Home Finance |
Personal Data processed: name, Emirates ID details, passport details, date of birth, nationality, mother's maiden name, banking details, home country address details, employment details, income details, name and contact details of two friends. Processing description: We will obtain Consent for checking your credit score with AECB. We will obtain Consent to pull a statement from the UAE Central Bank. Processing form: physical and digital platform. |
Consent |
Mutual Funds |
Personal Data processed: name, information on your current investments at ADCB, previous experience with investments, liquidity, return expectations, time horizon, subscription amount, account number, address, profession, country, nationality, DOB, source of funds, contact details, joint account holder info, redemption amount, units, and signature. Processing description: The Personal Data is processed to assess your risk profile and tolerance towards investment, and ultimately your investment strategy, and give you access to our investment management. Your Personal Data may be shared with Authorities upon request. Processing form: digital platform, risk profile questionnaire, subscription form, redemption form. |
Consent |
Sukuks |
Personal Data processed: name, information on your current investments at ADCB, previous experience with investments, liquidity, return expectations, time horizon, and signature. Processing description: The Personal Data is processed to assess your risk profile and tolerance towards investment, and ultimately your investment strategy, and to take instructions to execute on behalf of you. Your Personal Data may be shared with Authorities upon request. Processing form: digital platform, email attachments, Sukuk execution form. |
Consent |
Loans |
Personal Data processed: name, account number, bank account information, bank account number, bank statements, CID, company entity, contact information, contract type, date of birth, home address, job title role, Emirates ID details, office location, passport information, salary wage, signature. Processing description: We process your Personal Data in order to consider and process your application for a loan with us. Processing form: physical and digital platform, relevant loan application form. |
Consent |
Cheques |
Personal Data processed: name, account number, bank account information, bank account number, bank statements, CID, compensation information, date of birth, gender, home address, marital status, Emirates ID details, nationality, parents names, passport details, contact information, signature. Processing description: We process your Personal Data in order to consider and process your application for a cheque book. Processing form: physical and digital platform, relevant cheque book application form. |
Consent |
Guarantees |
Personal Data processed: name, account number, bank account information, bank account number, CID, contact details, home address, letter communication, signature. Processing description: We process your Personal Data in order to consider and process your application for a guarantee. Processing form: physical and digital platform, Letter of Guarantee application, third party indemnity (if the guarantee is to be issued on behalf of a third party). |
Consent |
Transactions Processing | We process your Personal Data in order to process transactions to and from your account. | Consent |
Declined Onboarding | If your application is declined, we will store your personal information in accordance with our record retention procedures and to comply with our legal obligations. | Consent |
Regulatory and Law Enforcement Requests | We may process your Personal Data to handle requests and instructions from regulators, law enforcement departments and the Ministry of Interior that ask for information about specific individuals. | Compliance with a legal obligation |
Dispute Resolution | We may process your Personal Data to resolve disputes. | Consent and compliance with a legal obligation |
Issuance of letters and certificates | We process your Personal Data in order to consider and process requests for letters/certificates, e.g., liability certificate. | Consent |
Digital Banking | We process your Personal Data in order to facilitate your use of our online banking services via website and mobile applications. | Consent |
FacePass |
We process and share your facial biometric data with a third party service provider and a UAE Government Authority for verification against UAE Government records, to confirm your identity.
The use of FacePass is optional. You may consent and opt-in to use FacePass by turning the feature on or off in the Mobile App or Internet Banking. Activation of FacePass will result in FacePass being the sole permitted means of authentication for certain transactions, to which the FacePass applies. Other means of authentication, such as by a One-Time-Password (OTP), may automatically be deactivated once FacePass has been activated.
When you activate FacePass, your photograph is collected, processed and stored by ADCB for the purpose of identification and verification, in order to authenticate your financial and nonfinancial transactions. |
Consent |
Account Administration |
We process your Personal Data in order to administer your account in a number of ways. This will include, for example, providing you with account statements, notices, and other information such as changes to your profit rate, managing any arrears on your account, enforcing any security that we have in place, and dealing with any queries or complaints you may have including data privacy requests and complaints. This type of Processing is necessary for the performance of our contract with you and to comply with our legal obligations. |
Consent |
KYC Update |
Personal Data processed: Emirates ID, passport copy, income proof, address proof, Visa copy, and Email ID. Processing description: The KYC process is mandatory for identification and verification of your identity when opening an account, and also periodically over time. The objective of the KYC is to prevent the Bank from being used by criminal elements for money laundering activities. Your Personal Data may be shared with Authorities upon request. Processing form: digital platform, email attachments, CIF update from branches, internet banking. |
Consent |
Business Operations | We may process your Personal Data to manage and improve our business operations, for example, our internal governance functions, which may include monitoring communications and activities in relation to your account. Such Processing may be necessary for our business and compliance purposes, accounting and audit purposes and to comply with our legal obligations. | Consent |
Marketing |
We may process your Personal Data for marketing purposes to provide you with information about products and services that you may be interested in. This also includes for the purposes of conducting market research and related statistical analysis to understand our Customer base and the markets in which we operate, or may wish to operate. We will obtain Express Consent before using and sharing your Personal Data for direct marketing or transferring the Personal Data to any third parties for direct marketing. You may place your request to stop receiving marketing messages at any time. In order to do so, follow guidance in section “Marketing From Us” of this Notice. |
Consent |
Websites | The Personal Data that we process when you are browsing our Websites, such as your Internet Protocol (“IP”) address is processed so that we can create, manage, monitor, improve and maintain your experience on our Websites. | Consent |
Retention | After your agreement has ended we will retain your Personal Data in accordance with our record retention procedures and to comply with our legal obligations and Applicable Law. | Consent |
We may collect your Personal Data from two primary sources
Directly From You
We may collect your Personal Data directly from you in a number of ways, including the following:
Indirectly From Other Parties
We may obtain your Personal Data indirectly from third parties in the following ways:
Where we need to collect Personal Data due to applicable legislative requirements or professional standards and you fail to provide that data when requested, we may have to decline a request for services or, if we are already supplying services, suspend or stop providing you with our services. We will notify you if this is the case at the time.
The security of your Personal Data is important to us. We have designed and implemented appropriate measures to prevent your Personal Data from being disclosed, modified or destroyed without sufficient authorisation. These measures address several dimensions of data security including and not limited to the following:
Whilst we take measures to secure your Personal Data, risks to data security do exist, and there is always a possibility of unauthorised use, disclosure, modification and/or destruction of your Personal Data. In the event of such a Personal Data Breach, within the limits of Applicable Law, we will notify you about it and its likely consequences, measures taken by us to mitigate the increased risk and avenues available to you to mitigate the risk as a result of the Personal Data Breach.
For reporting Personal Data Breaches or further information on how we respond to and handle Personal Data Breaches, please contact us at dataprivacy@adcb.com.
If you want to exercise any of your rights, please submit a request through our Data Subject Rights Portal or contact our Data Protection Officer (“DPO”) in writing at dataprivacy@adcb.com. Your rights in relation to our Processing of your data may differ based on your relationship with us as per Applicable Law. Your rights are outlined in the table below:
Description of Your Relationship With Us | Your Rights |
Consumers |
Right of access: you are entitled to request access to the information that we process about you.
Right to rectification: under certain circumstances, you have the right to have inaccurate Personal Data about yourself rectified or completed if it is incomplete.
Right to complain: you have the right to contact us with any inquiries or complaints in respect of your Personal Data Processing.
Right to Withdraw Consent: you have the right to withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent. Unless specified otherwise, the withdrawal will take effect within 30 complete days upon receiving your request.
|
All Other Data Subjects (e.g. Website Visitors, Contractors) |
Right of access: you are entitled to request access to the information that we process about you.
Right to request Personal Data portability: if you have provided information to us directly, the right to data portability allows you to obtain and easily reuse (move, copy or transfer) your Personal Data for your own purposes from one IT environment to another, securely and without affecting its usability.
Right to rectification: under certain circumstances, you have the right to have inaccurate Personal Data about yourself rectified or completed if it is incomplete.
Right to erasure: you have the right to ask to have your Personal Data erased. We may have the right to refuse a request for erasure in some circumstances, for example where the Personal Data is required for compliance with the law or in connection with legal claims.
Right to restrict Processing: under certain circumstances, you are entitled to ask us to restrict the processing of your Personal Data.
Right to stop Processing: under certain circumstances, you have the right to stop the processing of your Personal Data. For example if your Personal Data is being used for direct marketing, statistical surveys and/or in contravention with the Applicable Law.
Rights in relation to automated decision making and Profiling: you have the right not to be subject to a decision based solely on Automated Processing, including Profiling, which could produce legal effects, i.e. something which adversely affects your legal rights. You have the right to obtain an explanation of a decision made by automated means and to challenge it.
|
ADCB will maintain the following obligations in relation to your rights concerning our Processing of your Personal Data:
Modalities to exercise your rights: If you want to exercise any of your rights, please submit a request through our Data Subject Rights Portal or contact our DPO in writing at dataprivacy@adcb.com.
Services at no charge: We will not charge you a fee for facilitating the exercise of your rights. In case of a repetitive or excessive request from you, we will either charge you a reasonable fee taking into account the administrative costs, or we may decide to not act on your request.
Notification to third parties if applicable: If you exercise your right to erasure, rectification or restriction of Processing, we will communicate this with applicable Processors or joint Controllers to ensure your wishes are executed as applicable.
Your Identification: In order to protect your Personal Data, we will request an identity document to verify your identity.
Notification of inaction if applicable: If we are unable to take action in response to your requests to exercise your rights, we will inform you along with the reasons for our inability to take action. We will also, in such cases, remind you of your right to lodge a complaint with the relevant Data Protection Regulator and seek a judicial remedy.
Throughout the course of your relationship with ADCB and even after its conclusion, your Personal Data may need to be shared with Processors who are both internal and external to ADCB. Under certain circumstances, within the permits of Applicable Law, this will involve us transferring your data outside the UAE.
If we need to transfer our Customer’s Personal Data outside the UAE, we will obtain Consent from them for such transfers as well as informing them as appropriate in a separate just in time notice.
In addition, we will take such steps as are necessary to ensure appropriate safeguards apply to maintain the same levels of protection as required under Applicable Law. These safeguards include, but are not limited to:
Equal Data Protection standards: we may transfer your Personal Data to jurisdictions outside the UAE if they have Data Protection legislation in place covering key Data Protection provisions.
Bilateral or multilateral agreements relating to Data Protection are in place between UAE and a state to which Personal Data is transferred.
Derogations: we may transfer your Personal Data outside the UAE on the basis of the following derogations:
We will only retain your Personal Data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances you can ask us to delete your data. For further information, please see section “Your Rights in Relation to Our Processing of Your Personal Data”.
You will only receive direct marketing communication from us where we have obtained your Express Consent.
You may place your request to stop receiving marketing messages at any time by following the opt-out links on any marketing message sent to you or by contacting the ADCB Customer Care Team on the following numbers: within UAE 600 50 2030, outside UAE +971 2 6210090 at any time.
Where you opt-out of receiving our marketing messages, this will not apply to Personal Data provided to us for other purposes.
We may share your Personal Data with the parties set out below for the purposes set out in this Notice:
Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your Personal Data in the same way as set out in this Notice.
We require all third parties to respect the security of your Personal Data and to treat it in accordance with the law. We do not allow third parties to use your Personal Data for their own purposes and only permit them to process your Personal Data for specified purposes and in accordance with our instructions.
Term | Definition |
ADCB | means Abu Dhabi Commercial Bank PJSC and any of its branches, successors and assignees. |
Authority(ies) | means legal, supervisory, regulatory, governmental and quasi-governmental bodies such as the UAE Central Bank, the Securities and Commodities Authority (“SCA”), fraud prevention agencies, tax authorities etc. |
Automated Processing | means Processing that is conducted using an electronic application or system that operates automatically, either independently without any human intervention or under the supervision and limited intervention of a human. |
Applicable Law(s) | means all Applicable Law(s) relating to the Processing of Personal Data and privacy, in each case which are in force at the date on which this policy is updated in the UAE including the UAE Data Protection Law as well as the UAE Central Bank Consumer Protection Regulation and accompanying Consumer Protection Standards as amended. |
Biometric Data | means any Personal Data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of the Data Subject, which allow the identification or confirm the unique identification of the Data Subject, such as facial images or fingerprints. |
Central Bank of the United Arab Emirates or UAE Central Bank | means the Central Bank of the United Arab Emirates. |
Consent | means the Consent by which the Data Subject authorises ADCB or third parties to process his Personal Data, provided that such Consent is clear, specific and unambiguous indication of the Data Subject's agreement, by a statement or by a clear affirmative action, to the Processing of his Personal Data. |
Consumer Protection Regulation or CPR | means the Consumer Protection Regulation of the Central Bank of the United Arab Emirates, and accompanying Consumer Protection Standards that apply to all Licensed Financial Institutions licensed by the Central Bank in relation to their activities specified in Article 65 of the Decretal Law No. 14 of 2018. |
Consumer Protection Standards or CPS |
means the Consumer Protection Standards of the Central Bank of the United Arab Emirates that accompany the Consumer Protection Regulation and apply to all Licensed Financial Institutions licensed by the Central Bank in relation to their activities specified in Article 65 of the Decretal Law No. 14 of 2018. |
Consumer(s) | means a Customer for the purpose of UAE Central Bank Consumer Protection Regulation and the accompanying Consumer Protection Standards. A Customer is any natural person or sole proprietor who obtains or may prospectively obtain services and/or products from ADCB, with or without charge, to satisfy their personal need or others’ needs. |
Controller(s) |
means, as per the CPS, a natural or legal person, public authority, agency, or other body that has the authority over the Processing of Personal Data. This entity is the focus of most obligations under privacy and Applicable Law. It controls the use of Personal Data by determining the purposes for its use and the manner in which the data will be processed specific to their biological, physical, biometric, physiological, mental, economic, cultural or social identity. means, as per the UAE Data Protection Law, the establishment or the natural person who is in the possession of the Personal Data and who, by virtue of its activity, alone or jointly with other persons or establishments determines the means, methods, criteria and purposes of the Processing of such Personal Data. |
Customer(s) | means anyone who uses, participates in, purchases or subscribes to any ADCB Offering. |
Data Breach(es) |
means, as per the CPS, any unauthorised or accidental loss, misuse, modification, access, disclosure or Destruction of Personal Data. means, as per the UAE Data Protection Law a breach of information security and Personal Data through unauthorised or unlawful access thereto, including replication, transmission, distribution, exchange, transfer, communication or Processing in such a manner leading to the disclosure or divulgence to third parties, or otherwise the destruction or modification of such data while being stored, transferred and processed. |
Data Protection | means the protection of Personal Data. |
Data Protection Officer or DPO | means any natural or legal person appointed by the Controller or the Processor who undertakes responsibilities to verify that the entity he belongs to complies with the Personal Data Protection controls, requirements, procedures and rules provided for herein, and to verify the integrity of its systems and procedures to achieve the compliance with the provisions hereof. |
Data Protection Regulator | means any governmental or regulatory body or authority with responsibility for monitoring or enforcing Applicable Law, for example the UAE Central Bank, as per the CPS and The Emirates Data Office (“The Office”), as per the UAE Data Protection Law. |
Data Subject(s) |
means, as per the CPS, any individual, who can be identified (either directly or indirectly) through one or more elements of Personal Data that are collected, used, shared, or otherwise processed as part of ADCB’s operations. means, as per the UAE Data Protection Law, the natural person to whom Personal Data relates. |
Data Subject Right(s) | means the set of rights afforded to individuals located in UAE, as per Applicable Law, who request information about the Personal Data collected or stored by ADCB and to exert choice or control over how that data is used by ADCB in accordance with Applicable Law. |
Destruction of Personal Data | means Personal Data no longer exists. |
Employee(s) | means full time staff of ADCB. |
Express Consent | means an indication that the Data Subject has given an active, clear and unambiguous agreement for their Personal Data to be used in a specific way, including, for example by signing a document, sending an email. |
Know Your Customer or KYC | means mandatory requirements to ensure updated information about ADCB’s Customers, to perform identity verification and prevention of illegal transactions through the business relationship with ADCB such as money-laundering, identity theft. |
Loss of Personal Data |
means that the Controller has lost control or access to the Personal Data. |
Personal Data | means any data relating to an identified natural person, or a natural person who can be identified, directly or indirectly, through the linking of data, by reference to an identifier such as his name, voice, image, identification number, online identifier, geographical location, or one or more physical, physiological, economic, cultural or social characteristics. Personal Data includes Sensitive Personal Data and Biometric Data. |
Processing | means any operation or set of operations performed upon Personal Data using any electronic means including the Processing or other means, including collection, storage, recording, organisation, adaptation or alteration, communication, modification, retrieval, exchange, sharing, use, description, disclosure by broadcasting, transmission, dissemination, or otherwise making available, formatting, merging, restriction, blocking, erasure, destruction or creation of a model of Personal Data. |
Processor(s) | means an establishment or a natural person who processes Personal Data on behalf of the Controller and under his supervision and instructions. |
Profiling | means a form of Automated Processing consisting of the use of Personal Data to evaluate certain personal aspects relating to the Data Subject. |
Recipient(s) |
means the entity to whom Personal Data is transferred. Target sectors to which Personal Data is transferred include, but is not limited to:
|
Sensitive Personal Data | means any data that directly or indirectly reveals a natural person’s family, ethnic origin, political or philosophical views, religious beliefs, criminal record, Biometric Data, or any data related to such person’s health and consisting of his physical, psychological, mental, cognitive, genetic or sexual status, including any information related to the provision of healthcare services to him which reveal his health condition. |
UAE | means the United Arab Emirates. |
UAE Data Protection Law |
means Federal Decree-Law No. 45 of 2021 Regarding the Protection of Personal Data issued by the Cabinet of United Arab Emirates. Document Reference No.: Version No.: 1.0 Document uncontrolled when printed |
Document Classification: Internal | Date of Issue: 28/2/2022 |