^{ADCB PRIVACY POLICY} Abu Dhabi Commercial Bank PJSC

Personal Data processed:name, contact details, address, Emirates ID details, passport details, date of birth, nationality, employment details, transaction pattern (no of credits/no of debits), source of income, and income details.

Processing description: We process your Personal Data in order to consider and process your application for an account with us. This Processing is necessary in order for us to take regulatory steps at your request before we enter into an agreement with you and is also necessary for deciding whether or not we can offer you the product you have applied for. This type of Processing is required in order for you to enter into an agreement with us.

Personal Data is also required as part of regulatory financial crime protection, including Know Your Customer (“KYC”) process mandated for account opening.

We use your Personal Data to prepare KYC forms, CRS forms, W-8 and W-9 forms, application forms, and to evaluate your Customer profile.

In respect of fraud searches and identity verification, this Processing is necessary for fraud prevention and to comply with our legal obligations.

If you do not provide this information, then we cannot proceed with your application.

Processing form: physical, digital platform, and ADCB mobile applications.

Personal Data processed: name, account number, bank account number, bank statements, CID, credit card number, date of birth, debit card number, home address, Emirates ID details, passport details, phone numbers, contact details.

Processing description: We process your Personal Data in order to consider and process your account closure request and to handle dormant/inactive accounts.

Processing form: physical, digital platform, and ADCB mobile applications.

Personal Data processed: name, Emirates ID details, passport details, date of birth, nationality, your mother's maiden name, banking details, home country address details, employment details, income details, name and contact of two friends.

Processing description: We process your Personal Data in order to consider and process your application for a credit card. Such Processing may include credit assessment, Profiling, and cross sales.

Your Personal Data may be shared with Authorities upon request.

We will obtain Consent to check your credit score with Al Etihad Credit Bureau (“AECB”).

We will obtain Consent to pull a statement from the UAE Central Bank.

Processing form: physical and digital platform.

Personal Data processed: name, Emirates ID details, passport details, date of birth, nationality, mother's maiden name, banking details, home country address details, employment details, income details, name and contact of two friends.

Processing description: We will obtain Consent for checking your credit score with AECB.

We will obtain Consent to pull a statement from the UAE Central Bank.

Processing form: physical and digital platform.

Personal Data processed: name, Emirates ID details, passport details, date of birth, nationality, mother's maiden name, banking details, home country address details, employment details, income details, name and contact details of two friends.

Processing description: We will obtain Consent for checking your credit score with AECB.

We will obtain Consent to pull a statement from the UAE Central Bank.

Processing form: physical and digital platform.

Personal Data processed: name, information on your current investments at ADCB, previous experience with investments, liquidity, return expectations, time horizon, subscription amount, account number, address, profession, country, nationality, DOB, source of funds, contact details, joint account holder info, redemption amount, units, and signature.

Processing description: The Personal Data is processed to assess your risk profile and tolerance towards investment, and ultimately your investment strategy, and give you access to our investment management.

Your Personal Data may be shared with Authorities upon request.

Processing form: digital platform, risk profile questionnaire, subscription form, redemption form.

Personal Data processed: name, information on your current investments at ADCB, previous experience with investments, liquidity, return expectations, time horizon, and signature.

Processing description: The Personal Data is processed to assess your risk profile and tolerance towards investment, and ultimately your investment strategy, and to take instructions to execute on behalf of you.

Your Personal Data may be shared with Authorities upon request.

Processing form: digital platform, email attachments, Sukuk execution form.

Personal Data processed: name, account number, bank account information, bank account number, bank statements, CID, company entity, contact information, contract type, date of birth, home address, job title role, Emirates ID details, office location, passport information, salary wage, signature.

Processing description: We process your Personal Data in order to consider and process your application for a loan with us.

Processing form: physical and digital platform, relevant loan application form.

Personal Data processed: name, account number, bank account information, bank account number, bank statements, CID, compensation information, date of birth, gender, home address, marital status, Emirates ID details, nationality, parents names, passport details, contact information, signature.

Processing description: We process your Personal Data in order to consider and process your application for a cheque book.

Processing form: physical and digital platform, relevant cheque book application form.

Personal Data processed: name, account number, bank account information, bank account number, CID, contact details, home address, letter communication, signature.

Processing description: We process your Personal Data in order to consider and process your application for a guarantee.

Processing form: physical and digital platform, Letter of Guarantee application, third party indemnity (if the guarantee is to be issued on behalf of a third party).

We process and share your facial biometric data with a third party service provider and a UAE Government Authority for verification against UAE Government records, to confirm your identity.

The use of FacePass is optional. You may consent and opt-in to use FacePass by turning the feature on or off in the Mobile App or Internet Banking. Activation of FacePass will result in FacePass being the sole permitted means of authentication for certain transactions, to which the FacePass applies. Other means of authentication, such as by a One-Time-Password (OTP), may automatically be deactivated once FacePass has been activated.

When you activate FacePass, your photograph is collected, processed and stored by ADCB for the purpose of identification and verification, in order to authenticate your financial and nonfinancial transactions. 

We process your Personal Data in order to administer your account in a number of ways. This will include, for example, providing you with account statements, notices, and other information such as changes to your profit rate, managing any arrears on your account, enforcing any security that we have in place, and dealing with any queries or complaints you may have including data privacy requests and complaints.

This type of Processing is necessary for the performance of our contract with you and to comply with our legal obligations.

Personal Data processed: Emirates ID, passport copy, income proof, address proof, Visa copy, and Email ID.

Processing description: The KYC process is mandatory for identification and verification of your identity when opening an account, and also periodically over time. The objective of the KYC is to prevent the Bank from being used by criminal elements for money laundering activities.

Your Personal Data may be shared with Authorities upon request.

Processing form: digital platform, email attachments, CIF update from branches, internet banking.

We may process your Personal Data for marketing purposes to provide you with information about products and services that you may be interested in. This also includes for the purposes of conducting market research and related statistical analysis to understand our Customer base and the markets in which we operate, or may wish to operate.

We will obtain Express Consent before using and sharing your Personal Data for direct marketing or transferring the Personal Data to any third parties for direct marketing. 

You may place your request to stop receiving marketing messages at any time. In order to do so, follow guidance in section “Marketing From Us” of this Notice.

Consumers

All Other Data Subjects (e.g. Website Visitors, Contractors)

Consumer Protection Standards or CPS

Controller(s)

means, as per the CPS, a natural or legal person, public authority, agency, or other body that has the authority over the Processing of Personal Data. This entity is the focus of most obligations under privacy and Applicable Law. It controls the use of Personal Data by determining the purposes for its use and the manner in which the data will be processed specific to their biological, physical, biometric, physiological, mental, economic, cultural or social identity.

means, as per the UAE Data Protection Law, the establishment or the natural person who is in the possession of the Personal Data and who, by virtue of its activity, alone or jointly with other persons or establishments determines the means, methods, criteria and purposes of the Processing of such Personal Data.

means, as per the CPS, any unauthorised or accidental loss, misuse, modification, access, disclosure or Destruction of Personal Data.

means, as per the UAE Data Protection Law a breach of information security and Personal Data through unauthorised or unlawful access thereto, including replication, transmission, distribution, exchange, transfer, communication or Processing in such a manner leading to the disclosure or divulgence to third parties, or otherwise the destruction or modification of such data while being stored, transferred and processed.

means, as per the CPS, any individual, who can be identified (either directly or indirectly) through one or more elements of Personal Data that are collected, used, shared, or otherwise processed as part of ADCB’s operations.

means, as per the UAE Data Protection Law, the natural person to whom Personal Data relates.

Loss of Personal Data

means the entity to whom Personal Data is transferred.

Target sectors to which Personal Data is transferred include, but is not limited to:

• Bank’s branches, subsidiaries, affiliates or other persons controlled by the Bank, or any person under common control with the Bank, in each case, whether directly or indirectly.
• Anyone that ADCB reasonably believes to be acting on your behalf with authority to do so, such as payment recipients, beneficiaries of your account, nominees, intermediaries, correspondent and agent banks, clearing houses, clearing or settlement systems, market counterparties, upstream withholding agents, swap or trade repositories, stock exchanges or companies in which you have an interest in securities (where such securities are held by ADCB for you), a debt charity, power of attorney or your professional advisors.
• Legal, supervisory, regulatory, governmental and quasi-governmental bodies such as the United Arab Emirates Central Bank, the Securities and Commodities Authority (“SCA”), fraud prevention agencies, tax authorities, our professional advisors, tribunals and/or the courts.
• Government-authorised credit reference/information agencies and bureaus including, but not limited to AECB, for the purposes of obtaining or providing credit references and other information to assess your ability to meet your commitments.
• Any rating agency, insurer or insurance broker, or direct or indirect provider of credit protection to the Bank in connection with the products and services provided by the Bank.
• Organisations that provide us with business support services. For example, account service and administration companies, back-up and server hosting, IT software and maintenance and platforms, document storage and management services. This processing is undertaken as it is necessary for the performance of our agreement with you.
• Any party for the purpose of enforcing or preserving ADCB’s rights against you when it is necessary for the establishment, exercise or defence of legal claims;
• Third parties who have introduced you to us (e.g. an intermediary or broker) in order for them to manage their records about you, to ensure that the type of business that they refer to us is appropriate and to help us to resolve any complaint made by you and/or any dispute between you and us. This type of processing allows us to ensure that the intermediary or broker is fulfilling the terms of their contract with us and in order for us to fulfil our legal obligations (e.g. our complaint-handling obligations).
• Market research organisations who we engage to assist us in developing and improving our products and services.
• Any person or entity that provides services to you through ADCB as an intermediary, including investment management or insurance services and in relation to additional products and services.
• Any party to a transaction acquiring an interest in, or assuming risk in, or in connection with, your banking relationship with ADCB.
• Any person or entity that is to provide, or has provided, any security of guarantee (and their professional advisors) in respect of your agreement with us and their professional advisors. This type of processing is necessary for the fulfilment of our contract with you, for example to enable us to recover any sums we have advanced under our agreement with you.
• Any entity (and their professional advisors) that provides funding to us or members of the Bank's group, any entity that provides us with debt or equity finance and any potential purchasers of any part of our business. This type of processing is necessary to enable us to fund our business.
• Any entity used for recovery or collection of receivables to the bank from delinquent or defaulted Customers.

• As required by any relevant legislation.

means Federal Decree-Law No. 45 of 2021 Regarding the Protection of Personal Data issued by the Cabinet of United Arab Emirates.

Document Reference No.:

Version No.: 1.0

Document uncontrolled when printed