Privacy Policy

Data protection policy

GAL Business Centre LLC, along with its subsidiaries, branches and associates (hereinafter, “GAL”, “we”, “us”, “our”), recognize the immense value of protection of personal data. In accordance with such recognition, GAL’s Data Protection Policy (hereinafter, the Policy) represents our commitment to treat personal information of employees, customers, stakeholders and other interested parties with utmost care and confidentiality.

This Policy is implemented in compliance with the DIFC Law No. 05 of 2020 for Data Protection and Regulation and the UAE Federal Decree Law No. 45 of 2021 regarding the Protection of Personal Data (PDPD Law) and the UAE Federal Decree Law No. 44 of 2021 Creation of the UAE Data Office established the Data Protection Office. For the purposes of applicable data protection law, GAL Business Centre LLC will be designated as a “data controller” since data submitted to us will be controlled by the GAL. We may, however, at times, assume the role of “processor” depending on the need of the case.

The primary objective of the Policy is to increase user awareness and avoid accidental data loss scenarios, and to ensure that the GAL is compliant with the local laws. In keeping with that, it outlines our plan of action for prevention of a data breach. Via this Policy, we intend to encompass the role of GAL and the responsibilities of management, general staff, and GAL with respect to access and use of that Personal Information. We endeavor to collect, gather, store, and handle personal data fairly, transparently being respectful of an individual’s privacy rights.

While we do not anticipate that the institution of such Policy will be able to eliminate all malicious or negligent data handling, nonetheless, we expect this Policy would serve to be a strong deterrent towards any mishandling of data.

1. Definitions

For the purposes of this Policy, the following terms shall be construed as provided herein:

Personal Data: any information that relates to an identified or identifiable living individual. Different pieces of information, which collected can lead to the identification of a particular person, also constitute personal data, for example a username or surname, a home address, email ID, educational details, digital footprints, photographs, social security numbers, financial data etc.
Processing Data: includes the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction of personal data.
Sensitive Data: high-risk information that must be protected against unauthorized disclosure such as PII (personally identifiable information), PHI (protected health information), biometric data, social security number, bank details, trade secrets, employee information and customer information, intellectual property data, industry-specific data, education records, confidential information etc.
Data Breach: if any data that has been recorded for processing has been used by, or transferred to, any third party without authorization.
Medical Data: personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about that person’s health status. It is also classified as high-risk data.
Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.
Data Retention Policy: an organization’s established protocol for retaining information for operational or regulatory compliance needs.
Third Party: any person authorised to process Personal Data, other than the Data Subject, the Controller, a Joint Controller, the Processor or a Sub-processor.

2. Scope of the policy

This data security Policy applies to all parties including but not limited to employees, job candidates, customers, clients, suppliers, vendors etc. who provide personal data to GAL Business Centre LLC, irrespective of the nature or amount of data disclosed. This Policy applies to all data including corporate data or personal data. It would, hence, apply to every server, database and IT system that handles such data, including any device that is regularly used for email, web access or other work-related tasks including any handsets from the GAL. Every user who interacts with the company’s IT services is also subject to this Policy.

Information that is classified as ‘Public’ is not subject to this Policy. Other data can be excluded from the Policy by company management based on specific business needs. The Policy also applies to all employees, contractors, consultants, partners, and any other external entity who are not under a direct employment contract with the GAL but have been responsible for collecting personal data on behalf of the GAL from individuals. Generally, our Policy will be applicable to anyone we collaborate with or who acts on our behalf and may need access to personal or sensitive data.

3. Purpose of collection of data

The purpose of the Policy extends to the purpose for collection of data and the methods adopted to ensure an ethical and legal processing of the same. In keeping with this, the GAL will ask for data for provision of legal services, communication of relevant material and headway in issues, management of business relationships with clients, compliance with legal obligations like audits, keeping your employment information up to date and for anything ancillary to the above or any other purposes for which your personal data was provided to us.

4. Policy elements

As part of our day-to-day operations, we need to obtain and process information. As a mandate of this Policy, our company aims to collect this information in a transparent way and only with the full cooperation, knowledge and consent of interested parties. Once this information is available to us, the following rules apply. This section outlines the appropriate technical and organizational security measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access, and other unlawful or unauthorized forms of processing, in accordance with applicable law.

Collection of personal data

Any personal data collected shall be collected after the approval and consent of the stakeholders, and the individual will be informed of the employees or individuals who may access the information. The GAL will undertake reasonable steps to ensure that the individual has consented to such processing. The individual will also be informed of the consequences of failing to disclose such information to the GAL, to ensure informed consent has been given.

Personal data may be collected:

directly from individuals;
during the course of GAL’s business relationship;
from GAL’s website, for example cookies and saved preferences;
when you register to use any of GAL’s services, for example records made by interactions;
from third parties, for example law enforcement agencies.

Collection of sensitive data

Sensitive data is highly confidential and is collected transparently and lawfully. Such data may be processed in GAL’s ordinary course of business, such as where processing personal sensitive data is necessary for the establishment, exercise, or defense of legal rights. Prior express consent will be obtained before processing any such personal sensitive data.

Purpose for processing

Personal data is processed broadly for the purposes of operating our business, providing our services to our clients, business communications, compliance with applicable laws and managing our IT services and website. The GAL is well regulated and has a legitimate interest in using information gained from clients where it is necessary or appropriate to provide advice.

Sharing of personal data with third parties

We may disclose received personal data to other GAL entities for legitimate business purposes, in accordance with applicable law and subject to applicable professional and regulatory requirements regarding confidentiality and professional secrecy. In addition, we may disclose your personal data to:

accountants, auditors, lawyers and other outside professional advisors to GAL;
any relevant party for the purposes of prevention, investigation, detection or prosecution of criminal offences, including safeguarding against and the prevention of threats to public security;
external providers of professional and support services (such as word processing, translation, document review and photocopying), which might involve the service provider receiving your relevant information from us;
legal and regulatory authorities, upon request, or for the purposes of reporting any actual or suspected breach of applicable law or regulation.

5. Cross-border transfer of information

In the course of the GAL’s work, we may need to transmit personal data between countries to facilitate the GAL’s business. This may require sharing such information with other professionals in different territories, which entails a transfer of personal information from within Dubai to recipients outside. The level of personal information protection in the various jurisdictions in which the GAL operates varies, and in some instances may not provide an adequate level of protection from an international perspective. To address this, the GAL has procedures and safeguards in place to ensure the protection of personal information. These procedures include contractual obligations to ensure that all such entities safeguard your personal information and use it only for the purposes that the GAL has specified and communicated to you. When we transfer your information to other countries, we will use, share, and safeguard that information as described in this Privacy Notice.

6. Data retention

The GAL does not keep your personal information indefinitely. In the course of carrying out various business activities, we collect information from a wide range of sources and generate a substantial volume of data that is retained as physical paper and/or electronic records. We have appropriate systems and processes in place for the preservation and timely disposal of documents and records in line with business requirements and relevant legislation. In keeping with this, personal data will be erased either on request of the client under circumstances or every five years.

7. Information security

We have implemented security policies, rules, and technical measures to protect the personal data that we have under our control from unauthorized access, improper use and disclosure, unauthorized destruction, or accidental loss. We also have procedures in place to deal with any suspected data breach. We will notify you and any applicable regulator or authority of a suspected data security breach where we are legally required to do so.

8. Changes to this policy

GAL reserves the right to modify or amend the Privacy Policy at any time and for any reason. Please check back to this Privacy Policy from time to time to stay informed. It is your obligation to regularly check the Privacy Policy.