Privacy Policy

BAMO MENA INTERNATIONAL SERVICES FZCO ("BAMO", "we", "us" or "our") is a company licensed by the International Free Zone Authority (IFZA), Dubai, United Arab Emirates, under licence no. 91463. We provide Corporate Service Provider, IT Services and Consulting Services.

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains what personal data we collect, why we use it, who we share it with, how long we keep it, and the rights you have. It applies when you visit www.bamo.ae and our subdomains (the "Website") or otherwise deal with us, and it is written to comply with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and, where they apply to you, other data protection laws.

1. Who this policy applies to

This policy applies to:

• visitors to our Website and people who contact us or attend our events;
• prospective and current clients, and their directors, shareholders, ultimate beneficial owners, authorised signatories, representatives and other connected individuals (each an "Affected Person");
• Independent Business Partners, applicants and their key individuals; and
• suppliers, service providers and other business contacts.

BAMO personnel are covered by a separate internal notice.

2. Who we are and our role

For the purposes of the PDPL, we act in two capacities:

Controller. We decide why and how personal data is used when we operate the Website, market our services, onboard and screen clients, manage Independent Business Partners, meet our legal obligations and run our business. This policy mainly covers this role.

Processor. When we deliver CaaS, corporate or IT services, we may handle personal data (for example, employee, shareholder or customer records) on behalf of a client and on the client's instructions. In that case the client is the controller and is responsible for informing you and for its own lawful basis. We handle that data only as set out in our agreement with the client.

For all privacy questions, rights requests and complaints, contact p.reddy@bamo.ae.

3. Personal data we collect

The personal data we collect depends on how you deal with us. It may include:

• Identity and KYC data: full name, former names, date of birth, nationality, gender, photograph, passport, Emirates ID and other government ID details, residence and visa details, signature, tax identification number, and the results of identity verification, including liveness or facial matching where you use that feature.
• Contact data: address, email, phone number and messaging or social media handles.
• Business and professional data: employer, job title, role in a company, shareholding or control, professional licences and registrations, qualifications and CV details.
• Financial data: bank account and IBAN details, billing details, invoices, payments and payment history, source of funds and source of wealth information.
• Due diligence and screening data: sanctions, politically exposed person (PEP) and adverse media screening results, and information from public registers and other lawful sources. This may include information about alleged or actual offences, which we process only where the law requires it.
• Client Data: personal data contained in the documents and records that clients give us to deliver our services.
• Independent Business Partner data: application and agreement details, Client Introduction Records, performance and earnings information, and declarations of independence.
• Communications data: emails, call notes, meeting records and support requests, and your marketing preferences.
• Technical data: IP address, approximate location, browser and device type, operating system, pages viewed, referring site, dates and times, and cookie identifiers.

We do not intentionally collect health data, data about your race, religion or political opinions, or data about children. If we need data of that kind, we will ask for it only where the law requires or you give explicit consent.

Providing data is generally voluntary, but we cannot onboard you, provide services or enter into an agreement without the data that the law or our service requires. In particular, we cannot complete client or partner due diligence without it.

How we collect it

• From you when you complete a form, apply, sign an agreement, send us documents, communicate with us or use our Website.
• From clients and Independent Business Partners who introduce you, or who give us details of directors, shareholders, beneficial owners or other connected people.
• From other sources, such as public registers, sanctions and PEP lists, professional directories and social media profiles you make public, banks and other institutions, authorities and screening providers.
• Automatically through cookies and similar technologies when you use our Website.

4. Why we use your personal data and our legal basis

We use personal data only for specific purposes and only where the law allows it. The PDPL allows processing with your consent and, in certain defined cases, without it (for example, where processing is needed for a contract with you, to comply with UAE law, or to establish, exercise or defend legal claims).

Where the law of another country applies to you (for example, the EU or UK GDPR), we also rely on the legal bases that law provides, including legitimate interests for securing our systems and running our business in ways you would reasonably expect.

Where we rely on your consent, you can withdraw it at any time by emailing p.reddy@bamo.ae or using the unsubscribe link in our messages. Withdrawal does not affect processing that happened before you withdrew, or processing that we must carry out for another lawful reason.

Automated tools and decisions

We use technology to help with identity verification and sanctions, PEP and adverse media screening. These tools produce alerts only. A trained member of our team reviews each alert, and we do not make decisions that have a legal or similarly significant effect on you based solely on automated processing. You can ask us to explain a decision or to review it again.

5. Who we share your personal data with

We do not sell your personal data, and we do not share it for third parties' own marketing. We share personal data only where necessary and only with the following kinds of recipient:

Legal confidentiality. UAE law may prohibit us from telling you or anyone else that we have made, or are considering making, a report to the authorities, and may require us to share data without notifying you.

6. Transfers outside the UAE

We are based in the UAE, but some of our service providers, banks and clients are located elsewhere, so your personal data may be transferred to and processed in other countries.

The PDPL allows us to transfer personal data outside the UAE where one of the following applies, and we apply these protections:

• the destination country or sector has been recognised as providing an adequate level of data protection;
• we have a binding contract with the recipient (for example, standard contractual clauses) that requires protection equivalent to the PDPL;
• the transfer is necessary to perform or conclude a contract with you, or a contract in your interest;
• the transfer is necessary to establish, exercise or defend legal claims, or to comply with a legal obligation; or
• you have given your explicit consent, after being told of the risks.

If you are in the European Economic Area or the UK, we use the European Commission and UK standard contractual clauses or another lawful transfer mechanism where required. Contact p.reddy@bamo.ae for more information about the safeguards we use.

7. How long we keep your personal data

We keep personal data only as long as needed for the purposes in this policy and to meet our legal obligations. The periods below are the maximum we usually apply; some records must be kept longer if the law, an inspection, an investigation or a proceeding requires.

When the retention period ends, we delete or irreversibly anonymise the data. Data in backups is overwritten in the ordinary backup cycle.

8. Your rights

Subject to the PDPL and other applicable law, you have the right to:

How to exercise your rights. Email p.reddy@bamo.ae and tell us which right you want to exercise and which data it concerns. We may ask you to verify your identity first. We acknowledge requests within 48 hours and respond within 30 days, which we may extend where the request is complex or the law allows. We do not charge a fee unless a request is clearly unfounded or excessive.

Limits. Some rights cannot be fully met where we must keep or share the data to comply with UAE law (for example, AML/CFT record-keeping and reporting), protect legal claims, or protect the rights of others. If we cannot act on a request, we will tell you why, unless the law prevents us from doing so.

Complaints. We would like the chance to resolve your concern first, so please contact p.reddy@bamo.ae. You can also complain to the UAE Data Office (or any successor authority) or to the data protection authority where you live.

Additional rights for people in the EEA or UK. If the GDPR or UK GDPR applies to you, you also have the rights set out in that law, including the right to lodge a complaint with your local supervisory authority.

9. Cookies and similar technologies

We use cookies and similar technologies on the Website:

You can change your choices at any time through the cookie settings link on the Website or in your browser settings. Blocking some cookies may affect how parts of the Website work. See our Cookie Policy.

10. Independent Business Partners and introduced clients

Independent Business Partners act independently and are not our employees. When a partner introduces or works with a client, the partner must handle personal data lawfully, keep it confidential, use it only for the introduced client and BAMO's services, and follow the data protection requirements in their agreement with us and our instructions. Partners must give this Privacy Policy, or equivalent information, to the individuals whose data they pass to us. If a partner handles personal data outside BAMO's systems, that partner is responsible for protecting it, and our agreement requires them to tell us immediately of any suspected loss or misuse.

11. Security

We use appropriate technical and organisational measures to protect personal data against accidental or unlawful loss, destruction, alteration, unauthorised disclosure or access. These include:

• encryption of data in transit, and of sensitive data at rest where appropriate;
• role-based access controls and multi-factor authentication for staff and partner systems;
• confidentiality commitments for our staff, partners and processors;
• due diligence on, and written data protection terms with, our service providers;
• secure storage and restricted access for KYC and identity documents;
• regular security reviews, backups, and staff training; and
• an incident response procedure.

If a personal data breach is likely to harm you, we will notify you and the competent authority as the law requires. No system is completely secure. If you suspect your data has been compromised, please contact p.reddy@bamo.ae immediately.

12. Children

Our Website and services are for businesses and professionals and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us data, please contact p.reddy@bamo.ae and we will delete it promptly.

13. Third-party websites and social media

Our Website may link to third-party websites and social media platforms (such as LinkedIn). This policy does not apply to them, and we are not responsible for their privacy practices. Please read their privacy policies. Information you post on our social media pages is public and may be seen by others and by the platform provider.

14. Changes to this policy

We may update this policy to reflect changes in our practices, technology or the law. We will update the "Last updated" date above and, for material changes, notify you by email or a notice on the Website. Please review it from time to time.

15. Contact us

For any privacy question, rights request or complaint: