^{Privacy Notice} Al Hilal Bank PJSC Privacy Notice

1.1. Al Hilal Bank PJSC (“Al Hilal Bank”, “AHB”, “Bank”, “We” or “Our”)

1.2. Data Protection in Al Hilal Bank is regulated by the United Arab Emirates ("UAE") Data Protection Law and the Central Bank of the UAE Consumer Protection Regulation and accompanying Consumer Protection Standards.

1.3. Our Contact Information

• Email: [email protected]

2.1 Al Hilal Bank is committed to protecting your privacy and your Personal Data.

2.2. This Privacy Notice ("Notice") aims to help you understand what Personal Data we collect, store or process about you, the legal basis on which we do so, the purpose for which we do so, if and whom we share your Personal Data with. This Notice also describes how long we retain your Personal Data.

2.3. This Notice describes your rights and the choices you can make in relation to our collection, use and disclosure of your Personal Data.
This Notice details:

• the Personal Data we Process about you
• the legal basis and purpose of that Processing
• if and whom we share your Personal Data with
• how long we retain your Personal Data
• your data privacy rights and choices regarding the Personal Data we process about you
• the various measures we have in place to protect the security of your Personal Data and minimise the potential for its unauthorised use, disclosure and destruction

2.4. The terms of this Notice will apply to you when you use our products or services, visit our online services at www.alhilalbank.ae and any of its ancillary pages and websites (the "Websites"), or provide us with your Personal Data.

2.5. Please review this Notice periodically as we may update it from time to time to reflect changes in our data practices.

2.6. Al Hilal Bank may change this notice from time to time if required by law or where there are any changes to its business practices.

3.1. Controller
A Controller is an entity who solely, or jointly with others, determines the purposes (“why”) and means (“how”) of Personal Data Processing. In most cases, we will act as the Controller when Processing your Personal Data – this means we will decide on how to collect, process and use Personal Data in this role.

3.2. Processor
A Processor is an entity who processes Personal Data on behalf of another entity, i.e. the Controller, and does so solely based on instructions provided by the Controller.

In some cases, Al Hilal Bank will act as the Processor when Processing your Personal Data on behalf of another group entity. In these cases, Al Hilal Bank will perform the Processing of the Personal Data under the specific instructions from the group entity acting as the Controller.

4.1. What is Personal Data?
Personal Data means data which relates to a living individual who can be identified directly or indirectly from that data. The definition includes a wide range of personal identifiers that constitute Personal Data, including names, identification numbers, location data or online identifiers, reflecting changes in technology and the way organisations collect information about people.

Examples of Personal Data include the following:

• name;
• national origin, age, language, birth, education;
• date of birth;
• gender or sex (for statistical purposes as required by the law),marital status (married, single, divorced);
• identification number (e.g. national ID, passport number, NI number, and drivers licence number);
• location data (e.g. GPS coordinates);
• information about a customer’s location (e.g. geolocation or GPS location);
• online identifiers;
• social media profiles;
• photographs, videos, voice recordings;
• employment history and current employment status (for example when a customer applies for finance);
• financial data/ financial history (e.g. income, expenses, obligations, assets and liabilities or buying, investing, insurance, banking and money management behaviour or goals and needs based on, amongst others, account transactions);
• contact information, telephone, mobile, fax numbers email address; physical address (e.g. residential address, work address or physical location);
• biometric information (e.g. fingerprints, signature or voice);
• race (for statistical purposes as required by the law);
• physical health, mental health, wellbeing, disability, religion, belief, conscience, culture;
• medical history, criminal history, employment history;
• transactional data;
• website technical data: e.g. your internet protocol (IP) address, website login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our website; and
• website profile and usage data: e.g. your interests, preferences, feedback and survey responses, information about how you use our websites, transaction details while performing online payments: e.g. merchant name, location, device used.

4.2. What is Processing?
Processing means doing anything with Personal Data, e.g. viewing, collecting, using, storing, sharing, manipulating, printing, copying, archiving etc.

Processing activity means any task that involves doing anything with Personal Data.

In this Notice the term “process or processing” explains how we collect, use, store, make available, destroy, update, disclose, or otherwise deal with your Personal Data. As a general rule, we will only process your Personal Data if this is required to deliver or offer a product or service to you or comply to a regulatory requirement. The Bank respects customers’ privacy and ensures its duty of confidentiality is maintained throughout our relationship with you.

Al Hilal Bank will obtain Express Consent from you to serve you with products and services, as per the Central Bank of the UAE’s Consumer Protection requirements. You should be aware that you have the right to withdraw your Consent at any time. You can do this by contacting us at [email protected]. However, this will not affect the lawfulness of any processing carried out before you withdraw your Consent.

We have set out a description of why we process your Personal Data in the table below, including what personal data we collect, and the legal basis for such processing.

We may collect your Personal Data from two primary sources:

6.1. Directly From You

We may collect your Personal Data directly from you in several ways, including the following:

• When you apply for any product on our application, through a postal application, telephone or directly with one of our Employees
• When you provide your Personal Data online or by any other method of communication, or when you provide it on the merit of your relationship with Al Hilal Bank, for example, if you inform us of a change in your circumstances
• When you visit our Websites, technical information, including the IP address used to connect to the internet, may be collected from you

6.2. Indirectly from Other Parties

We may obtain your Personal Data indirectly from third parties in the following ways:

1. Following an introduction to us by another third party, such as an accountancy firm, law firm or management consultancy

2. If another person provides your information to us when they apply to obtain a product from us:

• on your behalf
• that is to be held jointly with you
• on behalf of any other organisation of which you are a director, shareholder, owner, trustee or beneficiary (as applicable)
• where they have nominated you as a guarantor under our agreement with them, or to provide any other security, or occupier of any security property

3. When we carry out searches for the purposes of processing your application and/or during the course of your relationship with us

4. In response to our marketing activities, you request information about our products via a third party (e.g. websites and social media platforms)

If you are applying to us through a third party, then they should have provided you with their own privacy notice in order to inform you how they may process your Personal Data.

In line with the UAE regulations and those of the Central Bank of UAE we may be inclined to collect and transfer personal data with third parties (such as authorised agents, suppliers, and subcontractors) to provide services or comply with regulatory requirements. Failure to provide this data may result in us declining a request or service, or if we are already providing a service, we may have to suspend or stop the same. In the case of such instances, we shall notify the same to you through Just-in-time notices.

To provide banking and other services to you, we may need to process your Personal Data in order to ensure we comply with our legal and regulatory requirements, for example we are obliged to verify the identity of our customers so we may need to process your passport information. If you fail or refuse to provide us with the requested Personal Data we need, we may not be able to supply, or continue to supply, our services to you, and should this occur, we will notify you. We will only ever process your Personal Data where we have a lawful right to do so.

The security of your Personal Data is important to us. We have designed and implemented appropriate measures to prevent your Personal Data from being disclosed, modified or destroyed without sufficient authorisation. These measures address several dimensions of data security including and not limited to the following:

• Asset Security: concepts and principles that ensure the protection of assets, including information assets such as your Personal Data from theft, misuse or destruction
• Access Control: techniques that regulate the ability of various entities to interact with your Personal Data (user authentication), and the degree to which they may do so (user authorisation)
• Cryptography: the use of mathematical algorithms to protect your Personal Data by rendering it unreadable using methods such as encryption and hashing
• Network Security: concepts and principles that secure our telecommunication networks appropriately to ensure your Personal Data flowing through them is not disclosed to unauthorised entities
• Application Security: concepts and principles that ensure our software applications that collect, store and otherwise process your Personal Data are securely developed and operated
• Communications Security: principles that drive secure transmission of your Personal Data across entities
• Physical Security: principles that support a secure physical environment for your Personal Data as it relates to printed hard copy records, for instance
• Organisational Security: concepts and principles that ensure security of your Personal Data through policies, segmented access control and employee training & awareness, for instance

Whilst we take measures to secure your Personal Data and have a robust incident response plan in place, risks to data security do exist, and there is always a possibility of unauthorised use, disclosure, modification and/or destruction of your Personal Data. In the event of a data breach, our robust data incident management process will be triggered, and our incident management response team will be assembled. The incident will be assessed to identify whether a data breach has in fact occurred. Upon confirmation of an actual data breach, there are stringent protocols that we follow to ensure the efficient management of data breaches and compliance with our legal requirements. Our internal protocols enable the immediate containment, investigation and remediation of data breach through the implementation of corrective and preventative measures and an assessment of any regulatory reporting and disclosure requirements. We will communicate with affected parties in compliance with our legal obligations, where the circumstances of a data breach may reasonably pose a risk to their financial and personal security and/or where it may pose reputational harm to affected parties. We will ensure all notifications provide clear and concise information to you and contain all relevant information as required by law.

For reporting Personal Data Breaches or further information on how we respond to and handle Personal Data Breaches, please contact us at [email protected].

If you want to exercise any of your rights, please write to [email protected]. Your rights in relation to our Processing of your data may differ based on your relationship with us as per Applicable Law. Your rights are outlined in the table below:

Al Hilal Bank will maintain the following obligations in relation to your rights concerning our Processing of your Personal Data:

• Modalities to exercise your rights: If you want to exercise any of your rights, please write to [email protected].
• Services at no charge: We will not charge you a fee for facilitating the exercise of your rights. In case of a repetitive or excessive request from you, we will either charge you a reasonable fee taking into account the administrative costs, or we may decide to not act on your request.
• Notification to third parties if applicable: If you exercise your right to erasure, rectification or restriction of Processing, we will communicate this with applicable Processors or joint Controllers to ensure your wishes are executed as applicable.
• Your Identification: If we have reasonable doubts concerning your identity, we may request additional information to verify your identity.
• Notification of inaction if applicable: If we are unable to act in response to your requests to exercise your rights, we will inform you along with the reasons for our inability to take action. We will also, in such cases, remind you of your right to lodge a complaint with the relevant Data Protection Regulator and seek a judicial remedy.

Throughout the course of your relationship with Al Hilal Bank and even after its conclusion, your Personal Data may need to be shared with Processors who are both internal and external to Al Hilal Bank. Under certain circumstances, within the permits of Applicable Law, this will involve us transferring your data outside the UAE.

If we need to transfer your Personal Data outside the UAE, we will:

• Obtain your Consent for such Personal Data transfers
• Comply with all relevant regulatory requirements
• Provide you with any additional information (as and when required) for you to be able to make an informed decision.

• In addition, we will take such steps as are necessary to ensure appropriate safeguards apply to maintain the same levels of protection as required under Applicable Law. Where we are permitted to transfer your Personal Data outside the UAE, one or more of these safeguards apply, but are not limited to:

  1. Equal Data Protection standards: we may transfer your Personal Data to jurisdictions outside the UAE if they have Data Protection legislation in place covering key Data Protection provisions. The country to which the data is being transferred has local legislation that includes the main provisions, measures, controls, conditions and rules for protecting the confidentiality and privacy of the Personal Data, including the Data Subject’s individual rights; A contract or agreement which applies the provisions, measures, controls and requirements of the UAE Data Protection Law will be signed between us and the Data Recipient (entity outside the UAE).

  2. Bilateral or multilateral agreements relating to Data Protection are in place between UAE and a state to which Personal Data is transferred.

  3. Derogations: we may transfer your Personal Data outside the UAE based on the following derogations:

  • the establishment, exercise or defence of legal claims
  • the performance of a contract between you and Al Hilal Bank or for the implementation of pre-contractual measures at your request
  • the conclusion or performance of a contract concluded in your interest between Al Hilal Bank and another natural or legal person
  • the performance of an act relating to international judicial cooperation
  • protection of public interest

We will only retain your Personal Data in a form that permits your identification for a minimum period of 5 years from the termination of our business relationship (such as closure of your account) or a completion of transaction (in instances where we do not have a business relationship with you) but not longer than necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

At the expiry of the stipulated retention periods, your Personal Data will be destroyed irreversibly (where possible) in order to comply with legal retention obligations or in accordance with applicable statutory limitation periods. Where it is impossible or impractical to delete your Personal Data, we will de-identify (which will limit reconstruction) your Personal Data in accordance with appropriate safeguards to guard against the record being used for any other purpose. Under certain circumstances, we may be required to retain your Personal Data beyond the defined retention period as stated in the initial purposes of processing for legal, regulatory, or legitimate business purposes. In such cases, we apply appropriate security measures to ensure the confidentiality and integrity of archived data. As and when we no longer retain your Personal Data, in accordance with this Notice, we shall ensure its secure destruction or de-identification in accordance with our internal data destruction procedure.

You will only receive marketing communications from us if you have consented to receive such communications.

You may request to stop receiving marketing messages at any time by following the opt-out links on any marketing message sent to you or by contacting the Al Hilal Bank Customer Care Team on [email protected] at any time. When you opt-out of receiving these marketing messages, it will not apply to personal data provided to us for other purposes.

We will only use your personal data for specified, explicit and legitimate purposes which are compatible with the purposes determined at the time we collect the personal data.

If we need to use your personal data for a new and unrelated purpose, we will make all reasonable efforts to collect consent from you for this new processing. Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

We may share your Personal Data with the parties set out below for the purposes set out in this Notice:

• Processors and Recipients, as further described in the section “Terms and Definitions” below.
• We may share your Personal Data with other companies within the Bank’s group (including Our parent entity, ADCB) so that they can provide you with relevant products and services. This type of processing is necessary to enable us to take steps at your request prior to you entering into a contract with a company within the Bank's group.
• Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your Personal Data in the same way as set out in this Notice.
• Our third-party suppliers and vendors who support us in providing the products and services we offer to our customers, and enable our organisational operations. When we disclose your Personal Data to our third-party suppliers, we take the necessary steps to ensure that these third parties have adequate safeguards in place to protect your Personal Data in the provision of their services to us. Please be aware that should you elect to withhold your consent for such sharing purposes, we may be unable to provide you with the product or service you have requested from us and may discontinue the provision of such product or service; and
• We may share your personal data with our regulators such as the Central Bank, government and other entities as we may be required to by law in accordance with our internal processes upon assessment of the legitimacy of such requests.

We require all third parties to respect the security of your Personal Data and to treat it in accordance with the law. We do not allow third parties to use your Personal Data for their own purposes and only permit them to process your Personal Data for specified purposes and in accordance with our instructions.

The latest version of our privacy notice is available on our Website. We will amend our privacy notice from time to time or as required. Please ensure that you visit our Website to view any changes to our notice.

Who can I contact if I have questions about this Privacy Notice?

If you have any questions about any aspects of this Privacy Notice or your Personal Data or you wish to exercise your data protection rights, please contact our Data Privacy Officer in writing at [email protected].