This Privacy Notice explains how we collect, use, and disclose your personal data, and your rights in relation to the personal data we hold. Your privacy is important to us, and we know that you are concerned about how we use your personal data. Wealth Management Ltd (in this Privacy Notice, “Imani”, “us”, “we” and “our”) collects and processes your personal data according to this Privacy Notice.

Some terms defined

For the purposes of this Privacy Notice, “you” is to be given its widest possible interpretation and includes any natural person in relation to whom Imani has collected and processes personal data of. “Personal data” is information which identifies an individual person or from which an individual person is identifiable. By “processing” we mean everything we can do with this data such as collecting it, recording, storing, adjusting, organising, using, disclosing, transferring, or deleting.

How we collect your data

We collect your personal data in several ways, for example: • From the information you provide to us when you meet us. • From information about you provided to us by your company or an intermediary. • When you communicate with us by telephone, fax, email, or other forms of electronic communication. In this respect, we may monitor, record and store any such communication. • When you complete (or we complete on your behalf) client on-boarding or application or other forms. • From your agents, advisers, intermediaries, and custodians of your assets. • From publicly available sources or from third parties, most commonly where we need to conduct background checks about you.

The categories of personal data we collect

Depending on the nature of your relationship with us, we might collect the following categories of personal data about you: • Your name and contact information such as your home or business address, email address and telephone number. • Biographical information which may confirm your identity including your date of birth, tax identification number and your passport number or national identity card details, country of domicile and/or your nationality. • Information relating to your financial situations such as income, expenditure, assets and liabilities, sources of wealth, as well as your bank account details. • Information about your knowledge and experience in the investment field. • An understanding of your goals and objectives in procuring our services. • Information about your employment, education, family or personal circumstances, and interests, where relevant. • Information to assess whether you may represent a politically exposed person or money laundering risk. The personal data mentioned above is an indicative list only and not exhaustive. We usually collect your personal data directly from you. However, sometimes we may need to collect personal data about you from third parties for the purposes described below. The circumstances in which we may need to do this include, for example, where we need information from a third party to assist us to process an application (such as to verify the information you have provided or to assess your circumstances) or to assist us to locate or communicate with you.

The basis for processing your personal data (other than with your consent), how we use that personal data and whom we share it with:

(i) Performance of a contract with you

We process your personal data because it is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract. In this respect, we use your personal data for the following: • Undertaking searches, taking up references and making such other enquiries as we deem necessary, for the purposes of verifying your identity. • To prepare a proposal for you regarding the services we offer. • To provide you with the services as set out in our Client Agreement with you or as otherwise agreed with you from time to time. • To deal with any complaints or feedback you may have. • For any other purpose for which you provide us with your personal data. In this respect, we may share your personal data with or transfer it to the following: • Your agents, advisers, intermediaries, and custodians of your assets. • Third parties whom we engage to assist in delivering the services to you (including any agent, introducer, depository, administrator, stock exchange, clearing or settlement system, account controller or other participant in the relevant system, counterparties, dealers, custodians, intermediaries and others where disclosure is intended for the purpose of effecting transactions in connection with a client agreement or establishing a relationship with a view to such transactions. • Our professional advisers where it is necessary for us to obtain their advice or assistance, including lawyers, accountants, IT or public relations advisers and auditors. • Other third parties such as intermediaries who we introduce to you. We will wherever possible tell you who they are before we introduce you.

(ii) Legitimate interests

We also process your personal data because it is necessary for our legitimate interests, or sometimes where it is necessary for the legitimate interests of another person. In this respect, we use your personal data for the following: • For the administration and management of our business, including recovering money you owe to us, and archiving or statistical analysis. • Seeking advice on our rights and obligations, such as where we require our own legal advice • To ensure network and information security, such as data backup. In this respect we will share your personal data with the following: • Our advisers or agents where it is necessary for us to obtain their advice or assistance • With third parties and their advisers where those third parties are acquiring, or considering acquiring, all or part of our business.

(iii) Legal obligations

We also process your personal data for our compliance with a legal obligation which we are under. In this respect, we will use your personal data for the following: • Meeting legal and regulatory requirements, such as for the prevention of money-laundering, terrorism, fraud, tax evasion, bribery and corruption or other crimes. Various local and international laws may expressly require us to collect/and or disclose your personal data, or we may need to do so in order to be able to comply with other obligations under those laws. Such laws include DFSA “Anti-Money Laundering, Counter-Terrorist Financing and Sanctions Module”, UAE “Federal Law No. 4 of 2002 regarding Criminalisation of Money Laundering”, UAE “Federal law No. 7 of 2014 on Combatting Terrorism Offences”, UAE “Federal Decree-Law No. 20 Of 2018 On Anti-Money Laundering And Combating The Financing Of Terrorism And Financing Of Illegal Organisations (for example, to comply with identity verification requirements), and other regulatory legislation (for example, requiring us to maintain client and transaction records), the DIFC Law No. 2 of 2018 “Common Reporting Standard Law”, “UAE/US Inter-Governmental Agreement” (regarding FATCA) and other taxation laws (for example, to comply with reporting obligations or information requests) • As required by regulatory, monetary, tax or fiscal authorities or any competent court or legal authority. In this respect, we will share your personal data with the following: • Our advisers where it is necessary for us to obtain their advice or assistance • Our auditors where it is necessary as part of their auditing functions • With third parties who assist us in conducting background checks • With relevant regulatory, monetary, tax or fiscal authority or law enforcement agencies where we are required to do so.

Processing and transfer of your personal data

We will take all steps reasonably necessary to ensure your data is processed fairly and lawfully, in accordance with the DIFC Data Protection Law, other applicable laws and this Policy. Imani does not engage in automated decision making when processing your Personal Data. When sharing your personal data with third parties as set out in this Privacy Notice, some of the recipients may be located outside the DIFC. While it is not reasonably practicable to list all the countries to which your information may be disclosed from time to time, it is likely that such countries may include the United Arab Emirates, Switzerland, Singapore, and the United Kingdom. However, in most cases your personal data will only be transferred outside the DIFC on one of the following bases: The jurisdiction where we send the personal data is providing an adequate level of protection for personal data. The third party to which the data is transferred to has provided appropriate safeguards that ensure the security of your Personal Data, in line with our data protection policy. To find out more about transfers by us of your personal data outside the DIFC and the countries concerned kindly contact us on dp@imaniwealth.com

How we protect your personal data

We apply an internal framework of policies and minimum standards across all our business to keep your data safe. These policies and standards are periodically updated to keep them up to date with regulations and market developments. More specifically and in accordance with the law, we take appropriate technical and organisational measures (policies and procedures, IT security, etc.) to ensure the confidentiality and integrity of your personal data and the way it is processed. We train people who work for us on how to handle personal data appropriately and we restrict access to what is necessary for specific job functions. In addition, our employees are subject to confidentiality and may not disclose your personal data unlawfully or unnecessarily.

Retention of your data

We will only retain your personal data for as long as we have a lawful reason to do so. In particular: Where we have collected your personal data as required by anti-money laundering legislation, including for identification, screening, and reporting, we will retain that personal data for six years after the termination of our relationship, unless we are required to retain this information by another law or for the purposes of court proceedings. Otherwise, we will in most cases retain your personal data for a period of six years after the termination of our contractual or other relationship with you in case any claims arise.

Your rights

We respect your rights as a customer to determine how your personal data is used. These rights include the right to: • Obtain access to, and copies of, the personal data that we hold about you. • Require us to correct the personal data we hold about you if it is incorrect. • Require us to erase your personal data. • Object at any time to the processing of your personal data. • Require us to restrict our data processing activities. • Require that we cease processing your personal data if the processing is causing you damage or distress. • Withdraw the consent you have previously given us to process your personal data. • Ask us to transfer your personal data directly to you or to another company. Where technically feasible, we will transfer your personal data. We will inform all third parties to whom we sent your personal data to of your request to access, rectify, erase, restrict or object to data processing activities, to the best of our abilities. We can inform you, if you so request, who the recipients of your personal data are. Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply.

Your duty to provide data

There is certain information, including personal data, which we must know about you so that we can commence and execute our services and fulfill our associated contractual duties. There is also information, including personal data, which we are legally obliged to collect. Without this data, we may not be able to open an account for you or provide certain services.

Changes to this Policy

We may change this Policy from time to time and without notice. If we make significant changes in the way we treat your Personal Data we will update this Policy accordingly and, if applicable, endeavor to provide you notice through e-mail. We encourage you to periodically review this Policy for the latest information on our privacy practices.

General information

Imani is a data controller in relation to your personal data and is committed to complying with the relevant data protection laws. If you have any questions about how we use your personal data, or you wish to exercise any of the rights set out above, please contact us:

Per Post: Office 206A, Level 2, Liberty House, P.O. Box 507288, DIFC, Dubai, UAE

Per email: dp@imaniwealth.com

Telephone: +971 4 580 9450

If you are not satisfied with how we are processing your personal data, you can make a complaint to the DIFC Data Protection Commissioner at:

Per Post: Dubai International Financial Centre Authority Level 14, The Gate Building

Per email: commissioner@dp.difc.ae

Telephone: +971 4 362 2222

You can find out more about your rights at http://www.difc.ae/laws-regulations/data-protection.