PRIVACY POLICY

Effective Date: 28 December 2021
Last Updated: 17 December 2025

1. Introduction & Confidentiality Commitment

Inchub Corporate Services Providers LLC, Inchub Financial Services FZCO, and any current or future legal entity owned, controlled, or operated by the Inchub Group (collectively, “Inchub”, “we”, “us”, or “our”) operate within a regulated, trust-based advisory environment.

Our clients—including high-net-worth individuals (HNIs), ultra-high-net-worth families, entrepreneurs, and family offices—entrust Inchub with sensitive personal, financial, corporate, and family-related information. Inchub treats such information with strict confidentiality, professional discretion, and regulatory discipline, in accordance with applicable law and professional obligations.

This Privacy Policy explains how Inchub collects, processes, uses, stores, protects, discloses, transfers, and retains information in the course of its business.

By accessing our website, communicating with Inchub, submitting information, or engaging our services, you acknowledge and accept this Privacy Policy to the extent required or permitted by applicable law.

2. Applicable Data Protection & Regulatory Frameworks

Inchub processes Personal Data in accordance with applicable data-protection, confidentiality, and regulatory laws, including, where relevant:

• UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and its Executive Regulations
• EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679)
• UK GDPR and the UK Data Protection Act 2018
• DIFC and ADGM Data Protection Regulations (where applicable)
• UAE AML/CFT laws, FIU confidentiality obligations, and related regulatory frameworks

Where more than one framework applies, Inchub adopts a risk-based and compliance-oriented approach consistent with applicable legal requirements.

3. Scope of Application

This is Privacy Policy applies to:

• Individual and corporate clients
• Shareholders, directors, officers, beneficiaries, employees, dependents, and authorised representatives
• Website visitors and users of Inchub platforms
• All information processed by Inchub, whether in physical, electronic, verbal, recorded, or automated form

4. Categories of Information Collected

Depending on the nature of services provided, Inchub may process the following categories of information:

4.1 Personal Identification Data

Names, nationality, date of birth, passport copies, Emirates ID (where applicable), visa pages, photographs, signatures, residential addresses, and contact details.

4.2 Corporate & Business Data

Trade licences, MOA/AOA, bylaws, resolutions, shareholder registers, UBO records, authorised signatory details, and regulatory filings.

4.3 Financial & Compliance Data

Bank statements, source-of-funds and source-of-wealth documentation, accounting records, payroll/WPS data (where applicable), VAT and Corporate Tax filings, ESR documentation, audit-support records.

4.4 Immigration & Government Data

Visa applications, entry permits, Emirates ID processing data, medical fitness records (where legally required), labour contracts, establishment cards, dependent documentation.

4.5 Communications & Operational Data

Emails, authorised messaging communications, call records, meeting notes, CRM entries, internal processing notes, and correspondence.

4.6 Website & Technical Data

IP addresses, browser and device data, cookies, analytics, inquiry forms, and uploaded documents.

5. Lawful Basis for Processing

Inchub processes Personal Data only where a lawful basis exists, including:

1. Contractual necessity – service delivery and administration
2. Legal or regulatory obligation – AML/CFT, tax, immigration, licensing, court orders
3. Legitimate interests – operational management, compliance, security, risk control
4. Consent – where required by law
5. Public interest and financial-crime prevention – due diligence, sanctions screening, regulatory reporting

Withdrawal of consent may limit Inchub’s ability to continue or complete services.

6. Confidentiality & Internal Access Controls

Client information is handled strictly on a need-to-know basis and accessed only by authorised personnel directly involved in the engagement.

Inchub prohibits:

• unauthorised access
• informal or casual disclosure
• internal or external sharing outside approved processes

All personnel are subject to confidentiality obligations and compliance oversight.

7. Written Instructions, Authorised Communications & Disclosure Restrictions

7.1 Authorised Instructions Only

Inchub acts exclusively on formal written instructions received from authorised Client representatives through authorised email addresses or formally designated communication channels recorded in Inchub’s engagement documentation.

Verbal instructions, informal messages, third-party communications, or intermediary directions shall not be relied upon unless subsequently confirmed in writing from an authorised Client email address.

Inchub has no obligation to act upon or acknowledge instructions not properly authorised.

7.2 Disclosure to Family Members & Related Parties

Inchub does not disclose or discuss Client information with family members, partners, advisors, employees, shareholders, beneficiaries, or related parties unless:

1. prior written authorisation is provided by the Client;
2. the scope, purpose, and recipient of disclosure are clearly defined; and
3. such disclosure is legally permissible.

No family relationship, business association, or implied authority creates a right to access Client information.

7.3 Client Responsibility for Authorisation

The Client is solely responsible for:

• identifying authorised representatives;
• maintaining secure authorised email access;
• notifying Inchub in writing of any changes or revocations.

Inchub shall not be liable for any delay, refusal, or non-action resulting from insufficient or unclear authorisation.

7.4 Regulatory Override

Nothing in this Policy restricts Inchub’s obligation to disclose information where required by law, regulation, court order, or competent authority.

8. Regulatory, AML/CFT & Mandatory Disclosures

Inchub operates within a regulated environment and may be legally required to disclose Client information to competent authorities without prior notice, including but not limited to:

• UAE Financial Intelligence Unit (FIU)
• Federal Tax Authority
• Ministry of Economy
• Licensing, immigration, and labour authorities
• Courts and law-enforcement agencies
• International tax authorities pursuant to FATCA, CRS, or similar frameworks

Where legally required, Inchub shall comply fully and shall bear no liability for such disclosures.

9. Third-Party Service Providers & Professional Counterparties

Inchub does not sell, rent, or commercially exploit Personal Data.

Disclosure to third parties occurs only where necessary, lawful, and proportionate, including to banks approved by the Client, auditors, legal and tax advisors, compliance specialists, attestation centres, couriers, translators, and secure technology providers.

All such parties are subject to confidentiality, professional secrecy, or statutory obligations.

10. Cross-Border Data Transfers

Personal Data may be transferred to or accessed from jurisdictions outside the UAE, EU, or UK for service delivery, secure hosting, or regulatory coordination.

Where such transfers occur, Inchub implements appropriate legal and contractual safeguards in accordance with applicable law, including recognised transfer mechanisms and confidentiality obligations.

11. Data Security Measures

Inchub maintains reasonable, risk-based technical and organisational safeguards designed to protect Personal Data against unauthorised access, misuse, alteration, loss, or disclosure.

These measures include access controls, role-based permissions, secure storage environments, internal confidentiality undertakings, and monitoring procedures.

While Inchub applies appropriate safeguards, no system can guarantee absolute security. Inchub shall not be liable for incidents arising from factors beyond its reasonable control, including force majeure events or third-party system failures.

12. Personal Data Breach Management

In the event of a Personal Data breach, Inchub shall assess and respond in accordance with applicable legal and regulatory requirements.

Where notification to supervisory authorities or affected individuals is legally required, Inchub shall comply within prescribed timeframes. Where notification is not legally mandated, Inchub shall act in accordance with regulatory guidance and risk assessment.

13. Data Retention & Destruction

Personal Data is retained only for periods required under applicable commercial, tax, AML/CFT, and regulatory laws, or as necessary to protect legal rights or comply with lawful authority instructions.

Upon expiry of retention periods, data is securely deleted, destroyed, or anonymised using controlled procedures.

14. Data Subject Rights

Subject to applicable law, data subjects may request access, correction, restriction, erasure, or portability of Personal Data.

These rights are not absolute and may be limited where retention or processing is required for legal, regulatory, or compliance purposes.

Requests must be submitted in writing to info@inchub.ae and may require identity verification.

15. Communications & Record-Keeping

Communications with Inchub may be recorded, stored, and reviewed for service delivery, compliance, quality assurance, security, and legal purposes, in accordance with applicable law.

16. Cookies & Website Usage

Inchub’s website may use cookies and analytics to support functionality and performance. Users may manage preferences through browser settings.

17. Intellectual Property

All Inchub intellectual property, brand assets, templates, and materials are protected under applicable laws. Unauthorised use is prohibited.

18. Limitation of Responsibility

Inchub shall not be responsible for losses arising from:

• inaccurate or incomplete information provided by the Client;
• mandatory regulatory disclosures;
• actions of third-party authorities or service providers;
• delays outside Inchub’s reasonable control.

Client indemnities and liability allocations are governed by separate engagement agreements, not this Privacy Policy.

19. Regulatory Priority & Severability

Where this Policy conflicts with mandatory legal requirements, such requirements prevail. Invalid provisions shall not affect the remainder.

20. Updates to This Policy

Inchub may update this Privacy Policy from time to time. The latest version will be published on our website.

21. Contact Information

Inchub Corporate Services Providers LLC / Inchub Group
📧 info@inchub.ae | hello@inchub.ae