Application of this privacy policy

This Privacy Policy ("Policy") forms part of the terms and conditions ("Terms") relating to the use of the website www.sarwa.co or the app provided by Sarwa Digital Wealth (Capital) Limited (together with its parent, subsidiaries, affiliate companies and their respective directors, partners, officers, employees, or agents (hereafter referred to as “Sarwa,” "we," "us," or "our").

For the purposes of ADGM Data Protection Regulations 2021 (ADGM DPR 2021), Sarwa is the “data controller” of your personal information provided to us, via this website, app or otherwise.

Sarwa is committed to safeguarding the privacy of the personal information that is provided to us or collected by us during the course of our business, as well as the personal information we receive from you (“User,” “you,” or “your”). This Policy describes how and why we collect, store, and use personal information, and provides information about your rights. Please read the following information carefully to understand our views and practices regarding how we handle personal information.

Collection of personal information

We may collect personal information from you through your use of the website or app, when you request information from us, when you engage us for services, or as a result of your relationship with us or any of our clients.

We may request and collect from you personal information including but not limited to your name, phone number, address, email address, passport details, and other such personal data. By providing us with any personal information, you consent to its use as described in this Policy.

Additionally, when using our website or app, we may automatically collect certain information (e.g., IP address, browser type, location, etc.) and behavioural data (e.g., page views, interactions) using cookies and other technologies.

Lawful Basis for Processing Personal Information

We rely on the following lawful bases to process your personal information in accordance with the ADGM DPR 2021:

1. Consent - Where you have given clear consent for us to process your personal data for specific purposes (e.g., marketing).
2. Contract - Where the processing is necessary for the performance of a contract we have with you or to take steps at your request before entering into such a contract.
3. Legal Obligation - Where processing is necessary for compliance with a legal obligation.
4. Legitimate Interests - Where processing is necessary for the purposes of legitimate interests pursued by us or a third party, except where such interests are overridden by your rights and interests.

Purposes of Processing

We will only use your personal information for our legitimate business purposes, including:

• To provide our services and respond to inquiries.
• To manage our relationship with you and our clients.
• To comply with regulatory requirements.
• To improve our website and app functionality.
• To compile anonymous statistical data.
• To facilitate marketing activities, where appropriate consent is given.

Automated Decision Making and Profiling

Sarwa may use automated decision-making, including profiling, for client services and marketing purposes. However, no decisions are made without human intervention that could significantly affect the data subject.

Where such automated processes are used, Sarwa ensures transparency, including the logic involved, the significance, and potential consequences of the processing.

Cookies and Similar Technologies

Sarwa uses cookies and similar technologies to enhance the user experience and analyse website traffic. These cookies include:

• Necessary Cookies: Essential for the proper functioning of our website.
• Functional Cookies: Enhance website functionality and personalization.
• Analytical Cookies: Help us understand website usage and improve performance.

Users are informed of cookie use upon their first visit, and consent is obtained where necessary. Users can manage or withdraw their consent at any time via their browser settings.

Data Minimization and Accuracy

Sarwa adheres to the principle of data minimization, collecting only the personal data necessary for specific purposes. We are committed to ensuring that the data we collect is accurate and up to date. Data subjects are encouraged to keep their personal data current by contacting Sarwa if there are any changes. Sarwa will make necessary corrections to inaccurate or outdated information promptly upon receiving such requests.

Data Protection Contact

Sarwa has appointed a Data Protection Contact Person, to oversee compliance with this Policy and to act as the primary contact for data protection-related inquiries. If you have any questions or concerns about how we process your personal data, please contact our Data Protection Contact Person at:

• Email: compliance@sarwa.co

Cross-Border Transfers

We may transfer your personal data to Sarwa’s affiliated offices, service providers, or partners located outside the ADGM. In such cases, appropriate safeguards (such as standard contractual clauses or contractual agreements) are implemented to ensure your data is adequately protected.

Your rights

Under the ADGM DPR 2021, you have the following rights:

• Right to Access - You can request a copy of the personal data we hold about you.
• Right to Rectification - You can ask us to correct any inaccurate or incomplete data.
• Right to Erasure - You can request that we delete your personal data under certain circumstances.
• Right to Object - You can object to certain types of processing, including direct marketing.
• Right to Data Portability - You can request that we transfer certain personal data to you or another data controller.
• Right to Withdraw Consent - If processing is based on your consent, you can withdraw it at any time.

To exercise any of these rights, please contact us at compliance@sarwa.co

Additionally, you have the right to lodge a complaint with the Office of Data Protection Commissioner (ODPC) in ADGM if you believe your data protection rights have been violated.

Data Breach Notification

Sarwa takes data breaches seriously. If a personal data breach occurs, Sarwa will promptly assess the situation and, if required, notify the ADGM Data Protection Commissioner and the affected individuals within the stipulated time frame.

Data Retention

We retain your personal information for as long as necessary to fulfil the purposes outlined in this Policy, or for longer periods where required by law (up to 15 years in the UAE, if applicable).

Changes to this privacy policy

This Policy is effective from October 1, 2020, with the latest update on March 12, 2026. It will remain in effect until further updates. Any changes to this Policy will be posted on this page and will become effective immediately after being posted.