Skip to main content
Privacy Policy
Nitish Mittal avatar
Written by Nitish Mittal
Updated over a year ago

(V002) This Policy was last updated in November 2023.

This Privacy Policy (“Policy”) clarifies how we at InvestSky Financial Limited (“InvestSky” “we”, “us”, “our”) collect, use, share and otherwise process Personal Data provided to us. For the purposes of this Policy terms such as “Processing”, “Personal Data” and “Special Categories of Personal Data” shall be interpreted in accordance with DIFC Law No.5 of 2020 and the associated Data Protection Regulations as amended from time to time (“DIFC Data Protection Law”). Capitalized terms used here have the meaning ascribed to them under the DIFC Data Protection Law.

  1. Who is the Controller?

    1.1 The controller is InvestSky Financial Limited, Unit IH-00-01-07-OF-03, Level 7, IH-00-01-CP-05, Dubai International Financial Centre, Dubai, UAE.

  2. Collection of Information

    2.1 Information may be collected from you in the course of your use of InvestSky’s website and/or in any communication between you and InvestSky’s personnel. If you are our client or prospective client we may also collect information about you from company and trade registers, and other publicly available sources.

    2.2 The types of Personal Data we may collect include: Contact details (e.g., name, address, gender, email address, telephone number, digital signature, date and place of birth, proof of identity documents, employment details, financial information such as source of income, net worth, bank account information, tax documentation and proof of company ownership.

    2.3 With regard to each of your visits to our website by way of a computer system, mobile device or through an application, we may automatically collect the following information:

    1. technical information, including the Internet protocol (IP) address used to connect your computer to the Internet, browser type and version, time zone setting, browser plug-in types and versions, operating system; and

    2. information about your visit, features you use and actions you take; services you viewed or searched for; page response times, download errors, length of visits, page interaction information (such as scrolling, clicks, and mouse-overs); hashtags you use,

    3. Content you create like posts, comments, reactions, or public interactions using text, audio, or video while using our website or application;

    2.4 We also process - insofar as necessary to provide our services - Personal Data that we obtain with permission from publicly accessible sources (e.g., press, internet) or from other third parties such as our local authorized business partners and service providers.

  3. Uses of Personal Data

    3.1 InvestSky may use your Personal Data for any of the following purposes:

    1. in the course of carrying out client due diligence and achieving a sufficient knowledge and understanding of a prospect or client and its business, management and employees;

    2. to provide services such as process and respond to inquiries, conduct due diligence;

    3. to prevent fraud;

    4. in order to ensure the legitimacy of all requests for further information from InvestSky;

    5. to check the identity of prospects and new clients and to prevent money laundering;

    6. to disclose it to its service providers, professional advisers and agents, where necessary;

    7. if you have registered for employment purposes, to review whether you are a suitable candidate for any job opportunities within InvestSky;

    8. occasionally, to trace debtors;

    9. to record and monitor for internal purposes your use of InvestSky’s websites. For internal administrative or training purposes;

    10. for responding to subpoenas, court orders or regulatory or legal requirements;

    11. for updating our records and databases;

    12. for responding to your queries or informing you of new developments at InvestSky, including news, thought-pieces or blogs; and

    13. for the marketing of InvestSky’s capabilities (whether direct marketing or any other form of marketing) or market and opinion research, unless you have objected to the use of your data.

  4. Legal Basis

    4.1 We will process your Personal Data for our legitimate business interests and if and to the extent the DIFC Data Protection Law provides a legal basis for us to do so. The legal basis we use will be one of:

    1. Necessary to comply with a legal obligation, for example to carry out anti-money laundering checks, reporting to regulators and registering clients with regulators ;

    2. Necessary to perform a contract we have entered into with you or in order to take steps at your request prior to entering into a contract;

    3. Necessary for our (or a third party’s) legitimate interest which is not overridden by your interests or fundamental rights and freedoms. Such legitimate interests include the providing of services by us, administrative or operational processes; or

    4. Your consent: You may withdraw such consent at any time, however, this will not affect the lawfulness of the processing based on your consent prior to the withdrawal, or where we have other legitimate reasons for processing your personal data.

    4.2 Please note that we may use or disclose Personal Data if we are required by DIFC Data Protection Law to do so or if we reasonably believe that use or disclosure is necessary to protect our rights and/or to comply with judicial or regulatory proceedings, a court order or other legal process.

  5. Special Categories of Personal Data

    5.1 Given the nature of our services, we do not collect ‘Special Categories of Personal Data’, which is defined as ‘Personal Data revealing or concerning (directly or indirectly) racial or ethnic origin, communal origin, political affiliations or opinions, religious or philosophical beliefs, criminal record, trade union membership and health or sex life and including genetic data and biometric data where it is used for the purpose of uniquely identifying a natural person’. We may collect Personal Data relating to criminal convictions and offences, particularly for fulfilling our legal obligations regarding anti-money laundering.

    5.2 To the extent that we have a business need to collect any of the above Special Categories of Personal Data for the purposes set out above, and are permitted to do so by DIFC Data Protection Law, we will identify the appropriate legal basis for that Processing and identify you beforehand.

  6. Disclosure of Data

    6.1 We may have to share your Personal Data with the third parties set out below:

    1. InvestSky Group entities;

    2. the DFSA and any other public authority we may be subject to for the purpose of demonstrating compliance with applicable law or to reply to a request;

    3. such third parties as we reasonably consider necessary in order to prevent crime, e.g. the police;

    4. where reasonably necessary, to any third-party service providers and specialist advisers who provide us with administrative, financial, KYC, research or other services in connection with the services we provide to you;

    5. our auditors for the purposes of carrying out financial and regulatory audits;

    6. our agents, including credit reference agencies, acting on our behalf, carrying out such credit and identity checks, including money laundering checks, compliance regulatory reporting and fraud prevention checks, as we may reasonably consider necessary or desirable. Any third party referred to in this section may share any Personal Data concerning you with us and other organisations involved in credit reference, the prevention of fraud and/or crime and/or money laundering or for similar purposes or to recover debts involved;

    7. introducing brokers, market makers, liquidity providers, prime brokers, clearing and settlement agents, exchanges, clearing houses and trade repositories, as applicable;

    8. courts, tribunals and regulatory authorities as agreed or authorised by law to enable us to enforce our agreement with you, comply with the requirements of a court, regulator or government agency;

    9. anyone authorised by you, as notified by you to us;

    6.2 If InvestSky appoints third parties to host, maintain, manage, or to provide other services in relation to data then your Personal Data may be accessed and used by these third parties to the extent necessary to fulfil their hosting, maintenance, managerial, and/or other functions. We may also disclose your Personal Data to the extent necessary if we enter into negotiations for a merger or acquisition. Where we do so, we will ensure that there is a written contract in place with appropriate safeguards for your Personal Data, including security measures and restrictions on the use of such data.

  7. Transfer of Personal Data

    7.1 InvestSky may have a business need to transfer your Personal Data to countries outside of DIFC. Accordingly, when you provide your Personal Data to InvestSky, you acknowledge and agree that we may disclose your Personal Data to recipients (including, but not limited to service providers, InvestSky’s affiliates or agents, and IT servers) located in jurisdictions other than your own.

    7.2 Data transfers to legal entities in states outside the DIFC (known as third countries) takes place so long as:

    1. The third country has been determined by the Commissioner as jurisdiction providing adequate level of protection under the DIFC Data Protection Law.

    2. We have provided appropriate safeguards under the DIFC Data Protection Law and enforceable data subject rights and effective legal remedies for data subjects are available.

    3. One of the specific derogations in the DIFC Data Protection Law (Article 27(3)) applies (including, but not limited to, where you have explicitly consented to the proposed transfer in accordance with the DIFC Data Protection Law); or

    4. The limited circumstances set out in the DIFC Data Protection Law (Article 27(4)) apply.

  8. How We Protect Your Personal Information

    8.1 We have implemented appropriate technical and organisational measures to protect your Personal Data in accordance with the DIFC Data Protection Law.

  9. Retention

    9.1 We retain your Personal Data as long as it is necessary to satisfy or meet the purposes for which it was obtained including applicable legal or regulatory requirements or for any minimum retention period set out in applicable law, and for any further period necessary for the specified purpose, and subject to any legal hold, in which case a new retention period will apply for the duration of that legal hold. This is also subject to any earlier valid and accepted exercise of your Data Subject Rights.

  10. Your Rights in Relation to Your Information

    10.1 You have rights as a Data Subject which you can exercise under certain circumstances in relation to your Personal Data that we hold. These rights are to:

    1. obtain information regarding the processing of your Personal Data and request access to your Personal Data (commonly known as a “data subject access request”) and request certain information in relation to its Processing;

    2. request rectification of your Personal Data, if it is inaccurate or incomplete;

    3. request the erasure of your Personal Data. Please note that there may be circumstances where InvestSky is legally entitled to retain Personal Data regardless of any such request;

    4. request the restriction of Processing of your Personal Data. There may be circumstances where InvestSky is legally entitled to refuse that request. As restricting is often temporary, we will inform you before removing any restriction or processing the Personal Data again;

    5. request to enable the portability of your Personal Data;

    6. to not be discriminated against as a result of exercising your rights under the Data Protection Law, including not being denied any services, being charged different prices or rates for such services, or being provided less favorable level or quality of services.

    7. where Processing is based on your consent, to withdraw that consent;

    8. object to the Processing of your Personal Data;

    9. the right to object to any decision based solely on automated processing, including profiling, which produces legal consequences concerning him, or other seriously impactful consequences and to require such decision to be reviewed manually;

    10. The right to file a complaint with the Commissioner.

    10.2 If you want to exercise one of these rights, please contact [email protected].

    10.3 You will in general not have to pay a fee to exercise any of your individual rights mentioned in this Privacy Policy. However, we may charge a reasonable fee if your request to exercise your individual rights is manifestly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

    10.4 When we respond to a data subject access request, we need to ensure that we do not disclose the Personal Data of any other individual, or otherwise infringe upon any other individual’s rights. We will redact or otherwise obscure any personal data relating to other individuals before responding. Additionally, if we have to limit the amount of Personal Data we can provide in response to a Data Subject Access Request to protect the rights of other individuals, we need to let the Data Subject know.

  11. Cookies and internet advertising


    11.1 We use ‘cookies’ to improve this website. Cookies are small files that are sent to a computer's hard drive by a web server. Cookies enable websites to remember who you are. Information from cookies may include information relating to your use of our websites, information about your computer (such as IP address and browser type), and demographic data.


    11.2 We also use third-party advertising identifiers which are similar to cookies and are found on many mobile devices and tablets. Like cookies, advertising identifiers are used to make online advertising more relevant. Advertising cookies and advertising identifiers use information about your use of this and other websites and apps, your response to ads and emails, and to deliver ads that are more relevant to you. These types of ads are called “internet based advertising”.


    11.3 We may use third-party Service providers to monitor and analyze the use of our Service

    1. Google Analytics: Google Analytics is a web analytics service offered by Google that tracks and reports website traffic. Google uses the data collected to track and monitor the use of our Service. This data is shared with other Google services. Google may use the collected data to contextualize and personalize the ads of its own advertising network. You can opt-out of having made your activity on the Service available to Google Analytics by installing the Google Analytics opt-out browser add-on. The add-on prevents the Google Analytics JavaScript (ga.js, analytics.js, and dc.js) from sharing information with Google Analytics about visits activity. You may opt-out of certain Google Analytics features through your mobile device settings, such as your device advertising settings or by following the instructions provided by Google in their Privacy Policy: https://policies.google.com/privacy. For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page: https://policies.google.com/privacy.

    2. Firebase: Firebase is an analytics service provided by Google Inc. You may opt-out of certain Firebase features through your mobile device settings, such as your device advertising settings or by following the instructions provided by Google in their Privacy Policy: https://policies.google.com/privacy. We also encourage you to review the Google's policy for safeguarding your data: https://support.google.com/analytics/answer/6004245. For more information on what type of information Firebase collects, please visit the How Google uses data when you use our partners' sites or apps webpage: https://policies.google.com/technologies/partner-sites.

    3. Email marketing: We may use Your Personal Data to contact You with newsletters, marketing or promotional materials, and other information that may be of interest to You. You may opt-out of receiving any, or all, of these communications from Us by following the unsubscribe link or instructions provided in any email We send or by contacting Us.

  12. Questions and Concerns

    12.1 If you have any questions or concerns about the way in which InvestSky handles your Personal Data, or about this Policy, please contact our Privacy Team at [email protected]

    12.2 We are typically able to resolve privacy questions or concerns promptly and effectively. If you are not satisfied with the response you receive from our Privacy Team, you may escalate concerns to the DIFC Commissioner of Data Protection.

Did this answer your question?