1.   Introduction

Whitegate Capital Limited (“Whitegate”, “the Firm”, “we”, “us” or “our”) is a company incorporated and registered in the Dubai International Financial Centre (“DIFC”) and regulated by the Dubai Financial Services Authority (“DFSA”) as a Category 3C Authorised Firm. The Firm holds the following DFSA licences and endorsement:

This Website Privacy Statement (“Statement” or “Policy”) describes how Whitegate Capital Limited collects, uses, stores, discloses, and protects personal data in connection with its regulated financial services activities and its public-facing website. This Policy applies to all data subjects whose personal data is processed by the Firm, including but not limited to:

• Clients, prospective clients, and fund investors
• Beneficial owners and authorised signatories
• Directors, officers, employees, and contractors
• Representatives of corporate clients and counterparties
• Third-party service providers and professional advisors
• Visitors to our website and individuals who contact us

This Policy is governed by and prepared in compliance with the following legal and regulatory framework:

• DIFC Data Protection Law No. 5 of 2020 (as amended by DIFC Laws Amendment Law No. 1 of 2025) (“DP Law”)
• DIFC Data Protection Regulations (“DP Regulations”)
• DFSA Rulebook — General Module (GEN), Conduct of Business Module (COB), and Collective Investment Rules Module (CIR)
• UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) (where applicable)
• UAE Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and Countering the Financing of Terrorism (as amended by Federal Law No. 10 of 2025)
• Any other applicable laws and regulations in force from time to time

This Policy should be read together with the Firm’s other relevant policies and procedures, including the AML/CFT Policy, Conflicts of Interest Policy, Client Suitability Policy, and Information Security Policy.

2.   Data Controller Information

Whitegate Capital Limited is the Data Controller responsible for the personal data it processes. A Data Controller is an entity that determines the purposes and means of processing personal data.

The Firm has designated a Data Protection Officer (“DPO”) / Compliance Officer responsible for overseeing compliance with data protection laws and serving as the primary point of contact for all data protection-related enquiries and requests.

Any questions, requests, or concerns relating to this Policy or the Firm’s data protection practices should be directed to the DPO / Compliance Officer using the contact details set out above.

3.   Personal Data We Collect

In the course of providing our regulated financial services, we collect and process various categories of personal data. The specific categories collected will depend on the nature of our relationship with you and the services provided.

3.1  Identity and Verification Data

• Full legal name, title, and any other names used (including maiden name and aliases)
• Date and place of birth, nationality, and country of residence
• Copies of passport, Emirates ID, national identity card, or other government-issued identification documents
• Photographs and signature specimens
• Tax identification number(s) and tax residency information (including for FATCA and CRS purposes)
• Beneficial ownership information (where the client is a corporate or legal entity)
• Politically Exposed Person (PEP) status and related declarations

3.2  Contact Data

• Residential address, mailing address, and registered office address
• Personal and business telephone numbers, including mobile numbers
• Personal and business email addresses
• Emergency contact details

3.3  Financial and Economic Data

• Bank account details, IBAN numbers, and financial institution information
• Source of wealth, source of funds, and net worth information
• Investment portfolio details, asset holdings, and investment history
• Credit history, creditworthiness assessments, and credit facility information
• Income, employment status, salary, and financial circumstances
• Details of existing financial products, loans, mortgages, and liabilities
• Financial statements, bank statements, and tax returns (where provided)

3.4  Suitability and Risk Profile Data

• Investment objectives, financial goals, and investment horizon
• Risk appetite, risk tolerance, and risk assessment questionnaire responses
• Investment knowledge, experience, and financial sophistication
• Capacity for loss and financial resilience information
• Client categorisation data (Professional Client classification)

3.5  Fund Investor Data (Collective Investment Fund Activities)

• Subscription agreements, redemption requests, and fund application forms
• Unit/share holdings, valuation information, and distribution records
• Investor classification and eligibility documentation (e.g., Qualified Investor Fund eligibility)
• Beneficial ownership declarations and ultimate beneficial owner information
• Anti-dilution levy and switching records
• Fund distribution and dividend payment records

3.6  KYC and AML/CFT Compliance Data

• Customer due diligence (CDD) and enhanced due diligence (EDD) documentation
• PEP screening results, adverse media checks, and sanctions screening records
• Suspicious Activity Reports (SARs) and internal AML/CFT investigation records
• Transaction monitoring records and alerts
• Copies of AML/CFT risk assessments and periodic review records

3.7  Technical and Communications Data

• Internet Protocol (IP) addresses, browser type and version, and device identifiers
• Records of telephone calls, electronic communications, meeting notes, and correspondence
• Website usage data, session information, and cookies (see Section 12)
• CCTV footage (where applicable at our premises)

3.8  Employment and Professional Data (Employees and Authorised Individuals)

• Employment history, qualifications, professional certifications, and regulatory references
• Continuing Professional Development (CPD) records
• DFSA fitness and propriety assessments and approved person declarations
• Performance reviews, disciplinary records, and remuneration information
• Emergency contact details and payroll information

4.   Lawful Basis for Processing

Under Article 10 of the DP Law, we are required to identify a lawful basis before processing personal data. We process personal data on one or more of the following lawful bases:

Where we rely on legitimate interests as our lawful basis, you have the right to object to such processing. Please see Section 10 (Your Rights as a Data Subject) for further information.

5.   How We Use Your Personal Data

We use the personal data we collect for the following purposes. We have indicated the lawful basis relied upon for each processing activity in the table below.

5.1  Regulatory and Legal Compliance

In addition to the above, we process personal data for the following regulatory and legal compliance purposes:

• Conducting customer due diligence (CDD), enhanced due diligence (EDD), and ongoing monitoring in accordance with DFSA AML Rules and Federal Law No. 10 of 2025
• Performing sanctions screening, PEP screening, and adverse media searches
• Filing Suspicious Activity Reports (SARs) with the UAE Financial Intelligence Unit (FIU)
• Meeting FATCA and CRS reporting obligations to UAE and international tax authorities
• Responding to requests from the DFSA, UAE Central Bank, FIU, law enforcement, and judicial authorities
• Maintaining records and registers required by DFSA rules, DIFC laws, and applicable UAE laws
• Complying with international trade and economic sanctions administered by OFAC, OFSI, the UN, and other authorities

5.2  Business Operations and Internal Administration

• Internal record-keeping, administration, and management information reporting
• Risk management, compliance monitoring, and internal audit activities
• Staff training, competency assessments, and CPD record-keeping
• Business continuity planning, disaster recovery, and IT security monitoring
• Processing, resolving, and reporting client complaints
• Detecting, investigating, and preventing fraud, financial crime, and unauthorised system access
• Conducting due diligence on third-party service providers and outsourcing arrangements

5.3  Marketing and Communications

• Sending service-related communications, account statements, and regulatory disclosures
• Providing market research, investment insights, and thought leadership content (with your consent or where permitted by applicable law)
• Responding to your enquiries, complaints, and requests
• Inviting you to events, seminars, and webinars (with your consent)

You may opt out of receiving marketing communications at any time by contacting us using the details in Section 2 or by following the unsubscribe instructions in any marketing communication.

6.   Special Categories of Personal Data

Under Article 11 of the DP Law, certain categories of personal data are subject to enhanced protections due to their inherent sensitivity. These “Special Categories of Personal Data” include data revealing:

• Racial or ethnic origin
• Political opinions or affiliations
• Religious, philosophical, or ideological beliefs
• Trade union membership
• Genetic data
• Biometric data processed for the purpose of uniquely identifying a natural person
• Data concerning physical or mental health
• Data concerning sex life or sexual orientation

As a regulated financial services firm, the Firm does not ordinarily process Special Categories of Personal Data in the course of its financial services activities. However, in limited circumstances, we may process such data (for example, where you voluntarily disclose health information relevant to a power of attorney or succession planning, or where biometric verification is conducted for identity verification purposes).

Where we do process Special Categories of Personal Data, we will only do so where one of the following conditions is met:

• You have given explicit, written consent to the processing for one or more specified purposes
• Processing is necessary for compliance with employment law, social security law, or social protection obligations
• Processing is necessary to protect the vital interests of the data subject or another person where the data subject is physically or legally incapable of giving consent
• The data has been manifestly made public by the data subject
• Processing is necessary for the establishment, exercise, or defence of legal claims
• Processing is necessary for reasons of substantial public interest (such as prevention or detection of financial crime)

We implement additional safeguards when processing Special Categories of Personal Data, including strict access controls, enhanced encryption, and specific staff training requirements.

7.   Data Sharing and Disclosure

In the course of our business operations, we may share your personal data with the following categories of recipients. We only share personal data to the extent necessary for the specified purpose, and we require all recipients to handle your personal data in accordance with applicable data protection laws.

7.1  Regulatory and Government Authorities

7.2  Service Providers and Business Partners

We engage third-party service providers (“Data Processors”) to provide services in connection with our regulated activities. These service providers process your personal data only on our instructions and are contractually bound to protect your data. Our service providers include:

• Eligible custodians and custodian banks (for arranging custody, safeguarding client assets, and fund property segregation under the Holding or Controlling Client Assets endorsement and Managing a Collective Investment Fund licence)
• Credit providers and financial institutions (for arranging credit facilities and credit products)
• Fund administrators, transfer agents, fund accountants, and independent valuers (for Collective Investment Fund administration)
• External auditors (for statutory audit of the Firm’s accounts and fund audits as required by the CIR module)
• Internal auditors and compliance consultants
• Legal advisors and solicitors
• IT service providers, cloud hosting providers, and cybersecurity firms (including ISO 27001-certified data centres)
• Sanctions screening, PEP screening, and adverse media checking providers
• Identity verification and electronic KYC service providers
• Banking and payment processing service providers

7.3  Other Third Parties

• Counterparties to transactions arranged on your behalf (only the information necessary to execute or settle the transaction)
• Professional advisors (lawyers, accountants, tax advisors) acting on your behalf and with your authority
• Successors or acquirers in the event of a merger, acquisition, restructuring, or sale of the Firm or its business

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. We do not allow our third-party service providers to use your personal data for any purpose other than providing the specified services to us.

8.   International Data Transfers

As a DIFC-based financial services firm with an international client base, your personal data may need to be transferred to, and processed in, countries or jurisdictions outside the DIFC. Such transfers may occur, for example, when we share data with custodians, fund administrators, credit providers, or IT service providers located abroad.

We will only transfer personal data outside the DIFC in compliance with Part 7 of the DP Law and the DIFC Data Protection Regulations. Specifically, an international transfer of personal data will only take place where:

• The receiving jurisdiction has been assessed by the DIFC Commissioner of Data Protection as providing an adequate level of data protection (“Adequacy Assessment”); or

Appropriate safeguards have been put in place, which may include:

• Standard Contractual Clauses (SCCs) approved by the DIFC Commissioner of Data Protection
• Binding Corporate Rules (BCRs) approved by the Commissioner
• Certification under an approved certification mechanism (including the Global Cross-Border Privacy Rules (CBPR) framework)
• Approved codes of conduct

A specific derogation applies, including where:

• The transfer is necessary for the performance of a contract between you and us, or for pre-contractual steps taken at your request
• The transfer is necessary for compliance with a legal obligation
• The transfer is necessary to protect vital interests
• You have provided explicit, informed consent to the transfer

Key jurisdictions to which data may be transferred include, but are not limited to: the United Kingdom, the European Union/EEA, Mauritius, the United States, and other jurisdictions where our custodians, fund administrators, or IT providers operate. We maintain a record of all international data transfers.

You may request a copy of the safeguards we rely upon for international transfers by contacting our DPO / Compliance Officer at the details provided in Section 2.

9.   Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy our legal, regulatory, accounting, and reporting obligations. When determining the appropriate retention period, we consider:

• The nature and sensitivity of the personal data
• The purpose(s) for which it is held and whether those purposes have been fulfilled
• Applicable legal and regulatory minimum retention periods
• The potential risk of harm from unauthorised use or disclosure
• Whether anonymisation or pseudonymisation would adequately serve the relevant purpose

Upon expiry of the applicable retention period, personal data will be securely and permanently deleted, destroyed, or anonymised in such a way that it can no longer be attributed to an identifiable individual. Where data is anonymised, it may be retained indefinitely for statistical and research purposes.

We maintain a Data Retention Schedule, reviewed and updated annually by the DPO / Compliance Officer in consultation with the Risk and Compliance Committee.

10.  Data Security

The security of your personal data is of paramount importance to Whitegate Capital Limited. We implement appropriate technical and organisational security measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, alteration, disclosure, or access, having regard to the nature of the personal data processed and the risks involved.

10.1  Organisational Security Measures

• All employees, contractors, and authorised individuals are required to sign confidentiality agreements and data protection undertakings
• Mandatory data protection and information security training is provided to all staff at induction and annually thereafter
• A formal information security policy and acceptable use policy are maintained and enforced
• Strict due diligence and data protection contractual obligations are imposed on all third-party service providers and Data Processors
• A documented incident response plan and personal data breach notification procedure are in place (see Section 11)
• Privacy impact assessments (PIAs) are conducted for new processing activities, system deployments, or significant changes involving personal data
• Regular internal data protection audits are conducted by the Compliance Officer
• Business continuity and disaster recovery plans are tested at least annually

No data transmission or storage system can be guaranteed to be 100% secure. If you believe your data has been compromised, please contact us immediately using the details provided in Section 2.

11.  Personal Data Breach Notification

A personal data breach is a security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. In the event of a personal data breach, we will follow the procedures set out below.

11.1  Internal Response Procedures

• Immediate containment and assessment of the breach upon identification
• Convening of the incident response team (comprising the DPO/Compliance Officer, IT Security, and senior management)
• Documentation of all personal data breaches, including the facts, categories of data affected, number of data subjects affected, likely consequences, and remedial actions taken, in the Firm’s Data Breach Register
• Root cause analysis and implementation of corrective and preventive measures

11.2  Notification to the DIFC Commissioner of Data Protection

Where a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, we will notify the DIFC Commissioner of Data Protection:

• Without undue delay, and in any event within 72 hours of becoming aware of the breach (unless the breach is unlikely to result in a risk to rights and freedoms)
• Where notification is not made within 72 hours, we will provide reasoned justification for the delay
• The notification will include: a description of the nature of the breach; the categories and approximate number of individuals concerned; the categories and approximate number of personal data records concerned; the likely consequences of the breach; and the measures taken or proposed to address the breach

11.3  Notification to Affected Individuals

Where a personal data breach is likely to result in a high risk to the rights and freedoms of the affected individuals, we will notify those individuals without undue delay. The notification will:

• Be communicated in clear and plain language
• Describe the nature of the breach and the personal data likely to have been affected
• Provide the contact details of our DPO / Compliance Officer
• Describe the likely consequences of the breach
• Describe the measures taken or proposed to address the breach and to mitigate its possible adverse effects

11.4  Notification to the DFSA

In accordance with our obligations under the DFSA Rulebook (GEN module), we will notify the DFSA without undue delay where a personal data breach constitutes a material operational risk event or an incident reportable to the DFSA under applicable DFSA Rules.

12.  Cookies and Website Usage

Our website ([Insert website URL]) uses cookies and similar tracking technologies to enhance your browsing experience, analyse usage patterns, and improve the quality of our online services. This section explains what cookies are, how we use them, and how you can manage your cookie preferences.

Cookies are small text files placed on your device when you visit a website. They are widely used to make websites work efficiently and to provide website owners with analytical information about user activity.

You can manage your cookie preferences by:

• Using the cookie consent banner displayed on your first visit to our website
• Adjusting the browser settings on your device to refuse cookies or to alert you when cookies are being used. Instructions for the most common browsers are available at www.aboutcookies.org
• Withdrawing consent at any time by contacting us at [Insert privacy email]

If you disable strictly necessary cookies, some features of our website and secure client portal may not function correctly. Disabling other categories of cookies will not affect core website functionality.

13.  Your Rights as a Data Subject

Under the DP Law, you have a number of rights in relation to your personal data. These rights are summarised below. Please note that some of these rights are not absolute and may be subject to limitations where we have overriding legal or regulatory obligations, or where exercising the right would adversely affect the rights of others.

13.1  How to Exercise Your Rights

To exercise any of your rights, please submit a written request to our DPO / Compliance Officer using the contact details provided in Section 2. Please include sufficient information to identify yourself and specify the right(s) you wish to exercise.

• We will respond to your request within 30 calendar days of receipt
• In complex cases, we may extend the response period by a further 30 days, in which case we will notify you within the initial 30-day period
• We do not charge a fee for responding to requests unless they are manifestly unfounded or excessive

Where we are unable to comply with your request (for example, due to overriding legal or regulatory obligations), we will explain the reason(s) and inform you of your right to complain to the DIFC Commissioner of Data Protection.

14.  Changes to This Privacy Policy

We review and update this Privacy Policy at least annually, and more frequently where required by:

• Changes to applicable laws or regulations (including changes to the DP Law, DFSA Rulebook, or UAE federal laws)
• Significant changes to our business activities, processing operations, or service offerings
• Material changes to our data processing arrangements, third-party processors, or international transfer mechanisms
• Guidance or decisions issued by the DIFC Commissioner of Data Protection or the DFSA

The effective date of the most recent revision is indicated at the top of this Policy. When we make material changes to this Policy, we will:

• Publish the updated Policy on our website with a prominent notice of the changes
• Notify existing clients by email or through their client portal accounts
• Where required by law, seek fresh consent from affected data subjects

We encourage you to review this Policy periodically to stay informed about how we protect your personal data. The continued use of our services following notification of material changes constitutes acceptance of the updated Policy.

Previous versions of this Privacy Policy are available upon request from the DPO / Compliance Officer.

15.  Complaints

We take data protection concerns seriously and are committed to resolving any issues promptly and in a transparent manner. If you have a concern or complaint about how we handle your personal data, we encourage you to contact us in the first instance.

15.1  Internal Complaints Process

Please contact our DPO / Compliance Officer in writing, providing:

• Your full name and contact details
• A description of your concern or complaint
• Any relevant dates, reference numbers, or supporting documentation

We will acknowledge receipt of your complaint within 5 business days and aim to provide a substantive response within 30 calendar days. If additional time is required, we will inform you of the expected resolution timeline.

15.2  DIFC Commissioner of Data Protection

If you are not satisfied with our response, or if you believe we have not adequately addressed your concern, you have the right to lodge a complaint with the DIFC Commissioner of Data Protection:

15.3  DFSA Complaints (Regulated Firm Conduct)

If your complaint relates to our conduct as a DFSA-regulated firm (rather than data protection specifically), you may also contact the DFSA:

16.  Governing Law and Jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of the Dubai International Financial Centre, including:

• DIFC Data Protection Law No. 5 of 2020 (as amended by DIFC Laws Amendment Law No. 1 of 2025)
• DIFC Data Protection Regulations
• Other applicable DIFC laws and regulations in force from time to time

Any disputes arising out of or in connection with this Privacy Policy, including disputes relating to the collection, processing, storage, disclosure, or security of your personal data, shall be subject to the exclusive jurisdiction of the DIFC Courts.

In the event of any conflict between this Privacy Policy and the requirements of applicable laws or regulations, the applicable laws and regulations shall prevail to the extent of such conflict. We will update this Policy promptly to reflect any such changes.

Nothing in this Privacy Policy limits or excludes any rights you have under applicable mandatory laws and regulations, including your rights as a data subject under the DP Law.

17.  Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy, your personal data, or our data protection practices, please do not hesitate to contact us:

We are committed to responding to all data protection enquiries promptly and in accordance with our obligations under the DP Law. We will acknowledge receipt of all enquiries within 5 business days.