Privacy Policy

Enhanced UAE PDPL & CBUAE Compliance Update:

• Added a strict data localization standard for payment data per Central Bank of the UAE mandates.
• Implemented unbundled consent; marketing and non-essential activities now require separate affirmative action.
• Added Data Subject Rights Relating to Automated Processing, including human review of algorithmic decisions.
• Updated breach notification protocols to regulators (UAE Data Office / DIFC / ADGM).
• Updated mandatory 5-year data retention for financial records.
• Integrated Privacy by Design through ongoing Data Protection Impact Assessments (DPIAs).

Your privacy is important to us. Capmob Financial Services LLC ("Capmob") is located at 901-48 Iris Bay, Business Bay, Dubai, UAE.

It is Capmob's policy to respect your privacy regarding any information the company may collect while operating our website or application. This Privacy Policy applies to Capmob Financial Services LLC ("Capmob") (including its successors and assigns) (hereinafter, "us", "we", "company" or "www.capmobfinance.com"). We respect your privacy and are committed to protecting personally identifiable information you may provide us through the Website or Application.

The company has adopted this privacy policy ("Privacy Policy") to explain what information may be collected on our Website or application, how we use this information, and under what circumstances we may disclose the information to third parties. This Privacy Policy applies only to information we collect through the Website or application and does not apply to our collection of information from other sources.

This Privacy Policy, together with the terms of service posted on our website or application, set forth the general rules and policies governing your use of our website or application. Depending on your activities when visiting our Website or application, you may be required to agree to additional terms of service.

This Privacy Policy has been prepared in compliance with:

• Federal Decree-Law No. 45 of 2021; DIFC Law No. 5 of 2020;
• ADGM Data Protection Regulations 2021;
• Central Bank Regulations;
• Other applicable acts, regulations, and rules requiring the publication of a privacy policy for handling or dealing in personal information, including sensitive personal data or information, as well as all applicable laws, regulations, and guidelines issued by applicable regulatory authorities, including but not limited to the Central Bank.

This Privacy Policy is incorporated into and at all times is subject to and is to be read in conjunction with the Terms of Use of the platform.

This Privacy Policy applies to all services, platforms, and data processing activities conducted by Capmob (the "Company") and its related group entities, subsidiaries, and affiliates.

For the purposes of this Policy, the terms "we," "us," "our," "Capmob" or "the Company" shall collectively refer to Capmob Financial Services LLC together with its subsidiaries and affiliates.

The security and protection of your Personal Data (PD) are fundamental to the Company's operations. The Company, acting as a Data Controller under the UAE Federal Decree-Law No. 45/2021 (UAE PDPL), defines its objectives and principles for securing and protecting PD.

We collect and process your Personal Data solely for declared, specific, and legitimate purposes. In adherence to the Principle of Purpose Limitation (UAE PDPL Article 4), the collection is strictly limited to what is adequate and necessary to achieve the stated purposes.

We follow a documented risk management approach to developing and implementing Information Security policies, standards, and procedures. Our Information Security Program is designed to meet our mandatory obligations under UAE PDPL Article 10 (Security of Personal Data), identifying, classifying, and protecting information assets effectively.

We collect various categories of Personal Data (PD) from you, the Data Subject, including, but not limited to:

• Identity Data: Names, Date of Birth, Address, Phone Numbers, Email Addresses.
• Official Identification & Financial Data (Sensitive Personal Data): Official identification numbers (e.g., National ID/Emirates ID details), Tax Identification Numbers, Financial Account Numbers, and documentation related to income.
• Applicant Data: Educational History, Employment History, CV details, and professional references.
• Technical Data: Device Identifiers and IP addresses.

We process your Personal Data based strictly on a valid legal justification as defined by the UAE PDPL. We rely on the following legal bases for specific processing activities:

• Legal Obligation: For mandatory activities such as Customer Identity Verification (KYC/AML) and Financial Reporting and Taxation, as these are non-negotiable requirements under UAE regulatory law.
• Contractual Necessity: For processing required for Service Provision and Contract Fulfillment (e.g., utilizing Identity Data and Financial Account Numbers to process your financial application) and for Recruitment and Employment Assessment (as a necessary step prior to entering into a potential contract).
• Explicit Consent: For processing related to non-essential activities, such as Internal Analytics and Service Improvement (where the analysis is non-essential, e.g., personalized recommendations).
• Necessity for Controller's Legal Rights/Security: For data processing related to Platform Security and Fraud Prevention (using technical data and system logs), which is necessary to protect the Controller's legitimate rights and ensure system security.

This Privacy Policy applies to the Personal Data of all natural persons who interact with, access, or use the Capmob website or any digital services provided through it.

This includes clients, prospective clients, general website visitors, and individuals providing data for specific services (e.g., job applications or inquiries) via the website.

You hereby expressly consent to provide the information that may be required in relation to the Services being rendered on the Platform by us. You acknowledge that we shall collect the information detailed under this Privacy Policy to facilitate lending & non-lending services by partnering with various financial lenders, third parties, service providers, etc. based on your requirement to avail such services.

Capmob will only be using the information for providing the services to you.

This Privacy Policy is a governing document that details how we collect, use, and protect your Personal Data. It should be read in conjunction with the Capmob Terms of Use, which outlines the general contractual relationship between you and the Company. However, explicit consent for specific data processing activities is managed separately via affirmative action on the Platform and is not implied by agreement to the Terms of Use.

Your use of the Platform and agreement to the Terms of Use permits us to process Personal Data that is strictly necessary for the performance of the services you have requested.

Your Right to Withdraw Service-Related Consent: You have the right to withdraw your consent at any time. The withdrawal of consent must be made as easily as the process of giving consent.

Procedure: You can withdraw consent by sending an email to info@capmobfinance.com.

Consequence: Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. However, withdrawing consent may mean we cannot continue to provide the specific service or communication linked to that consent.

Explicit consent for auxiliary activities, specifically marketing and promotional communications, is managed separately through a distinct, affirmative action on the Platform (such as an unchecked opt-in box).

No Implied Agreement: Your agreement to the Terms of Use or your continued use of our core financial services does not imply consent for marketing or non-essential data processing. You may decline marketing communications without any prejudice to your ability to access and use the core functionalities of the Capmob Platform.

Ease of Withdrawal: You maintain the right to withdraw your marketing consent at any time through your account settings or by contacting our Data Privacy Team by sending an email to info@capmobfinance.com, and such withdrawal will not affect the core contractual relationship governed by the Terms of Use.

The Company adheres to legal, regulatory and customer privacy requirements.

• The Company collects personally identifiable information (PII) when voluntarily submitted by our online visitors. The information provided is used to fulfill specific requests unless given permission to use it in another manner.
• This privacy policy sets out the rules that the company will follow when processing your personal information to preserve the right to protect your personal data, your privacy, and to ensure that your personal data is not misused.

In connection with the services we provide, the Company may collect the following types of information:

• Personally Identifiable Information: Names, addresses, email addresses, phone numbers, Emirates ID, Passport, Company Name, Business Vintage, Turnover, Salary information and any other information that you share with us.
• User Communications: When a visitor sends an email or other communication to the Company, these communications may be retained in order to process inquiries, respond to requests, and improve overall services.

The Company only collects and processes Personal Information (PI) when necessary for the provision of services to our clients, or when required by legal obligation. Prior to or at the time of data collection, the Company shall provide all involved individuals with a clear and concise Privacy Notice.

As a general rule, the Company will not disclose personally identifiable information except when the Company is required or permitted per customer agreement, law or otherwise.

The Company may share information with governmental agencies or other companies assisting in fraud prevention or investigation when permitted or required by law, trying to protect against or prevent actual or potential fraud or unauthorized transactions, or investigating fraud which has already taken place.

Personal Information (PI) may be transferred, processed, and stored either to authorized external third parties or internally among the Company's affiliated entities. The primary processing and storage of PI are conducted entirely within the United Arab Emirates (UAE).

The Company takes reasonable steps to protect personally identifiable information through appropriate physical, technical, and managerial procedures.

The Company complies with the Privacy regulations set forth by the UAE's Federal Data Protection Law and other applicable laws regarding the collection, use, and retention of personal information.

As part of the Company's commitment to accountability and "Privacy by Design," we shall conduct formal Data Protection Impact Assessments (DPIAs) on an ongoing basis.

If the Company determines an employee is in violation of this Privacy Policy, that employee will be subject to the Company's disciplinary process.

In the event that the Company undergoes a merger, acquisition, asset sale, or similar corporate restructuring, we may disclose and transfer your Personal Information (PI) as part of that transaction, where reasonably necessary and legally permissible, with equivalent protection maintained.

This Privacy Policy is subject to change, mandated by our commitment to maintaining continuous compliance with all applicable laws and regulations of the UAE.

This Policy shall be formally reviewed at least annually and updated immediately as necessary following any material changes to our data processing activities or regulatory requirements.

Any revisions will be communicated by posting the updated Privacy Policy on our official website or application.

Information obtained from or relating to clients or former clients is subject to the terms of any specific privacy notice provided to that client, any governing contract or other agreement with the client, and all applicable enforcement laws.

In case of conflict, the specific contractual terms related to data protection generally govern the relationship.

In certain processing scenarios, we will be the Data Controller in respect of your relationship with us. The Data Controller is responsible for deciding how to hold and use Personal Data about you.

In some cases, we may process your personal data ourselves and do not share it with any external third parties.

We are committed to providing the clearest possible transparency.

We may provide supplemental privacy notices on specific occasions (e.g., when enrolling in a new service or using a new feature) when we are collecting or processing personal data about you.

These supplemental notices should be read together with this overarching Privacy Policy to ensure you are fully aware of how and why we are using your Personal Data.

The Company will cooperate with the appropriate regulatory authorities, including local data protection regulatory authorities (such as the UAE Data Office, DIFC, and ADGM), to resolve any complaints regarding the handling of personal data that cannot be resolved directly between the Company and an individual.

Furthermore, the Company does not process any data belonging to a Child (an individual under eighteen years of age) either directly or indirectly.

We adhere strictly to the Principle of Storage Limitation, Article 4(5) of Federal Law No. 45/2021 (PDPL). The Company will retain your Personal Information (PI) only for the maximum duration necessary to fulfill the specific purposes for which it was collected, or as required by law.

Retention Necessity: We will retain and use your PI for the duration of the service contract and to the extent necessary thereafter to comply with legal obligations, resolve disputes, and enforce our legal agreements and policies.

Right to Erasure and Disposal: Once the requirement to process your PI ends, the PI will be securely deleted or anonymized from all live and backup systems. If you exercise your Right to Erasure before the mandatory retention period expires, the Company will delete your PI immediately, provided there is no overriding legal obligation.

Our services are structured to comply with strict Central Bank of the UAE (CBUAE) mandates for Payment Service Providers, which require all associated Personal Data (PD) and Payment Transaction Data to be stored and maintained exclusively within the territorial boundaries of the UAE.

Furthermore, in adherence to CBUAE's AML/CFT and financial record-keeping regulations, this mandated data is securely retained for a minimum period of five (5) years following the date of the last transaction or the end of the customer relationship.

We may share your personal information (including Personal Information and Sensitive Personal Information) collected for the following purposes:

Business Transactions: If the Company is involved in a merger, acquisition or asset sale, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law enforcement: Under certain circumstances, the Company may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other legal requirements: The Company may disclose your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation;
• Protect and defend the rights or property of the Company;
• Prevent or investigate possible wrongdoing in connection with the Service;
• Protect against legal liability.

The security of your personal data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure.

While the company strives to use commercially acceptable means to protect your personal data, the company cannot guarantee its absolute security.

Since the company is ISO 27001 Certified, it makes sure to comply with all applicable clauses of the standard with respect to the security of the data of the user.

Compliance with the policy is mandatory and Capmob department managers shall ensure continuous compliance monitoring within their department.

Compliance with the statements of the policy is a matter of periodic review.

Any breach of the policy may constitute a security violation and gives the company the right to conduct disciplinary and/or legal action, up to and including termination of business relationship.

Security Incidents (SI) involve wrongful handling or disclosure of information and can give rise to Data Breaches where personal data is involved.

Any individual who suspects that a theft, breach or exposure of protected data has occurred must immediately provide a description of what occurred via email to info@capmobfinance.com.

The company adheres to the IRP (Incident Response Plan) process while handling the security breach.

Upon detection and confirmation of a Personal Data Breach, the Company will promptly assess the risk to Data Subjects.

We are obligated to notify the Competent Authority (the UAE Data Office, or the respective Free Zone Regulator such as the DIFC Commissioner or ADGM Registrar) of the breach without undue delay (not later than 72 hours) once we become aware of an incident that compromises the confidentiality, integrity, or availability of Personal Data.

We will notify you, the Data Subject, of the Personal Data Breach if the breach is likely to result in significant harm or risk to your privacy, rights, or freedoms.

Timing: Notification to the Data Subject will be made as soon as practically feasible (not later than 72 hours) after the risk assessment is complete.

Method: Notification will typically be sent via email.

Any breach notification provided to you will clearly include:

• A clear description of the nature of the Personal Data Breach;
• The categories of data and the approximate number of Data Subjects concerned;
• The likely consequences resulting from the breach;
• The measures taken or proposed to be taken by the Company to address the breach;
• Contact information where you can obtain further information from our Privacy Officer.

The rights that are available to you are as follows:

• Right to Access and Information
• Right to Request Rectification
• Right to Erasure
• Right to Restriction of Processing
• Right to Data Portability
• Right to Object
• Rights Relating to Automated Processing

You can exercise your rights by submitting a request to Capmob's Grievance Redressal Officer at info@capmobfinance.com.

Upon receiving your request, Capmob shall acknowledge your request within 3 working days, conduct a verification check to validate your identity, and accordingly process the request.

We will respond to all legitimate requests within 30 days of receiving them. In adherence to data quality best practices, any substantiated errors or inaccuracies in Personal Data shall be remediated or corrected within seven (7) business days following successful notification and verification.

In accordance with Article 16 of the UAE Federal Decree-Law No. 45/2021 on Personal Data Protection (UAE PDPL), you have specific rights concerning decisions made about you that rely solely on automated processing.

Right to Object and Request Human Intervention: You have the right to object to decisions that are based solely on automated processing, including profiling, if such decisions produce a legal effect concerning you or significantly affect you in a similar manner.

Where such a decision is made, you have the right to request human review, contest the decision, and express your point of view during the human review process.

How to Contest an Automated Decision: Submit a formal request to our Privacy Officer / Grievance Redressal Officer detailing the specific automated decision you are contesting and the reason you believe it is incorrect.

Exceptions: This right does not apply if the automated decision is necessary for entering into or performing a contract, is authorized by UAE Federal or Emirate Law, or is made with your separate and explicit consent.

Technological advances and changes in the business requirements will necessitate periodic revisions to documents.

Therefore, this document may be updated to reflect changes or define new or improved requirements as and when required and in compliance with the Information Security Program Charter.

We may share your personal information (including Personal Information and Sensitive Personal Information) collected for the following purposes:

Legal Purposes: We may share your information with law enforcement and other government agencies, courts and other bodies on their legal requests to comply with the law and aid the ongoing and impending legal proceedings.

Additionally, we may share your information collected on the Platform with:

• Our employees, agents, and professional advisors working with us for the purposes described in this Privacy Policy;
• The associated service providers that provide us services pertaining to protecting and securing our systems, and provide us other services requiring the processing of information and data collected so as to host your information or data for the proper functioning of the Platform.

If you have any questions about our Privacy Policy, please contact us via email at info@capmobfinance.com.

In case of any grievance, customers can intimate and record their complaints/grievances for a resolution via:

• Email to info@capmobfinance.com;
• A formal written complaint to: Capmob Financial Services LLC, 901-48 Iris Bay, Business Bay, Dubai, UAE.

If you are unsatisfied with the resolution provided, Capmob has appointed a data protection officer for certain jurisdictions. The appointed person may be reached at info@capmobfinance.com.

We are committed to resolving any concerns you may have regarding the processing of your Personal Data. If you remain unsatisfied with the resolution provided by our Data Protection Officer (DPO), or if your request regarding your data rights remains unresolved within the timeframe mandated by applicable law, you have the right to lodge a formal complaint with the relevant supervisory authority.

The appropriate regulator depends on the jurisdiction governing our operations and your data:

• UAE Federal Jurisdiction: For matters governed by the UAE Federal Decree-Law No. 45/2021, you may contact the UAE Data Office.
• DIFC Jurisdiction: If your data is processed within the Dubai International Financial Centre (DIFC) under DIFC Law No. 5/2020, you may contact the DIFC Commissioner of Data Protection via email at info@difc.ae.
• ADGM Jurisdiction: If your data is processed within the Abu Dhabi Global Market (ADGM) under the ADGM Data Protection Regulations 2021, you may contact the ADGM Office of Data Protection via email at Data.Protection@adgm.com.

We maintain these escalation paths in accordance with our duty of Accountability and your statutory right to seek regulatory intervention to ensure the protection of your privacy and data rights.