Kshetry & Co. (“Kshetry & Co.”, “we”, “us” or “our”) respects your privacy and is committed to handling personal data responsibly. This Privacy Policy explains how we collect, use, disclose, store and protect personal data when you visit our Website, contact us, request information or engage our services. This Policy is intended to operate in accordance with applicable UAE data-protection requirements, including Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data, together with other applicable laws and regulations.

1. PERSONAL DATA WE MAY COLLECT

Depending on how you interact with us, we may collect:

IDENTIFICATION INFORMATION

• Full name;
• Nationality;
• Date of birth where relevant;
• Passport or identification information where necessary;
• Emirates ID information where legally required; and
• Other identification information necessary for a particular service.

CONTACT INFORMATION

• Email address;
• Telephone number;
• Postal address;
• Business address; and
• Other contact details.

BUSINESS INFORMATION

• Company Name;
• Position;
• Business Activity;
• Corporate Structure;
• Transaction Information;
• Commercial Requirements;
• Contractual Information; And
• Information Provided In Relation To A Matter.

LEGAL / PROFESSIONAL INFORMATION

Where necessary for an engagement, we may process information relating to:

• Contracts;
• Disputes;
• Claims;
• Litigation;
• Arbitration;
• Property;
• Corporate Matters;
• Employment Matters;
• Estate And Succession Matters; And
• Other Professional Matters.

TECHNICAL INFORMATION

We may collect:

• IP address;
• Browser type;
• Device information;
• Operating system;
• Website activity;
• Approximate location information;
• Referring website;
• Access times; and
• Analytics information.

2. HOW WE COLLECT PERSONAL DATA

We may collect personal data:

• Directly from you;
• Through website forms;
• By email;
• By telephone;
• Through consultations;
• Through engagement documents;
• From your organisation;
• From authorised representatives;
• From publicly available sources;
• From government or regulatory authorities where legally permitted;
• From professional advisers; and
• From service providers assisting with your matter.

We seek to collect only information reasonably necessary for the relevant purpose

3. PURPOSES OF PROCESSING

We may process personal data to:

• Respond to Enquiries;
• Assess Potential Engagements;
• Conduct Conflict Checks;
• Provide Professional Services;
• Prepare Legal and Commercial Documents;
• Perform Due Diligence;
• Communicate With Clients;
• Administer Engagements;
• Process Payments;
• Coordinate Third-Party Services;
• Comply With Legal and Regulatory Obligations;
• Maintain Business Records;
• Protect Our Systems;
• Prevent Fraud or Misuse;
• Improve Our Website; And
• Perform Other Lawful Business Purposes.

4. LEGAL BASIS FOR PROCESSING

Where applicable, personal data may be processed on the basis of:

• Consent;
• Performance of a contract or steps requested before entering into a contract;
• Compliance with a legal obligation;
• Protection of legitimate interests;
• Protection of vital interests;
• Public-interest requirements; or
• Another lawful basis recognised under applicable law.

The UAE Personal Data Protection Law recognises circumstances in which processing may occur without consent where legally justified, including certain legal or publicinterest circumstances.

5. CONSENT

Where consent is required, we will seek consent in an appropriate manner. You may withdraw consent where applicable, although withdrawal will not affect processing that was lawfully carried out before withdrawal or processing that may continue under another lawful basis.

6. MARKETING COMMUNICATIONS

We will not use personal information for direct marketing in a manner prohibited by applicable UAE law. Where consent is required for marketing communications, we will obtain the appropriate consent. You may request to stop receiving marketing communications by using the relevant unsubscribe mechanism or contacting us. UAE consumer-protection rules include protections relating to consumer privacy and the use of consumer data for marketing.

7. DISCLOSURE OF PERSONAL DATA

We may disclose personal data where reasonably necessary to:

• Authorised employees;
• Professional consultants;
• Advocates;
• Legal consultants;
• Accountants;
• Auditors;
• Tax Advisers;
• Government Authorities;
• Courts and Tribunals;
• Arbitral Institutions;
• Notaries;
• Banks and Payment Providers;
• Technology Providers;
• Document-Management Providers;
• Translators;
• Pro or Corporate Service Providers;
• Insurers; And
• Other Service Providers Supporting an Engagement.

Third parties will receive only information reasonably necessary for the relevant purpose, subject to applicable legal and contractual requirements.

8. CROSS-BORDER TRANSFERS

Because Kshetry & Co. may work across multiple jurisdictions, personal data may in appropriate circumstances be transferred or accessed outside the UAE. Any crossborder transfer will be undertaken subject to applicable UAE data-protection requirements and any applicable safeguards or legal basis. The UAE Personal Data Protection Law includes provisions concerning cross-border transfers and sharing of personal data.

9. DATA SECURITY

We implement reasonable technical and organisational measures designed to protect personal data against:

• Unauthorised Access;
• Accidental Loss;
• Destruction;
• Alteration;
• Disclosure;
• Misuse; And
• Other Unlawful Processing.

However, no electronic system can be guaranteed to be completely secure.

10. DATA RETENTION

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including:

• providing services;
• maintaining professional records;
• complying with legal obligations;
• resolving disputes;
• enforcing agreements;
• meeting regulatory requirements; and
• protecting legitimate business interests.

Retention periods may vary according to the nature of the information and applicable legal requirements.

11. YOUR DATA RIGHTS

Subject to applicable law and any relevant exceptions, you may have rights concerning your personal data, including rights to:

• Obtain information regarding processing;
• Access personal data;
• Request correction of inaccurate information;
• Request updating of information;
• Request restriction or cessation of certain processing;
• Withdraw consent where consent is the applicable basis;
• Request deletion where legally available;
• Object to certain processing where legally available; and
• Exercise other rights provided by applicable law.

The UAE government describes the Personal Data Protection Law as providing individuals with rights including correction of inaccurate data and restricting or stopping certain processing. Requests should be submitted using the contact details below.

12. IDENTITY VERIFICATION

To protect personal information, we may need to verify your identity before processing certain requests. We may request reasonable documentation for this purpose.

13. CHILDREN’S DATA

The Website is not intentionally directed towards children. We do not knowingly collect children’s personal data except where necessary for a lawful professional purpose and where appropriate safeguards are in place. Where a matter involves a minor, information will be handled in accordance with applicable law.

14. COOKIES AND TRACKING TECHNOLOGIES

We may use cookies and similar technologies to:

• operate the Website;
• remember preferences;
• understand Website usage;
• improve performance;
• maintain security; and
• analyse traffic

Where required, we will provide appropriate cookie controls. You may also manage cookies through your browser settings, although disabling certain cookies may affect Website functionality.

15. THIRD-PARTY WEBSITES

Our Website may contain links to third-party websites. We are not responsible for the privacy practices, content or security of third-party websites. You should review the privacy policies of those websites before providing personal information.

16. THIRD-PARTY SERVICE PROVIDERS

We may use external technology and professional service providers to support our operations. Such providers may process personal data only to the extent reasonably necessary for the services they provide and subject to applicable contractual, confidentiality and data-protection obligations.

17. DATA BREACHES

Where a personal-data incident occurs, Kshetry & Co. will assess the incident and take appropriate action in accordance with applicable law and regulatory requirements, including notification to relevant authorities or affected individuals where legally required.

18. CONFIDENTIALITY AND PROFESSIONAL PRIVILEGE

Privacy protection under this Policy does not by itself create professional privilege. Where a professional engagement exists, confidentiality and privilege will also be governed by:

• Applicable law;
• Professional rules;
• The relevant engagement terms; and
• The circumstances of the communication.

19. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect:

• Changes in law;
• Regulatory developments;
• Changes in our services;
• Technological developments; or
• Changes in our data-processing practices.

The latest version will be published on this Website with the updated effective date.

20. CONTACT US ABOUT PRIVACY

For questions, requests or complaints concerning personal data, please contact:

Kshetry & Co.
Dubai, United Arab Emirates
Privacy Contact: [Insert Name/Department]
Email: [Insert Privacy Email]
Telephone: [Insert Number]
Registered Address: [Insert Verified Address]

We will consider privacy requests in accordance with applicable law.

21. COMPLAINTS

If you believe that your personal data has been processed unlawfully or that your privacy rights have not been appropriately addressed, you may first contact Kshetry & Co. so that we can review and address the matter. You may also have the right to approach the relevant competent regulatory authority or court, depending on the nature of the matter and applicable law.

22. GOVERNING LAW

This Privacy Policy shall be interpreted in accordance with applicable laws of the United Arab Emirates and, where applicable, the Emirate of Dubai. Mandatory dataprotection rights applicable to an individual will not be excluded by this clause.