Privacy Policy

Kapiti Management FZE, registration number 6694/2015, is responsible for deciding how and why personal information covered by this Policy is processed.

In a specific professional engagement, another entity or professional may independently control information for its own services. Where that applies, its own privacy terms may also apply.

This Policy applies to personal information processed through:

• the Kapiti Management website and its enquiry forms;
• email, telephone, meetings, WhatsApp, and other business communications;
• prospective-client reviews and onboarding;
• professional engagements and ongoing corporate administration; and
• relationships with clients, beneficial owners, directors, employees, suppliers, professional partners, and other business contacts.

It does not govern a third party's independent processing or a website, platform, authority, bank, or professional firm that has its own privacy policy.

The information collected depends on how you interact with Kapiti and whether an enquiry becomes a professional engagement.

The current Website enquiry form asks for a service request, message and context, name, email address, phone number, and preferred contact method.

Kapiti may receive information:

• directly from you through forms, communications, meetings, instructions, and documents;
• from a company, authorised representative, introducer, adviser, colleague, or other person involved in a mandate;
• from public registries, government or authority records, company websites, professional databases, and other lawful public sources;
• from banks, free zones, authorities, local professionals, and service providers involved in a requested service; and
• automatically through standard hosting, security, and server logs when the Website is accessed.

If you provide information about another person, you must be authorised to do so and should ensure they receive this Policy where required.

Kapiti may process personal information to:

• receive, validate, assess, and respond to enquiries;
• communicate with you and arrange consultations or follow-up;
• prepare proposals, determine scope, and take steps requested before an engagement;
• verify identity, authority, beneficial ownership, source of funds, eligibility, and risk;
• establish, perform, administer, and document professional engagements;
• coordinate with authorities, registries, banks, free zones, advisers, and service providers;
• manage billing, payments, records, deadlines, quality, complaints, and client relationships;
• comply with legal, regulatory, tax, accounting, sanctions, anti-money-laundering, and reporting obligations;
• establish, exercise, or defend legal rights and protect people, information, systems, and operations;
• maintain and improve the Website, services, internal processes, and business continuity; and
• send relevant updates or marketing where permitted, subject to your preferences and right to object.

Depending on the circumstances and applicable law, Kapiti relies on one or more of the following grounds:

• your consent, where consent is required or is the appropriate basis;
• steps requested by you before entering an engagement and performance of an engagement;
• compliance with legal, regulatory, court, authority, and professional obligations;
• protection of public interests, safety, and the rights of Kapiti or another person;
• the establishment, exercise, or defence of legal claims; and
• Kapiti's legitimate business interests where permitted and not overridden by your rights, such as responding to business enquiries, administration, security, fraud prevention, and service improvement.

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect processing already carried out lawfully and may not prevent processing required on another lawful ground.

Corporate, residency, banking, and cross-border mandates may require detailed identity, ownership, financial, professional, or background information. Kapiti collects such information only where relevant to the proposed service, compliance review, or legal obligation.

Do not submit passports, bank statements, health information, criminal-history information, biometric data, or other sensitive material through the general Website form unless specifically requested through an appropriate channel. Where sensitive personal information is necessary, Kapiti applies additional care and an appropriate legal basis.

Kapiti does not sell personal information. Where necessary for the purposes described above, information may be shared with:

• Kapiti personnel and authorised representatives who need it for their work;
• affiliated or collaborating entities involved in an international mandate;
• government authorities, free zones, registries, immigration bodies, tax authorities, courts, regulators, and law-enforcement bodies;
• banks, payment providers, auditors, accountants, lawyers, notaries, translators, corporate-service providers, registered agents, and other appointed professionals;
• technology, hosting, email-delivery, communications, document, security, and business-administration providers;
• insurers, advisers, auditors, potential transaction counterparties, or successors in connection with risk, claims, reorganisation, or a business transfer; and
• another person where you direct or authorise the disclosure, or where disclosure is required or permitted by law.

Website enquiries are delivered using an external email-delivery provider to Kapiti's designated inbox. Providers may process information on Kapiti's behalf under contractual and security requirements, or as independent controllers where they determine their own purposes.

Kapiti manages international enquiries and services. Personal information may therefore be accessed, stored, or processed in the United Arab Emirates and in other countries connected with a mandate, a client, a service provider, an authority, or technical infrastructure.

Where personal information is transferred across borders, Kapiti uses measures required by applicable law, which may include assessing the destination's protections, contractual safeguards, explicit consent where appropriate, or a transfer necessary to perform a contract, comply with law, or establish or defend rights. Protections and legal rights may differ between countries.

Kapiti retains personal information only for as long as reasonably necessary for the purpose collected and to meet legal, regulatory, tax, accounting, professional, contractual, security, dispute, and recordkeeping requirements.

Retention is assessed by considering:

• whether an enquiry becomes an engagement;
• the nature, sensitivity, volume, and risk of the information;
• the service lifecycle and continuing client relationship;
• authority, corporate-record, anti-money-laundering, tax, limitation, and professional retention periods;
• open instructions, disputes, investigations, complaints, or legal holds; and
• whether information can be securely deleted, anonymised, or retained in a restricted archive.

Enquiries that do not proceed may still be retained for a reasonable period to document the interaction, manage follow-up, prevent duplicate or improper requests, and protect legal rights.

Kapiti uses reasonable technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration, loss, misuse, or destruction. These may include access controls, validation, role-based handling, secure service providers, confidentiality duties, backups, and incident-management procedures.

No website, email, transmission, or storage system can be guaranteed completely secure. You should use appropriate care when sending sensitive information and notify Kapiti promptly if you suspect an unauthorised disclosure or security incident.

At the effective date of this Policy, the Website code does not include advertising pixels or a dedicated analytics integration. Kapiti does not use the current Website to sell behavioural data or build advertising profiles.

The Website and its hosting or security infrastructure may still process essential technical information or use strictly necessary technologies to deliver pages, balance traffic, maintain security, prevent abuse, and diagnose errors. Standard server logs may record an IP address, request, timestamp, browser, device, or referring page.

If Kapiti later introduces non-essential analytics, advertising, or similar technologies, this Policy and any required consent controls will be updated before or when those technologies are used.

Kapiti may send service updates, invitations, or business content where you have requested them, consented, or where another lawful basis permits. You may object to direct marketing or unsubscribe at any time by using an available opt-out method or emailing legal@kapitimanagement.com.

Service, legal, compliance, security, and transaction messages are not marketing and may continue where needed to manage an enquiry or engagement.

The current Website form validates entries and generates a reference automatically, but Kapiti does not use the Website to make solely automated decisions that produce legal or similarly significant effects. Enquiries are reviewed by people.

Compliance tools or service providers may assist with screening, matching, or risk indicators during onboarding. Material decisions remain subject to appropriate human review unless applicable law permits otherwise and required safeguards are provided.

Subject to applicable law, identity verification, and relevant exemptions, you may have the right to:

• request information about the personal information Kapiti processes and obtain access to it;
• request correction of inaccurate information or completion of incomplete information;
• request deletion where the information is no longer needed or another legal ground applies;
• request restriction of processing in applicable circumstances;
• object to processing, including direct marketing;
• withdraw consent where processing relies on consent;
• request transfer of information in an orderly, machine-readable form where the right applies;
• object to certain solely automated decisions; and
• submit a complaint to the competent data-protection authority.

To exercise a right, email legal@kapitimanagement.com and describe your request. Kapiti may ask for information needed to confirm your identity, authority, and the records concerned. A request may be limited or refused where permitted by law, including where it would affect another person's rights, legal privilege, security, regulatory duties, investigations, or the establishment or defence of claims.

The Website and Kapiti's services are intended for adults and business users. They are not directed to children, and Kapiti does not knowingly collect children's personal information through the general enquiry form. If you believe a child has submitted personal information, contact Kapiti so the situation can be reviewed.

The Website may link to authority websites, banks, free zones, professional firms, WhatsApp, and other external services. Those parties control their own privacy practices. You should review their policies before providing information or using their services. Kapiti is not responsible for a third party's independent processing.

Kapiti may update this Policy to reflect changes in law, services, technology, providers, or business practices. The revised version will be posted on this page with an updated date. Where a change is material and applicable law requires additional notice or consent, Kapiti will take appropriate steps.

Questions, rights requests, privacy concerns, and complaints may be sent to:

Kapiti will review the request and respond in accordance with applicable law. You may also have the right to complain to the UAE Data Office or another competent authority. Kapiti encourages you to contact us first so the concern can be investigated directly.