Privacy Policy

Effective Date: 21 April 2025

Fortis Intelligence Management Consultancies Company LLC (“Fortis Intelligence”, “we”, “us”, or “our”) is committed to protecting personal data in accordance with the United Arab Emirates Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“PDPL”), its Implementing Regulations, and other applicable laws where relevant.

This Privacy Notice explains how we collect, use, disclose, transfer, retain, and protect personal data, and outlines the rights available to individuals whose personal data we process.

  1. Scope of This Privacy Notice

This Privacy Notice applies to personal data processed by Fortis Intelligence in connection with:

  • Visitors to our website;
  • Clients, prospective clients, and their representatives;
  • Suppliers, advisors, counterparties, and professional contacts;
  • Individuals who communicate with us, attend meetings or events, or otherwise engage with our business.

This Notice applies regardless of whether personal data is collected electronically, in hard copy, verbally, or through other lawful means.

  1. Definitions

For the purposes of this Privacy Notice:

  • Personal Data means any data relating to an identified or identifiable natural person.
  • Sensitive Personal Data includes data relating to health, biometric or genetic data, criminal records, religious beliefs, or other categories protected under the PDPL.
  • Processing means any operation performed on personal data, including collection, storage, use, disclosure, transfer, restriction, or deletion.
  • Data Subject means the individual to whom the personal data relates.
  1. Categories of Personal Data We Collect

Depending on the nature of your interaction with Fortis Intelligence, we may collect and process the following categories of personal data:

3.1 Identification and Contact Data

  • Full name;
  • Email address;
  • Telephone number;
  • Postal or business address.

3.2 Professional and Business Information

  • Job title and role;
  • Employer or affiliated organisation;
  • Professional background, credentials, and experience;
  • Information contained in correspondence or engagement documentation.

3.3 Financial and Transactional Data

  • Bank account or payment details;
  • Invoicing and billing information;
  • Records of payments made to or received from us.

3.4 Technical and Usage Data

  • Internet Protocol (IP) address;
  • Browser type and version;
  • Device identifiers;
  • Website access logs and usage patterns.

3.5 Communications Data

  • Emails, messages, call records, meeting notes, and instructions;
  • Information voluntarily provided during enquiries, meetings, or engagements.

3.6 Special Categories of Data

We do not intentionally collect or process Sensitive Personal Data unless:

  • It is strictly necessary for a lawful purpose;
  • We are legally required to do so; or
  • We have obtained your explicit consent, where required by law.
  1. Sources of Personal Data

We may collect personal data from:

  • You directly;
  • Your employer or authorised representatives;
  • Publicly available sources, including corporate registries, court records, regulatory filings, and media publications, where lawful and relevant;
  • Third parties acting on your behalf or in connection with our professional activities.
  1. Purposes of Processing and Legal Basis

We process personal data only for specified, explicit, and legitimate purposes, including:

  • Providing advisory, intelligence, investigative, and related professional services;
  • Responding to enquiries and communications;
  • Managing client, supplier, and professional relationships;
  • Conducting due diligence, integrity checks, investigations, and risk assessments;
  • Supporting litigation, arbitration, regulatory, or enforcement proceedings;
  • Managing billing, accounting, and financial administration;
  • Complying with legal, regulatory, and contractual obligations;
  • Ensuring website security and functionality;
  • Improving our services and internal operations;
  • Sending business-related communications where permitted by law.

Processing is carried out on one or more of the following legal bases under the PDPL:

  • Consent, where required;
  • Performance of a contract or steps taken at your request prior to entering into a contract;
  • Compliance with a legal obligation;
  • Protection of legitimate interests, provided such interests do not override the rights and freedoms of the data subject.
  1. Disclosure and Sharing of Personal Data

Personal data may be disclosed, on a need-to-know basis, to:

  • Professional advisors, consultants, and service providers acting under our instructions;
  • IT, cloud hosting, cybersecurity, and communications service providers;
  • Banks, auditors, insurers, and professional firms;
  • Government authorities, courts, regulators, or law enforcement agencies where required or permitted by law;
  • Affiliated or related entities, where necessary for service delivery.

We do not sell, rent, or trade personal data.

  1. International Transfers of Personal Data

Where personal data is transferred outside the UAE, Fortis Intelligence ensures that:

  • The destination jurisdiction provides an adequate level of protection; or
  • Appropriate safeguards are implemented, including contractual, technical, and organisational measures in line with the PDPL.

International transfers occur only where necessary and lawful.

  1. Data Retention

Personal data is retained only for as long as necessary to:

  • Fulfil the purposes for which it was collected;
  • Comply with legal, regulatory, professional, and contractual obligations;
  • Resolve disputes and enforce agreements.

Certain records may be retained longer where required by law. Suppression or opt-out records may be retained to ensure compliance with preferences.

  1. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. Measures include access controls, secure systems, encryption where appropriate, and confidentiality obligations.

  1. Data Subject Rights

Subject to applicable law, data subjects may have the right to:

  • Confirm whether we process their personal data;
  • Access personal data;
  • Request correction or updating of inaccurate data;
  • Request erasure, where legally permissible;
  • Restrict or object to certain processing;
  • Withdraw consent, where processing is based on consent;
  • Request transfer of personal data, where applicable;
  • Lodge a complaint with the UAE Data Office or another competent authority.

Requests may be subject to verification and lawful limitations.

  1. Cookies and Website Technologies

Our website uses essential cookies for functionality and security. Non-essential cookies (such as analytics) are used only with consent. Browser settings may be used to control cookies.

  1. Third-Party Websites

Our website may contain links to third-party websites. We are not responsible for their privacy practices and encourage review of their notices.

  1. Changes to This Privacy Notice

We may update this Privacy Notice periodically. Updated versions will be posted with a revised effective date.

  1. Contact Information

For questions or requests relating to this Privacy Notice or personal data processing:

Fortis Intelligence

Email: [Insert official privacy contact email]

  1. Consent Mechanisms Under the UAE PDPL

Where processing relies on consent, Fortis Intelligence ensures that consent is freely given, specific, informed, unambiguous, documented, and withdrawable at any time. Withdrawal does not affect processing already lawfully carried out.

Consent is not relied upon where processing is necessary for contractual performance, legal obligations, or legitimate interests, including investigations and risk management.

  1. Data Minimisation, Necessity, and Proportionality

We apply strict principles of data minimisation, necessity, and proportionality. Personal data processed is limited to what is relevant and necessary. Investigative activities are subject to internal necessity and proportionality assessments, and anonymisation or pseudonymisation is applied where feasible.

  1. Lawful Intelligence, Investigations, and Open-Source Data Processing

Fortis Intelligence may process personal data from lawful public, commercial, or third-party sources for purposes including corporate intelligence, asset tracing, due diligence, litigation support, fraud detection, and risk assessment.

Processing is conducted lawfully, proportionately, and subject to legitimate interest balancing, professional judgment, and internal controls.

  1. Cross-Border and Asset Tracing–Related Processing

In complex cross-border matters, personal data may be processed across multiple jurisdictions to identify ownership, beneficial interests, asset concealment, dissipation, or misappropriation, and to support enforcement or recovery proceedings. Enhanced safeguards are applied reflecting the sensitivity of such work.

  1. Automated Processing and Decision-Making

We do not engage in automated decision-making or profiling producing legal or similarly significant effects without meaningful human oversight.

  1. Confidentiality and Professional Secrecy

All personal data is subject to strict confidentiality obligations. Access is restricted to authorised personnel on a need-to-know basis.

  1. Data Breach Management

In the event of a personal data breach posing a risk to individuals, we will take mitigation steps and notify authorities or affected individuals where required by law.

  1. Record-Keeping and Accountability

We maintain records of processing activities and periodically review data protection practices to ensure ongoing compliance with the PDPL.

  1. Governing Law

This Privacy Notice is governed by the laws of the United Arab Emirates.

  1. Law Enforcement, Legal Privilege, and Regulatory Carve-Out

Nothing in this Notice limits processing necessary for legal claims, legal privilege, regulatory cooperation, or law enforcement. Data subject rights may be restricted where required to protect investigations or proceedings.

  1. Data Accuracy and Source-Reliability Disclaimer

Data may originate from public, third-party, or historical sources. While reasonable steps are taken to assess credibility, Fortis Intelligence does not warrant completeness or accuracy in all cases, particularly in intelligence and investigative contexts involving allegations or preliminary findings.

  1. Jurisdictional Scope and Conflicts of Law

This Notice is governed by UAE law. Where foreign laws apply extraterritorially, Fortis Intelligence will comply to the extent required, without creating obligations where none legally exist.

  1. Litigation Hold and Evidence Preservation

Where litigation or enforcement is anticipated, personal data may be retained beyond standard retention periods to preserve evidence and comply with legal hold obligations.

  1. Language

This Privacy Notice is issued in English. In the event of translation, the English version shall prevail.