Privacy Policy

1.  Introduction

Medici Expert Consultancy FZ LLC, a legal entity incorporated in the United Arab Emirates under License No. 18740/2023, with its registered address at M1, Twin Towers, P.O. Box 4422, Fujairah, UAE (together with its affiliated entities, includin, Medici Expert Accounting F.Z.C and any subsidiaries, branches, or associated companies, collectively referred to as "Medici Expert", "we", "us", or "our"), is committed to protecting the privacy and personal data of all individuals who interact with us through our website located at https://medici.expert (the "Website") or in connection with our professional services.

This Privacy Policy ("Policy") explains how Medici Expert collects, uses, stores, shares, and otherwise processes personal data in connection with the Website and our professional activities. It also describes the rights available to individuals whose personal data we process and how those rights may be exercised.

This Policy should be read together with our General Terms and Conditions and Cookie Policy, both of which are available on the Website.

We process personal data in accordance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("UAE PDPL") and its implementing regulations. Where our processing activities fall within the territorial scope of the EU General Data Protection Regulation ("GDPR"), the UK General Data Protection Regulation and the UK Data Protection Act 2018 ("UK GDPR"), or other applicable data protection legislation, we apply the relevant requirements of those frameworks to the extent required by applicable law.

We do not represent that this Policy ensures compliance with all data protection laws in every jurisdiction globally. Users located in specific jurisdictions are encouraged to seek independent advice regarding their local privacy rights.

2.  Data Controller

For the purposes of this Policy and applicable data protection legislation, the data controller (or equivalent responsible party under the UAE PDPL) in respect of personal data collected through the Website and in connection with our professional services is:

Medici Expert Consultancy FZ LLC
M1, Twin Towers, P.O. Box 4422, Fujairah, UAE
Email: hello@medici.expert

In certain circumstances, professional services may be delivered through or in collaboration with affiliated entities, external counsel, agents, consultants, local partners, or other service providers. Where any such party independently determines the purposes and means of processing personal data, they may act as a separate data controller in respect of that processing. This Policy governs the processing activities of Medici Expert Consultancy FZ LLC as data controller in connection with the Website and our own professional activities.

If you have any questions regarding this Policy or wish to exercise your data subject rights, please contact us at: hello@medici.expert.

3.  Scope of This Policy

This Policy applies to the processing of personal data in the following contexts:

• access to and use of the Website, including browsing, navigating, and interacting with Website content;
• submission of contact forms, inquiry forms, or booking forms through the Website;
• email inquiries and other preliminary communications directed to Medici Expert prior to the execution of a separate written engagement agreement;
• booking and conducting introductory or exploratory calls arranged through the Website or by email;
• client onboarding, including the collection of information and documentation required to establish a professional relationship;
• Know-Your-Customer (KYC), Anti-Money Laundering (AML), sanctions screening, and related compliance checks conducted in connection with potential or existing client engagements;
• the provision of professional consultancy, corporate, compliance, regulatory, and related services under separate written agreements, to the extent personal data is processed in that context;
• marketing and professional communications, including newsletters, service updates, and event invitations, where permitted by applicable law or with consent where required;
• analytics, cookies, and similar tracking technologies used in connection with the Website, as further described in our Cookie Policy.

This Policy applies to personal data relating to natural persons, including individuals acting in a personal capacity, representatives and authorized persons of legal entities, beneficial owners, directors, officers, shareholders, and other individuals whose personal data is provided to us in connection with the above activities.

4.  Categories of Personal Data We Process

Depending on the nature of your interaction with us, we may collect and process the following categories of personal data:

• Identity Data: full name, date of birth, nationality, passport or national identity card details, Emirates ID (where applicable), photographs, signatures, and other information used to verify identity.
• Contact Data: email address, telephone number, postal address, and other contact details.
• Business and Professional Data: job title, professional role, employer or organization name, professional background, qualifications, and other information relevant to your professional capacity.
• Company and Representative Data: information relating to the legal entity you represent, including company name, registration number, jurisdiction of incorporation, registered address, corporate structure, and details of directors, officers, shareholders, and authorized persons.
• KYC and AML Data: identity verification documents, proof of residential address, information regarding ultimate beneficial ownership (UBO), politically exposed person (PEP) status, sanctions screening results, adverse media findings, and other information collected as part of our client due diligence and compliance obligations.
• Financial and Source of Funds / Source of Wealth Data: information regarding the origin of assets, source of funds, source of wealth, financial standing, and related documentation provided in connection with KYC/AML procedures or the provision of services.
• Communication Data: the content of correspondence, emails, messages, and other communications exchanged with us, including records of inquiries, instructions, and responses.
• Technical Data: IP address, browser type and version, operating system, device identifiers, time zone, referring URLs, and other technical information collected automatically when you access the Website.
• Usage and Cookie Data: information about how you navigate and interact with the Website, including pages visited, links clicked, session duration, and other behavioral data collected through cookies and similar technologies, as further described in our Cookie Policy.
• Marketing Preferences: your preferences regarding receipt of marketing and professional communications from us, including opt-in and opt-out records.
• Information Contained in Voluntarily Provided Documents: any personal data contained in documents, materials, or information voluntarily submitted to us by you or on your behalf in connection with an inquiry, onboarding process, or the provision of services.

We collect personal data directly from you, from the legal entity you represent, from publicly available sources (including company registries, regulatory databases, and sanctions lists), and, where applicable, from third-party verification and screening providers.

5.  Special Categories of Personal Data

We do not intentionally seek to collect special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a natural person, health data, or data concerning a person's sex life or sexual orientation) through the Website or in the ordinary course of our professional activities.

However, such data may occasionally be contained within documents, correspondence, or other information voluntarily provided to us by a client or user, for example within identity documents, corporate records, or background materials submitted in connection with KYC/AML procedures or the provision of services.

When we become aware that special category data has been provided to us, we will process it only to the extent strictly necessary for the relevant purpose, and only where a valid legal basis exists under applicable law, including, where required, explicit consent or another condition permitting such processing. We will apply appropriate safeguards to any such data.

6.  Purposes of Processing

We process personal data for the following purposes:

• Responding to inquiries and preliminary communications: to review, assess, and respond to inquiries, contact form submissions, and other communications received through the Website or by email prior to the establishment of a formal engagement.
• Arranging introductory and exploratory calls: to schedule and conduct introductory calls or meetings with prospective clients or other interested parties.
• Assessing potential engagements and conducting conflict checks: to evaluate whether we are able to act for a prospective client, including conducting internal conflict of interest checks and preliminary eligibility assessments.
• KYC, AML, sanctions screening, and compliance due diligence: to fulfill our obligations under applicable AML/CFT legislation, sanctions regulations, and other regulatory requirements, including verifying the identity of clients and their representatives, screening against sanctions lists and PEP databases, and assessing source of funds and source of wealth.
• Providing professional services: to perform consultancy, corporate, compliance, regulatory, and related services under separate written engagement agreements, including managing client matters, preparing documents, and communicating with clients and third parties on their behalf.
• Managing client relationships: to maintain and manage our professional relationships with clients, including record-keeping, correspondence, and follow-up communications.
• Preparing proposals, engagement letters, and invoices: to prepare and issue service proposals, engagement letters, fee estimates, and invoices in connection with potential or existing engagements.
• Legal, regulatory, accounting, and tax compliance: to comply with our legal and regulatory obligations, including record-keeping requirements, regulatory filings, reporting obligations, and cooperation with competent authorities.
• Website security and integrity: to monitor, maintain, and protect the security and integrity of the Website, including detecting and preventing unauthorized access, fraud, and other malicious activity.
• Analytics and improvement of the Website: to analyze how the Website is used, identify technical issues, and improve the functionality, content, and user experience of the Website, using analytics tools and cookies as described in our Cookie Policy.
• Marketing and professional communications: to send professional updates, newsletters, service-related communications, and other marketing materials where permitted by applicable law or with your consent where required. You may withdraw your consent or opt out at any time as described in Section 12 of this Policy.
• Record-keeping and administration: to maintain accurate and complete records of our professional activities, client interactions, and compliance procedures, as required by applicable law and professional standards.
• Protecting legal rights and preventing fraud: to establish, exercise, or defend legal claims, protect our rights and interests, and prevent, detect, and investigate fraud, misconduct, or other unlawful activity.

7.  Legal Bases for Processing

We process personal data only where a valid legal basis exists under applicable law. The legal bases on which we rely depend on the specific purpose of processing and the applicable legal framework. The principal legal bases we rely upon are set out below.

Where the UAE PDPL applies, we process personal data on the basis of consent, contractual necessity, legal obligation, legitimate interest, or other grounds recognized under the UAE PDPL and its implementing regulations. Where the GDPR or UK GDPR applies to our processing activities, we rely on the equivalent legal bases under those frameworks, as described below.

• Consent (Article 6(1)(a) GDPR; UAE PDPL): We rely on consent where we are required by applicable law to obtain it before processing personal data, including for non-essential cookies and certain direct marketing communications. Consent is freely given, specific, informed, and unambiguous. Where we rely on consent, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out prior to withdrawal. We do not rely on consent as a blanket basis for all processing activities.
• Performance of a contract or steps prior to entering into a contract (Article 6(1)(b) GDPR; UAE PDPL): We process personal data where it is necessary to perform a contract to which you are a party, or to take steps at your request prior to entering into a contract, including processing inquiries, preparing proposals, and conducting preliminary assessments.
• Compliance with a legal obligation (Article 6(1)(c) GDPR; UAE PDPL): We process personal data where we are required to do so by applicable law, including our obligations under UAE AML/CFT legislation (Federal Decree-Law No. 20 of 2018 and Cabinet Decision No. 10 of 2019), sanctions regulations, tax and accounting laws, regulatory reporting requirements, and other mandatory legal obligations.
• Legitimate interests (Article 6(1)(f) GDPR; UAE PDPL): We process personal data where it is necessary for the purposes of our legitimate interests or those of a third party, provided that such interests are not overridden by your interests, rights, or freedoms. Our legitimate interests include: operating and improving the Website; conducting conflict checks; maintaining the security and integrity of our systems; managing and developing our professional practice; and sending professional communications to existing contacts where permitted by applicable law.
• Establishment, exercise, or defence of legal claims (Article 9(2)(f) GDPR; UAE PDPL): We may process personal data, including where necessary special category data, for the purpose of establishing, exercising, or defending legal claims, including in the context of regulatory investigations, disputes, or litigation.
• Compliance with AML/KYC and sanctions obligations: We process personal data, including identity, financial, and due diligence data, as required by applicable AML/CFT legislation, sanctions regulations, and related regulatory frameworks. This processing is mandatory and cannot be waived by consent or contractual agreement.

Where we rely on legitimate interests as a legal basis, you may have the right to object to such processing in certain circumstances. Please refer to Section 11 of this Policy for further information on your rights.

8.  Cookies and Analytics

The Website uses cookies and similar tracking technologies to support its functionality, analyze usage patterns, and, where applicable, deliver relevant content. A cookie is a small text file placed on your device when you visit a website.

We use strictly necessary cookies to ensure the proper operation of the Website. These cookies do not require your consent. We may also use analytics, functional, and marketing cookies, which are deployed only where we have obtained your prior consent, to the extent required by applicable law.

Full details of the cookies we use, their purposes, their duration, and how you can manage your cookie preferences are set out in our Cookie Policy, available on the Website. You may withdraw or adjust your consent to non-essential cookies at any time through the cookie preference settings on the Website.

9.  Sharing of Personal Data

We do not sell personal data to third parties. We may share personal data with the following categories of recipients, where necessary and in accordance with applicable law:

• Affiliated entities and group companies: including Medici Expert LLC, Medici Expert Accounting F.Z.C and other subsidiaries, branches, or associated companies, where necessary for the provision of services or internal administrative purposes.
• External lawyers, consultants, accountants, and auditors: engaged to assist with the delivery of professional services or to provide independent advice in connection with a client matter or our own compliance obligations.
• Banks, payment institutions, company registries, free zones, and regulatory authorities: where required in connection with the provision of services, including company incorporation, bank account opening, licensing applications, and regulatory filings.
• KYC, AML, and sanctions screening providers: third-party providers engaged to assist with identity verification, due diligence, PEP and sanctions screening, and related compliance procedures.
• IT, hosting, CRM, email, analytics, and cloud service providers: third-party technology and infrastructure providers engaged to support the operation of the Website and our internal systems, subject to appropriate data processing agreements and confidentiality obligations.
• Professional advisers: including legal counsel, insurance providers, and other professional advisers engaged in connection with our business operations or the management of legal claims.
• Courts, regulators, law enforcement, and competent authorities: where we are required or permitted to do so by applicable law, court order, regulatory requirement, or in connection with the prevention, detection, or investigation of fraud or other unlawful activity. This includes disclosure to financial intelligence units and other competent authorities in connection with our AML/CFT obligations, which may be made without prior notice to the data subject where required or permitted by law.

Where we share personal data with third-party service providers acting on our behalf, we require them to process personal data only in accordance with our instructions and to implement appropriate technical and organizational measures to protect the data.

10.  International Transfers of Personal Data

Medici Expert is based in the United Arab Emirates. Our clients, users, and service providers are located in various jurisdictions around the world. As a result, personal data that we collect may be transferred to, stored in, or processed in countries other than the country in which it was originally collected, including the UAE, the European Union and European Economic Area, the United Kingdom, the United States, and other jurisdictions depending on the nature of the services, the location of the relevant service provider, or the requirements of a particular client matter.

Where personal data is transferred internationally, we take steps to ensure that appropriate safeguards are in place to protect the data in accordance with applicable law. Such safeguards may include:

• transfers to countries or territories recognized as providing an adequate level of data protection under the UAE PDPL, GDPR, or UK GDPR, as applicable;
• the use of standard contractual clauses approved by the relevant supervisory authority, where required;
• contractual protections and data processing agreements with recipients that impose obligations equivalent to those applicable to us;
• transfer risk assessments, where required by applicable law; and
• other appropriate safeguards recognized under applicable data protection legislation.

You may request further information about the safeguards applicable to a specific transfer by contacting us at the details set out in Section 18 of this Policy.

11.  Data Retention

We retain personal data only for as long as is necessary to fulfill the purposes for which it was collected, to comply with our legal and regulatory obligations, to resolve disputes, and to enforce our agreements. The appropriate retention period depends on the nature of the data, the purpose of processing, and the applicable legal framework.

The following general principles apply to our retention practices:

• Inquiry and contact data: personal data collected through contact forms, email inquiries, or booking forms that do not result in a formal engagement will generally be retained for a reasonable period sufficient to respond to the inquiry and assess whether a professional relationship may be established, after which it will be deleted or anonymized unless we have another legal basis for retention.
• Client onboarding and KYC/AML data: personal data collected in connection with client onboarding, identity verification, and KYC/AML due diligence will be retained for the duration of the client relationship and for a minimum period of five (5) years following the termination of the relationship, or such longer period as may be required by applicable AML/CFT legislation, regulatory guidance, or other mandatory legal requirements.
• Accounting and billing records: financial records, invoices, and related documentation will be retained for the period required by applicable accounting, tax, and commercial laws, which is generally a minimum of five (5) years from the end of the relevant financial year, or such longer period as required by applicable law.
• Legal and compliance records: records maintained for the purpose of legal compliance, regulatory reporting, or the establishment, exercise, or defence of legal claims will be retained for the duration of any applicable limitation period and for such additional period as may be necessary to resolve any pending or threatened proceedings.
• Marketing data: personal data processed for marketing purposes will be retained until you withdraw your consent or opt out of marketing communications, or until we determine that the data is no longer relevant for marketing purposes, whichever is earlier.
• Cookie and analytics data: data collected through cookies and analytics tools will be retained in accordance with the retention periods set out in our Cookie Policy.

At the end of the applicable retention period, personal data will be securely deleted, destroyed, or anonymized in accordance with our internal data management procedures.

12.  Your Rights as a Data Subject

Depending on your location and the applicable data protection legislation, you may have the following rights in relation to your personal data. These rights are not absolute and may be subject to limitations and exceptions under applicable law, including in connection with our AML/CFT and other mandatory compliance obligations.

• Right of access: you have the right to request confirmation of whether we process your personal data and, if so, to obtain a copy of that data together with information about how it is processed.
• Right to rectification: you have the right to request the correction of inaccurate or incomplete personal data that we hold about you.
• Right to erasure ("right to be forgotten"): you have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent (and no other legal basis applies), or where the data has been unlawfully processed. This right does not apply where we are required to retain the data by applicable law or for the establishment, exercise, or defence of legal claims.
• Right to restriction of processing: you have the right to request that we restrict the processing of your personal data in certain circumstances, including where you contest the accuracy of the data or where you have objected to processing pending verification of our legitimate grounds.
• Right to object: you have the right to object to the processing of your personal data where we rely on legitimate interests as our legal basis, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or where the processing is necessary for the establishment, exercise, or defence of legal claims. You also have the right to object at any time to the processing of your personal data for direct marketing purposes.
• Right to data portability: where processing is based on consent or contractual necessity and is carried out by automated means, you may have the right to receive your personal data in a structured, commonly used, and machine-readable format and to request its transfer to another controller, where technically feasible.
• Right to withdraw consent: where we rely on your consent as the legal basis for processing, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.
• Right to lodge a complaint: if you consider that our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority in your jurisdiction. In the UAE, the relevant authority is the UAE Data Office. If you are located in the EU/EEA, you may contact the supervisory authority in your Member State. If you are located in the United Kingdom, you may contact the Information Commissioner's Office (ICO).

To exercise any of the above rights, please submit a written request to us at hello@medici.expert. We will respond to your request within the timeframe required by applicable law. We may need to verify your identity before processing your request. We will not charge a fee for handling your request unless the request is manifestly unfounded or excessive.

13.  Marketing Communications

We may send professional updates, newsletters, service-related communications, and other marketing materials to individuals who have expressed an interest in our services or with whom we have an existing professional relationship, where permitted by applicable law.

Where applicable law requires prior consent for the sending of marketing communications, we will only send such communications where we have obtained your consent. In other cases, we may rely on our legitimate interests in communicating with existing contacts about our professional services, subject to your right to opt out at any time.

You may withdraw your consent to, or opt out of, marketing communications at any time by:

• сlicking the unsubscribe link included in any marketing email we send you; or
• ·contacting us directly at hello@medici.expert with a request to be removed from our marketing list.

Opting out of marketing communications will not affect the receipt of service-related or transactional communications that are necessary in connection with an existing engagement or legal obligation.

14.  Security of Personal Data

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include, as appropriate:

• access controls and authentication procedures to restrict access to personal data to authorized personnel only;
• confidentiality obligations imposed on employees, contractors, and service providers who have access to personal data;
• secure storage of personal data, including the use of encryption where appropriate;
• limited access to personal data on a need-to-know basis;
• due diligence procedures applied to third-party vendors and service providers who process personal data on our behalf;
• internal policies and procedures governing the handling, storage, and disposal of personal data; and
• monitoring and review of our security measures on a periodic basis.

While we take reasonable steps to protect personal data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee the absolute security of personal data transmitted to or from the Website or stored on our systems. You transmit personal data to us at your own risk.

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will take appropriate steps in accordance with our obligations under applicable law, including notifying the relevant supervisory authority and, where required, affected individuals.

15.  Professional Confidentiality

As a professional consultancy and advisory firm, Medici Expert is subject to professional confidentiality obligations in respect of client information received in the course of providing services. We maintain strict confidentiality in relation to all information and documents provided to us by clients and do not disclose such information to third parties except:

• where required by applicable law, court order, or the direction of a competent regulatory or enforcement authority;
• where disclosure is necessary for the performance of services, including to external counsel, agents, or service providers engaged on the client's behalf;
• where we are required to make a disclosure in connection with our AML/CFT obligations, including the filing of suspicious transaction reports or other mandatory notifications to competent authorities, which may be made without prior notice to the client where required or permitted by law; or
• where the client has provided prior written consent to the disclosure.

Professional confidentiality obligations survive the termination of any engagement or professional relationship. These obligations apply in addition to, and do not limit, our obligations under applicable data protection legislation.

16.  Third-Party Websites and Links

The Website may contain links to third-party websites, platforms, or resources for convenience only. Medici Expert is not responsible for the content, privacy practices, security, or availability of any third-party websites. The inclusion of a link on the Website does not imply endorsement or approval of the linked website or its content by Medici Expert.

We encourage you to review the privacy policies of any third-party websites you visit. Your access to and use of third-party websites is at your own risk and is governed by the terms and privacy policies of those websites.

17.  Children

The Website is not directed at, and is not intended for use by, children under the age of 18 (or such other minimum age as may be applicable under local law). We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child without appropriate parental or guardian consent, we will take steps to delete such data as soon as reasonably practicable.

If you believe that we may have collected personal data from a child, please contact us at hello@medici.expert.

18.  Automated Decision-Making and Profiling

We do not use personal data for solely automated decision-making processes that produce legal effects concerning you or that similarly significantly affect you, within the meaning of applicable data protection legislation.

Where automated tools or systems are used in connection with our operations (for example, in the context of sanctions screening or analytics), such tools are used to support, and not to replace, human review and decision-making. Significant decisions affecting individuals are made with appropriate human involvement.

19.  Contact Details and Data Protection Enquiries

If you have any questions, concerns, or requests relating to this Policy or our processing of your personal data, please contact us using the details below:

Medici Expert Consultancy FZ LLC
M1, Twin Towers, P.O. Box 4422, Fujairah, UAE
Website: https://medici.expert
Email: hello@medici.expert

We will endeavor to respond to all legitimate requests within the timeframe required by applicable law. In some cases, particularly where requests are complex or numerous, it may take us longer to respond. We will notify you if this is the case and keep you updated on the progress of your request.

20.  Updates to This Privacy Policy

We may update or revise this Policy from time to time to reflect changes in our processing activities, applicable law, regulatory guidance, or our business operations. Any revised version of this Policy will be published on the Website with the date of the most recent update indicated at the top of the document.

We encourage you to review this Policy periodically to stay informed about how we process your personal data. Where required by applicable law, we will notify you of material changes to this Policy. Your continued use of the Website following the publication of a revised Policy constitutes your acknowledgment of the updated terms.

This Policy does not form part of any contract for the provision of services. It is provided for informational purposes and to fulfill our transparency obligations under applicable data protection legislation.