Privacy Pollicy

1. Introduction

Innovest Management Consultants FZE (“Innovest”, “we”, “us”, or “our”) is committed to protecting the privacy and security of Personal Data. This Privacy Policy (“Policy”) explains how we collect, store, use, disclose, retain, and protect your Personal Data when you use our services, such as when you:

  • Visitour website at https://innovest.ae/,
  • Engage with us in connection with our business activities, including through proposals, due diligence, and business development conducted through our application forms and related channels.

This Policy is intended to comply with the DIFC Data Protection Law (DIFC Law No. 5 of 2020, as amended) (the “DP Law”), UAE Federal Data Protection Law (Federal Decree Law No. 45 of 2021) (the “UAE Data Protection Law”)and, where applicable, any other data protection laws relevant to the jurisdictions in which Innovest operates.

Innovest Management Consultants FZE, 33 A Maktabi, Floor 18, Sheikh Rashid Tower, Dubai World Trade Centre, Dubai, United Arab Emirates

2. Scope of this Policy

This Policy applies to Personal Data processed by Innovest through:

  • our website and any online forms, including the application/proposal form;
  • communications with prospective and existing business partners, counterparties, and clients;
  • due diligence and onboarding processes; and
  • marketing and website analytics activities, where applicable.

It applies to all persons whose Personal Data we collect, including website visitors, clients, prospective clients, business partners, and other persons who interact with us.

This Policy supplements, and should be read alongside, the Privacy and Data Protection Clause presented at the point Personal Data is submitted (for example, via the application form).

3. Data Controller and Contact Details

Innovest is the Data Controller responsible for Personal Data processed as described in this Policy.

For any questions about this Policy, or to exercise your Data Subject rights, you may contact us at:

4. Personal DataCollection of Personal Data

Depending on your interaction with us, we may collect the following categories of Personal Data:

  • Identification and contact details (e.g., name, job title, company, email address, phone number);
  • Business and financial information submitted through proposals or due diligence (e.g., company details, investment or transaction information, financial background);
  • Communications and correspondence exchanged with us;

Technical and usage data collected through the website (e.g., IP address, browser type, pages visited, referral source) — see Section 9 (Cookies).

5. Processing of Personal Data

We process Personal Data only where necessary for legitimate business purposes, will take all reasonably necessary steps to ensure your data is processed fairly and lawfully, and in accordance with the DP Law, UAE Data Protection Law, and other applicable data protection laws. Depending on the nature of your interaction with us, we may process your Personal Data for the following purposes:

  • Business development and proposals — to receive, review, and respond to proposals and to facilitate potential business collaboration or partnership discussions;
  • Due diligence and onboarding — to conduct due diligence, verify identity, assess suitability, and onboard prospective clients, partners, or counterparties;
  • Marketing — to send information about Innovest’s services, insights, or events, where you have consented or where otherwise permitted by law
  • Website analytics — to understand how visitors use our website and to improve its functionality and content; and
  • Legal and compliance — to comply with applicable legal, regulatory, or contractual obligations.

6. Legal Basis for Processing

We process Personal Data only where we have a lawful basis to do so under the DP Law. Depending on the circumstances, we may rely on one or more of the following legal bases:

  • Consent — where you have given clear consent for us to process your Personal Data for a specific purpose,;
  • Performance of a contract — where processing is necessary to take steps prior to entering into, or to perform, a contract with you;
  • Legitimate interests — where processing is necessary for our legitimate business interests (e.g., evaluating proposals, conducting due diligence), provided such interests are not overridden by your interests or fundamental rights; and
  • Legal obligation — where processing is necessary to comply with an applicable law or regulation.

7. Data Retention

We retain Personal Data only for as long as necessary to fulfil the purposes for which it was collected, as set out in Section 5 of this Policy, or as otherwise required or permitted by applicable law. In general:

  • Proposals and business development data not resulting in a partnership: retained for 6 months from the date of submission, after which it is securely deleted or anonymised;
  • Due diligence and onboarding data: retained for 12 months to meet regulatory, contractual, and record-keeping obligations;
  • Marketing data: retained until you withdraw consent or opt out, or for 12 months;
  • Website analytics data: retained for 12 months or as configured in the relevant analytics tool.

Upon expiry of the applicable retention period, or once the purpose for which the Personal Data was collected has ceased, Personal Data will be securely and permanently deleted, anonymised, pseudonymised, or securely encrypted, in accordance with the DP Law.

8. International Transfers of Personal Data

Innovest is based in the Dubai World Trade Centre. In the course of our operations, Personal Data may be transferred to, and processed in, countries outside the DWTC, including countries in which Innovest currently operates or provides services.

Where Personal Data is transferred outside the DWTC, we will ensure that such transfers are protected through appropriate safeguards in accordance with DP Law and the UAE Data Protection Law, which may include:

  • transferring data to jurisdictions recognised by the DWTC Commissioner of Data Protection as providing adequate levels of protection;
  • use of standard contractual clauses or other appropriate safeguards approved under the Law; or
  • reliance on a derogation permitted under the Law (e.g., your explicit consent, or where the transfer is necessary for the performance of a contract with you).

We operate in Asia, Europe, USA, Middle East as of date we would transfer data between countries as required while working with the clients & companies in these jurisdiction.

9. Cookies and Similar Technologies

Our website uses only essential cookies that are necessary for the operation and security of the website, including maintaining user login sessions and enabling authenticated access to secure areas.

We do not use cookies for advertising, marketing, or profiling purposes. We also do not use analytics or tracking cookies that collect information about your browsing behaviour for commercial purposes.

Because only essential cookies are used, these cookies cannot be disabled through our website as they are required for the website to function properly.

10. Data Subject Rights

  • Subject to the applicable conditions, limitations and exceptions under the DP Law and the UAE Data Protection Law, you may have the following rights in relation to your Personal Data: Right of access — to obtain confirmation as to whether we process your Personal Data, and to request access to such Personal Data. Your right of access can be exercised for any reason, at any time, in accordance with DP Law, the UAE Data Protection Law, and other applicable laws
  • Right to rectification — to request rectification of information you think is incorrect or inaccurate Personal Data. You also have the right to ask us to complete information you think is incomplete;
  • Right to erasure — to request that we restrict processing, erase, transfer information you provided from one organisation to another, or otherwise process your Personal Data in line with the relevant articles providing for such rights set out in the DP Law or other applicable laws;
  • Right to object — to object on reasonable grounds to the processing of your Personal Data where such processing is based on our legitimate interests or, where applicable, for direct marketing purposes;
  • Right to restriction — to request that we restrict the way we process your Personal Data in certain circumstances prescribed by the applicable laws;
  • Right to data portability — where applicable, to receive the Personal Data you have provided to us in a structured, commonly used, machine-readable format, and where technically feasible to have it transmitted to another controller, where technically feasible.
  • Right to Withdraw Consent – to withdraw consent to the processing of your Personal Data. Your right to withdraw consent may be exercised at any time by notifying us through our Contact Details in this Policy.

To exercise any of these rights, please contact us at info@innovest.ae. We will respond to your request as soon as reasonably practicable within the timeframe prescribed under the applicable laws. We may need to verify your identity before acting on a request.

You also have the right to lodge a complaint with the DWTC Commissioner of Data Protection if you believe your Personal Data has been processed in a manner that is inconsistent with  the applicable laws.

11. Data Security

We implement appropriate technical and organisational measures to protect Personal Data against unauthorised or unlawful processing, accidental loss, destruction, or damage, including access controls, encryption where appropriate, and staff training on data protection obligations.

12. Disclosure of Personal Data

We may disclose Personal Data to the following categories of recipients:

  • service providers and professional advisers who assist us in operating our business, maintaining our website and IT systems, providing professional services, or supporting business development and due diligence activities, and who are subject to appropriate confidentiality and data protection obligations;
  • regulators, courts, law enforcement agencies, or other governmental authorities where disclosure is required or permitted by applicable law;
  • a successor entity or prospective purchaser in connection with a merger, acquisition, restructuring, sale of assets, or other corporate transaction, provided that appropriate safeguards are in place to protect your Personal Data.

We do not sell, rent, or trade Personal Data to third parties for their own marketing purposes.

13. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices or applicable law. Any updates will be published on our website and will take effect from the date of publication. The “Last Updated” date below indicates when this Privacy Policy was most recently revised. We encourage you to review this Privacy Policy periodically to remain informed of any changes. Last updated: August 2026

14. Contact Us

If you have any questions about this Privacy Policy or how we handle your Personal Data, please contact us at: