Privacy Policy

Kaelo Global Ltd ("Kaelo", "we", "us", or "our") is committed to protecting the privacy and security of personal data. This Privacy Policy explains how we collect, use, store, share, and protect personal information in connection with our advisory services and this website (kaeloglobal.com).

This policy applies to all individuals who interact with Kaelo, including clients, prospective clients, business partners, website visitors, job applicants, and any other persons whose personal data we process. By accessing our website or engaging our services, you acknowledge that you have read and understood this Privacy Policy.

1. Data Controller

The data controller responsible for your personal data is:

Kaelo Global Ltd
Meydan Free Zone, Business Bay
Dubai, United Arab Emirates
Email: privacy@kaeloglobal.com

2. Information We Collect

We may collect and process the following categories of personal data:

2.1 Information you provide directly:

• Identity data: full name, title, date of birth, nationality, passport or identification numbers
• Contact data: email address, telephone number, postal address, business address
• Professional data: employer, job title, professional qualifications, LinkedIn profile
• Financial data: bank account details, investment history, source of wealth, source of funds (as required for KYC/AML compliance)
• Communications data: correspondence, meeting notes, enquiry form submissions
• Application data: CVs, cover letters, references, interview notes (for job applicants)

2.2 Information collected automatically:

• Technical data: IP address, browser type and version, operating system, device type
• Usage data: pages visited, time spent on pages, navigation paths, referral source
• Cookie data: as described in our Cookie Policy

3. Legal Bases for Processing

We process personal data on the following legal bases under the DIFC Data Protection Law 2020, the EU General Data Protection Regulation (GDPR), and the Singapore Personal Data Protection Act 2012 (PDPA):

• Contractual necessity: Processing necessary for the performance of our advisory engagement agreements and related services.
• Legal obligation: Processing required to comply with regulatory obligations, including AML/CFT requirements under DFSA, MAS, and SIBA regulations, and tax reporting obligations under FATCA and CRS.
• Legitimate interests: Processing necessary for business development, relationship management, internal analytics, fraud prevention, and network security, where such interests are not overridden by your fundamental rights.
• Consent: Where we rely on your consent for marketing communications or non-essential cookies, you may withdraw consent at any time without affecting the lawfulness of prior processing.

4. How We Use Your Information

We use personal data for the following purposes:

• Providing advisory, consulting, and investment-related services
• Client onboarding, including KYC, enhanced due diligence, and sanctions screening
• Communicating with you about our services, events, and publications
• Complying with regulatory and legal obligations across all jurisdictions in which we operate
• Processing job applications and managing recruitment
• Improving our website, services, and client experience
• Preventing fraud, money laundering, and other financial crime
• Protecting our legal rights and enforcing contractual obligations

5. Data Sharing

We may share personal data with the following categories of recipients:

• Regulatory authorities: DFSA, MAS, Seychelles financial services, and other regulators as required by law
• Professional service providers: External legal counsel, auditors, tax advisers, and fund administrators engaged in connection with our services
• Technology providers: Cloud hosting, email services, CRM systems, and analytics platforms that process data on our behalf under appropriate contractual safeguards
• Compliance service providers: KYC/AML screening providers, sanctions databases, and corporate intelligence firms
• Group entities: Kaelo offices in Dubai, Singapore, and Seychelles as necessary for service delivery

We do not sell personal data to third parties. We do not share personal data for direct marketing purposes without your explicit consent.

6. International Data Transfers

Given our operations across the UAE, Singapore, and Seychelles, personal data may be transferred internationally. Where data is transferred outside the DIFC, we ensure appropriate safeguards are in place in accordance with the DIFC Data Protection Law, including adequacy determinations, standard contractual clauses, or binding corporate rules. Transfers from the EEA are conducted in compliance with GDPR Chapter V requirements. Transfers from Singapore comply with the PDPA's transfer limitation obligation under section 26.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Client engagement records: Duration of engagement plus 7 years (regulatory retention requirement)
• KYC/AML records: 5 years from the end of the business relationship (DFSA requirement; 6 years under MAS)
• Job applications: 12 months from the date of application (or longer with consent for talent pipeline purposes)
• Website analytics: 26 months (anonymised after this period)
• Marketing preferences: Until withdrawal of consent

8. Your Rights

Depending on your jurisdiction and applicable law, you may have the following rights:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your data where there is no legitimate reason for continued processing
• Right to restrict processing: Request limitation of processing in certain circumstances
• Right to data portability: Receive your data in a structured, commonly used format
• Right to object: Object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent: Where processing is based on consent, withdraw at any time

To exercise any of these rights, please contact our Data Protection Officer at dpo@kaeloglobal.com. We will respond within 30 days under applicable law or 30 business days (PDPA). You also have the right to lodge a complaint with the relevant supervisory authority: the relevant data protection supervisory authority in your jurisdiction.

9. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption in transit (TLS 1.3) and at rest (AES-256), access controls with multi-factor authentication, regular security assessments, and employee training on data protection obligations. Our information security management framework is aligned with ISO 27001 principles.

10. Cookies and Tracking

Our website uses cookies and similar technologies to improve functionality, analyse usage, and deliver relevant content. For detailed information about the cookies we use and how to manage your preferences, please refer to our Cookie Policy.

11. Children's Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a child, we will take steps to delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, regulatory requirements, or applicable law. The "Last updated" date at the top of this page indicates when this policy was most recently revised. We encourage you to review this policy periodically. Material changes will be communicated via our website or direct correspondence where appropriate.

13. Contact Us

For questions about this Privacy Policy or to exercise your data protection rights:

Data Protection Officer
Kaelo Global Ltd
Meydan Free Zone, Business Bay, Dubai, UAE
Email: dpo@kaeloglobal.com