Menu

10 Leaves Website Privacy Policy

Data Protection and Privacy Notice

This Data Protection and Privacy Notice (“Notice”) is issued by the 10 Leaves entities responsible for the operation of this Website and the services made available through it. These include 10 Leaves Limited, an entity established in the Abu Dhabi Global Market (“ADGM”), UAE, and 10 Leaves Consultancy Limited, an entity established in the Dubai International Financial Centre (“DIFC”), UAE (together, “10 Leaves”, the “Company”, “we”, “us” or “our”).

The entity responsible for Processing your Personal Data will depend on the entity with which you interact or engage. Personal Data Processed by 10 Leaves Limited is subject to the ADGM Data Protection Regulations 2021 and its subsequent amendments, where applicable. Personal Data Processed by 10 Leaves Consultancy Limited is subject to the DIFC Data Protection Law No. 5 of 2020 and the DIFC Data Protection Regulations and their subsequent amendments, where applicable.

Your privacy is important to us, and we are committed to protecting your personal data. Therefore, we respect and protect your right to privacy and will process your personal data in accordance with the provisions of the applicable privacy laws.

This Notice sets out what personal data we collect and how we collect and use it. It also sets out the rights you have in relation to the Personal Data.

What kind of personal data do we collect?

Personal data means any information relating to an identified or identifiable natural person. The Company collects and processes the following types of personal data:

  • name, address, email address, telephone number and other contact information;

  • date and place of birth;

  • nationality;

  • gender;

  • employment details;

  • marital status;

  • copies of identity documents (such as passport, national ID cart, driver’s license, employee identification numbers);

  • source of wealth;

  • utility bills, bank statements;

  • tax residency:

  • details of shareholdings and other assets which are legally or beneficially owned by the data subject;

  • details of people and organisations which may be connected to the data subject (by family or otherwise) 

Please note that the list is not exhaustive and that the Company may also collect and process personal data to extent this is useful or necessary for the provision of our services.

How does the Company collect personal data?

The Company obtains and processes personal data in different ways.

  • Personal data provided to the Company directly: We collect personal data directly from (prospective) clients, business partners and intermediaries for the purposes of entering into a contract or a service agreement and/or to meet certain legal requirements.
  • Personal data obtained from third parties :We also collect and process personal data from publicly accessible sources such as internet, social networks, World-Check or commercial registers. Furthermore, we may receive personal data from third parties as part of the service we provide to you or to people which are connected to you (including but not limited to organisations in which you have a shareholding or by which you are employed) or in connection with legal requirements that are applicable to us.

How does the Company use personal data?

The majority of the personal data processed by the Company is necessary for the performance of a contract to which the data subject is a party or to comply with the request of the data subject prior to entering into a contract. The Company also processes personal data in order to comply with our legal and regulatory obligations.

We may furthermore process personal data for the purposes of the legitimate business interests pursued by the Company. Such legitimate interests include general research and development (including statistical research or as a basis to analyze our current security measures), administration of our business and systems, including IT, billing and invoicing systems or to develop and improve our services or to strengthen our relationship with you. We may provide you with communications or information regarding our service offering which we think will be interesting for you. When we process your personal data for our legitimate business interests, or where consent to process personal data was received, we will consider and balance any potential impact on you and your rights under the relevant data protection and any other relevant law. Whenever we process personal data for these purposes you have the right to object to this way of processing.

Use of Automated and AI-enabled Systems

10 Leaves may use approved automated or artificial intelligence-enabled technologies to support the operation of the Website and the provision, administration and improvement of our services.

Where Personal Data is Processed by 10 Leaves Consultancy Limited in the DIFC through a machine-based system operating in an autonomous or semi-autonomous manner that constitutes a “System” for the purposes of Regulation 10 of the DIFC Data Protection Regulations, the requirements of Regulation 10 will apply to such Processing.

Not every software application, automated process or technology service used by 10 Leaves constitutes a System for the purposes of Regulation 10. Where Regulation 10 applies, 10 Leaves Consultancy Limited will ordinarily act as the “Deployer” where the System operates under its authority, on its direction or for its benefit. A third-party technology provider may act as a “Provider” and, where it operates or supervises the relevant System on behalf of 10 Leaves Consultancy Limited, may also act as an “Operator”.

1. Purposes and use of Systems

Where a System is used to Process Personal Data collected through the Website or in connection with our services:

1.  the Personal Data may only be Processed for a specific human-defined or human-approved purpose that is lawful and compatible with the purpose for which the Personal Data was collected;

2. a System must not independently establish a materially different Processing purpose outside the purposes, principles, limits and constraints approved by 10 Leaves;

3. use of a System does not create a separate lawful basis for Processing. The lawful basis applicable to the underlying Processing activity will continue to apply;

4. outputs generated by a System may include summaries, classifications, recommendations, drafted content, analysis, screening results or other generated information, depending on the relevant use case; and

5. where an output relates materially to an identifiable individual or may materially affect that individual, appropriate human review will be undertaken before the output is relied upon for a consequential decision or action.

2. Privacy and safeguards by design and default

10 Leaves applies appropriate technical and organisational measures to Systems used to Process Personal Data, having regard to the nature, scope, context and risk of the relevant Processing.

Depending on the System and its use case, such measures may include:

1. data minimisation and restrictions on the categories of Personal Data that may be submitted to the System;

2. access controls and role-based permissions;

3. use of approved enterprise or business configurations;

4.  restrictions on the use of Company or client data for model training where such controls are available;

5. encryption and confidentiality controls;

6. retention and deletion controls;

7. human review and escalation mechanisms;

8. monitoring for unfair, discriminatory or biased outcomes; and

9.  controls designed to ensure that the System operates only within approved purposes and authorised use cases.

3. Safety and safety verification

Where Regulation 10 applies, Systems used to Process Personal Data will be subject to appropriate Safety measures designed to identify the use of Personal Data, assess and mitigate risks of harm to individuals and reduce the risk of unfair, discriminatory or biased outcomes.

Appropriate oversight, testing and controls will be applied having regard to the nature and risk of the relevant System. Where required, safety verification may include consideration of regulatory compliance, information security, reliability of relevant outputs, appropriate human oversight and whether the System continues to operate within its approved purpose, limits and governance parameters.

4. Codes, certifications and policy frameworks

Where relevant, 10 Leaves may take into account recognised codes, certifications, standards and AI governance or policy frameworks when assessing and governing Systems used to Process Personal Data. These may include recognised ISO or SOC standards, the OECD AI Principles, the NIST AI Risk Management Framework, applicable UAE regulatory guidance, relevant vendor responsible-AI frameworks and any other codes, certifications or policy frameworks recognised or designated by the DIFC Commissioner of Data Protection from time to time.

5. Third-party Systems

Some Systems used by 10 Leaves may be developed, hosted, operated or supported by third-party technology providers. Before approving a System for use with Personal Data, 10 Leaves will apply appropriate due diligence and governance measures having regard to the nature of the Processing and associated risks.

Where applicable, contractual and organisational safeguards may address confidentiality, security, permitted Processing purposes, use of Personal Data for model training, assistance with Data Subject rights, incident notification, audit and regulatory access, retention and deletion, international transfers and the engagement of relevant sub-processors or other service providers.

6. Further information about Systems

Where required under Regulation 10, 10 Leaves Consultancy Limited maintains information concerning Systems used to Process Personal Data, including relevant use cases, Processing purposes, necessity and proportionality, the nature and use of outputs, applicable lawful bases, human oversight arrangements, privacy by design and default measures, Safety controls, applicable audit or certification requirements, relevant Third Parties and international transfer safeguards.

You may contact us at This email address is being protected from spambots. You need JavaScript enabled to view it. to request further information concerning a relevant System and its Processing of your Personal Data, including, where applicable:

1. the purpose and use case for which your Personal Data is Processed;

2. the nature of the output generated and how that output is used;

3. whether the System is used to make or support automated decisions concerning you;

4. applicable human intervention and oversight mechanisms;

5. relevant audit, certification or governance requirements;

6. relevant Third Parties, Operators, Processors or other recipients involved in the Processing; and

7. applicable international transfer arrangements and safeguards.

Information may be summarised or redacted to the minimum extent reasonably necessary to protect intellectual property rights, confidential information, security or to comply with Applicable Law. Any information required to be provided to the DIFC Commissioner of Data Protection will be provided in accordance with the applicable Law and Regulations.

To whom does the Company provide personal data?

The Company may disclose or transfer personal data collected by the Company to its group companies insofar as reasonably necessary for the purposes of our service offering or for bona fide compliance purposes as well as on the legal basis as set out in this Privacy Notice.

The Company may also engage approved technology providers that provide automated or AI-enabled functionality. Where such a provider Processes Personal Data on our behalf, appropriate contractual and organisational controls will be applied having regard to the provider’s role as a Processor, Sub-processor, Operator or Provider, as applicable. Where Regulation 10 of the DIFC Data Protection Regulations applies, use of the relevant System will additionally be subject to the governance, transparency, Safety and oversight requirements described in this Notice.


Except as otherwise described in this Notice or permitted or required under Applicable Law, the Company will not disclose, transfer or sell your Personal Data to a Third Party for purposes unrelated to those for which the Personal Data was lawfully collected.

The Company may disclose or transfer personal data to subcontractors, intermediaries or external advisors for the purpose of the proper performance of the services we provide to our clients. It may, for example, disclose or transfer such personal data to third party service providers who provide administrative, computer, payment, data processing, debt collecting or other services. We enter into data processing agreements with such subcontractors to ensure that they process your data, on our behalf, with the same level of security and confidentiality as applied by the Company. The Company may furthermore disclose or transfer personal data when we received your consent to do so. 


In addition, the Company may disclose or transfer personal data to protect our rights or those of our clients and/or to prevent fraud. The Company can also be obliged to disclose or transfer personal data to competent authorities in order to comply with our legal and/or regulatory obligations.

International transfers and data storage

The Company may disclose or transfer personal data to other group companies that are located in countries that are outside the UAE with the above purposes.

The personal data the Company processes is stored by the Company on our servers, and/ or on the servers of the cloud-based database management services the Company engages.


If disclosure or transfer of personal data is being done in a country that does not ensure an adequate level of protection of your personal data the Company will make sure additional safeguards will be put in place.

Retention

The Company will process and store the relevant personal data for the duration of our services or for the duration of the business relationship. The Company may also store the data for as long as it is necessary or required in order to fulfill legal, contractual or statutory obligations and, or for the establishment, exercise or defense of legal claims, and in general where it has a legitimate interest for doing so.

Your rights 

You have the following rights:

  • Access to your information

You have the right to access the personal information that the Company holds about you at any time.

  • Data portability

You may ask the Company to provide you with a copy of the personal information that the Company holds about you.

  • Correction of your personal information

You have the right to ask the Company to update and correct any out-of-date or incorrect personal information that we would hold about you.

  • Deletion of your personal information (the right to be forgotten)

You have the right to ask the Company to delete your personal information, to the extent that the Company has no legal and/or regulatory obligations to keep such personal information.

  • Restriction of processing of your personal information

You have the right to ask the Company to restrict the processing of your personal information in case:

  1. You contested the accuracy of the personal information held by the Company;
  2. The processing is unlawful but you objected to the deletion of the personal data and requests the restriction of the use instead;
  3. The Company no longer needs the personal data for the purposes of the processing, but you require them for legal reasons;
  4. You objected to processing and the Company is investigating whether there are legitimate grounds to override your objection.

 

  • Automatic decision making

10 Leaves may use automated or AI-enabled Systems to support certain Processing activities. We do not authorise a System to make a solely automated decision producing legal or other seriously impactful consequences concerning you without the safeguards required under Applicable Law.

Where a System supports a consequential decision concerning you, appropriate human review must be undertaken by a person with sufficient information and authority to meaningfully assess, challenge and, where appropriate, disregard or change the System’s output.

Where Article 38 of the DIFC Data Protection Law applies, you have the right to object to a decision based solely on automated Processing, including Profiling, which produces legal or other seriously impactful consequences concerning you and to require the decision to be reviewed manually, subject to the circumstances and exceptions provided under Applicable Law.

You may contact This email address is being protected from spambots. You need JavaScript enabled to view it. if you wish to obtain information regarding relevant automated Processing or challenge an outcome produced or materially influenced by a System.

  • Object

You have the right to object at any time to the processing of your personal data for any direct marketing (and related profiling) by the Company.

If you wish to exercise any of the above rights, you can contact the Company using the below contact details.

In addition you have the right to make a complaint with the local supervisory authority with respect to the way the Company is processing your personal data or the way the Company is handling your rights.

Navigation and Cookies

Please note that the Company is the controller of personal data collected through the Company’s website (the "Website").

The Company collects personally-identifiable information on certain areas of the Website when users register, request publications or other information, sign up for conferences and events, apply for jobs, and participate in user posting areas, such as bulletin boards, discussion forums, and surveys. The personally-identifiable information collected may consist of information that you provide, such as names, mailing addresses, e-mail addresses, telephone and fax numbers, and, for recruiting purposes, any other personally-identifiable information on your resume.

The Website also uses cookies to identify you and your interests and to track usage of the website. Cookies are small pieces of text stored on your computer that help us know which browser you are using and where you have been on the Website and on websites to which you may link in order to use some of our features. By accepting our cookie, you will be permitted access to certain pages of the Website without having to log in each time you visit. A user who does not accept the cookie from the Website may not be able to access certain areas of the Website. The Company also logs IP addresses, or the location of computers on the Internet, to help diagnose problems with our server and to administer the Website. If you prefer not to accept a cookie, you can set your web browser to warn you before accepting cookies, or you can refuse all cookies by turning them off in your web browser.

Where the Website subsequently incorporates any chatbot, intelligent agent, AI-enabled search functionality, recommendation tool or other autonomous or semi-autonomous System that Processes Personal Data, users will be provided with clear and accessible information about the relevant technology and Processing at or before the point of interaction, together with any additional information required under Regulation 10 of the DIFC Data Protection Regulations.

How we protect personal data?

The Company is committed to ensuring the security of your personal data. The Company takes appropriate commercially reasonable technical, physical and organisational measures to prevent unauthorised or unlawful processing of your personal data or accidental loss or destruction of your personal data. The Company will ensure a level of security suitable to the identified risks and pursuant to applicable data protection laws.

Employees of the Company are trained to handle personal data securely and with utmost respect and they will treat your personal data strictly confidential. Staff members shall be authorized to access personal data only to the extent necessary to serve the applicable legitimate purposes for which the data are processed by the Company and to perform their job.

The Company will not divulge client information to a third party unless we have received explicit client authorisation or we are required to do so by law.

Governance of Autonomous and Semi-Automated Systems

Responsibility for oversight of Systems used by 10 Leaves Consultancy Limited will be allocated in accordance with the DIFC Data Protection Law and Regulation 10 of the DIFC Data Protection Regulations.

Where a System is used to engage in High Risk Processing Activities and Regulation 10 requires the appointment of an Autonomous Systems Officer (“ASO”), 10 Leaves Consultancy Limited will appoint an appropriately qualified ASO with the required organisational authority and regulatory, technical and organisational expertise.

Where appointment of an ASO is not required, responsibility for oversight of relevant Systems and compliance with Regulation 10 will be clearly allocated within the organisation. Details of the responsible person or function will be made available to the DIFC Commissioner of Data Protection upon request.

Changes to this Notice

The Company may update this Notice from time to time. We advise you to periodically review this Notice to be informed of how the Company is protecting your privacy.

Contact

If you have any questions, concerns or complaints with respect to this Notice, the way the Company is handling your privacy or you wish to exercise any of your rights please contact dp (@) 10leaves.ae

 

Contact CONTACT
Facebook Chat Widget by 10leaves
184