Privacy Policy

    1. Scope and Controller

This Privacy Policy (The “Policy”) applies to all subsidiaries affiliated to BCI Holding S.A. (“The company”), if not stated otherwise within this document, a company duly incorporated and registered under number 599079 at The Registrar of Corporate Affairs of the British Virgin Islands and established at the following address: Intershore Chambers, P.O.Box 4342, Road Town, Tortola, British Virgin Islands in its capacity of owner and controller of the personal data. 
This Policy is issued in compliance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and its Executive Regulations (collectively, the “UAE PDPL”), Regulation (EU) 2016/679 (the “GDPR”) where BCI or its EU group entities process Personal Data within the GDPR’s territorial scope, including where BCI or an EU group entity has an establishment in the EU or offers services to, or monitors the behaviour of, individuals in the EU, and all other applicable data protection laws in the jurisdictions where BCI operates.
By using the Website, viewing any product, data feed, and/or service (collectively the “Service”), you acknowledge that you have read, understood, and agree to be bound by this Policy. Please review the Terms and Conditions and the Cookies Policy prior to using the Website.

BCI Holding is committed to protecting the privacy of individuals whose Personal Data is processed in connection with our business activities, websites, platforms, products, and services.
Unless otherwise specified, BCI Holding SA acts as the Data Controller for Personal Data processed under this Privacy Statement. For EU Users, the relevant BCI EU entity may act as the Data Controller: [BCI EU entity name, address].

Owner and Data Collector Address:
BCI Holding SA
Address: Intershore Chambers, P.O.Box 4342, Road Town, Tortola, British Virgin Islands
Tel: +961 1 34 76 16
Email: inquiry@bciholding.com

 

    2. Construction

In this Privacy Policy, the terms set out below shall (unless the context requires otherwise) have the following respective meanings:

Personal Data (or Data)	means any information that directly, indirectly, or in connection with other information — including a personal identification number — allows for the identification or identifiability of a natural person.
Data Subject	means the natural person to whom the Personal Data refers.
Usage Data	means information collected automatically through this Website (or third-party services employed – if any), which can include: the IP addresses or domain names of the computers utilized by the Users who use this Website, the URI addresses (Uniform Resource Identifier), the time of the request, the method utilized to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server's answer (successful outcome, error, etc.), the country of origin, the features of the browser and the operating system utilized by the User, the various time details per visit (e.g., the time spent on each page within the Application) and the details about the path followed within the Application with special reference to the sequence of pages visited, and other parameters about the device operating system and/or the User's IT environment.
Cookie	means Trackers consisting of small sets of data stored in the User's browser. It is used to identify the User’s browser, provide analytics, remember information about the User such as its language preference or login information.
Data Controller (or Owner)	means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data, including the security measures concerning the operation and use of www.bciholding.com . The Data Controller, unless otherwise specified, is the Owner of this Website.
Data Processor	means the natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller, as described in this privacy policy.
Processing	Any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
Tracker	indicates any technology - e.g. Cookies, unique identifiers, web beacons, embedded scripts, e-tags and fingerprinting - that enables the tracking of Users, for example by accessing or storing information on the User’s device.
Services	means the service provided by this Website as described in the relative terms (if available) and on this site.
User	means the individual using this Website who, unless otherwise specified, coincides with the Data Subject.
Website	means the means by which the Personal Data of the User is collected and processed.
Sensitive Personal Data	means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation, as well as any other category of data classified as sensitive under the UAE PDPL.
Applicable Data Protection Law	means the UAE PDPL, the EU General Data Protection Regulation (where applicable), and any other data protection legislation applicable in the jurisdictions where BCI operates.
UAE Data Office	means the UAE Data Office established under the UAE PDPL as the competent authority for the regulation and supervision of Personal Data protection in the United Arab Emirates.

Other defined terms shall have the meaning set out in the Section in which that term is first used.

   3. Types of Data Collected

3.1 Depending on how you interact with the Website, we may collect: Name and surname, Email address, Telephone number, Company/organization, Job title, Country/location, Information submitted through contact or inquiry forms, IP address and device/browser information, Website usage and analytics data, 
3.2 Complete details on each type of Personal Data collected are provided in the dedicated sections of this privacy policy or by specific explanation texts displayed prior to the Data collection.
3.3 Personal Data may be freely provided by the User, or, in case of Usage Data, collected automatically when using this Website.
3.4 Unless specified otherwise, all Data requested by this Website is mandatory and failure to provide this Data may make it impossible for this Website to provide its services. In cases where this Website specifically states that some Data is not mandatory, Users are free not to communicate this Data without consequences to the availability or the functioning of the Service.
3.5 Users who are uncertain about which Personal Data is mandatory are welcome to contact the Owner.
3.6 Any use of Cookies – or of other tracking tools – by this Website or by the owners of third-party services used by this Website serves the purpose of providing the Service required by the User, in addition to any other purposes described in the present document and in the Cookie Policy.
3.7 Users are responsible for any third-party Personal Data obtained, published or shared through this Website and confirm that they have the third party's consent to provide the Data to the Owner.
3.8 BCI does not intentionally collect Sensitive Personal Data through this Website. If Sensitive Personal Data is inadvertently collected, it shall be processed in accordance with the enhanced protections required under the UAE PDPL and deleted where it is not strictly necessary for the stated purposes.

 

    4. Mode and Place of Processing the Data

4.1 Methods of processing
4.1.1 Personal Data is processed using secure technical and organizational measures to prevent unauthorized access, disclosure, modification, or unauthorized destruction of the Data.
4.1.2 The Data processing is carried out using computers and/or IT enabled tools, following organizational procedures and modes strictly related to the purposes indicated. In addition to the Owner, in some cases, the Data may be accessible to certain types of persons in charge, involved with the operation of this Website (administration, sales, marketing, legal, system administration) or external parties (such as third-party technical service providers, mail carriers, hosting providers, IT companies, communications agencies) appointed, if necessary, as Data Processors by the Owner. The updated list of these parties may be requested from the Owner at any time.

4.2 Legal Basis for Processing
4.2.1 The owner may process Personal Data relating to Users if one of the following applies. Where the GDPR applies, the legal bases for processing are those set out in Article 6 GDPR, as applicable, together with any additional conditions required for special categories of Personal Data under Article 9 GDPR.
a. Users have given their consent for one or more specific purposes;
b. provision of Data is necessary for the performance of an agreement with the User and/or for any pre-contractual obligations thereof;
c. processing is necessary for compliance with a legal and/or regulatory obligation to which the Owner is subject; or
d. processing is necessary for the purposes of the legitimate interests pursued by the Owner or by a third party.
e. processing is related to Personal Data that is clearly made public by the Data Subject.
4.2.2 BCI processes Personal Data only where legally permitted.

In any case, the Owner will gladly help to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.
4.2.3 Where BCI relies on consent as the legal basis for processing, such consent shall be freely given, specific, informed, and unambiguous, and may be withdrawn by the Data Subject at any time without affecting the lawfulness of processing based on consent before its withdrawal.

4.3 Place of Processing
4.3.1 The Data is processed at the Owner's operating offices and in any other places where the parties involved in the processing are located: across countries and offices where BCI operates, on BCI managed infrastructure; and on systems hosted by trusted service providers.
4.3.2 Depending on the User's location, data transfers may involve transferring the User's Data to a country other than their own. To find out more about the place of processing of such transferred Data, Users can check the section containing details about the processing of Personal Data.
4.3.3 Users are also entitled to learn about the legal basis of Data transfers to a country outside the European Union or the United Arab Emirates, or to any international organization governed by public international law or set up by two or more countries, and about the security measures taken by the Owner to safeguard their Data. Where the GDPR applies, transfers of Personal Data outside the EEA will be made on the basis of an applicable adequacy decision or, where no adequacy decision applies, Standard Contractual Clauses and appropriate supplementary safeguards. When Personal Data is transferred outside the UAE, BCI ensures that the recipient country or organisation provides an adequate level of protection as determined by the UAE Data Office, or that appropriate safeguards are in place in accordance with the UAE PDPL, including binding corporate rules, standard contractual clauses, or the explicit consent of the Data Subject.
4.3.4 BCI Holding Cross-Border Data Transfer Statement: BCI operates internationally and may transfer data between the EU, UAE, KSA, Lebanon, Turkey, and other jurisdictions. Where the GDPR applies, transfers outside the EEA will rely on an applicable adequacy decision or, where no adequacy decision applies, Standard Contractual Clauses and supplementary measures to ensure protection. All cross-border transfers comply with the requirements of the UAE PDPL and the guidelines issued by the UAE Data Office.

4.4 Retention time
4.4.1 Personal Data shall be processed and stored for as long as required by the purpose they have been collected for.
4.4.2 Personal Data collected for purposes related to the performance of a contract between the Owner and the User shall be retained until such contract has been fully performed.
4.4.3 Personal Data collected for the purposes of the Owner’s legitimate interests shall be retained as long as needed to fulfill such purposes. Users may find specific information regarding the legitimate interests pursued by the Owner within the relevant sections of this document or by contacting the Owner.
4.4.4 The Owner may be allowed to retain Personal Data for a longer period whenever the User has given consent to such processing, as long as such consent is not withdrawn. Furthermore, the Owner may be obliged to retain Personal Data for a longer period whenever required to do so for the performance of a legal obligation or upon order of an authority.
4.4.5 Once the retention period expires, Personal Data shall be deleted. Therefore, the right of access, the right to erasure, the right to rectification and the right to data portability cannot be enforced after expiration of the retention period.
4.4.6 BCI shall conduct periodic reviews of retained Personal Data to ensure that retention remains necessary and proportionate to the original purpose of collection, in accordance with the UAE PDPL.

4.5 The purposes of processing
4.5.1 The Data concerning the User is collected to allow the Owner to provide its Service, comply with its legal and/or regulatory obligations, respond to enforcement requests, protect its rights and interests (or those of its Users or third parties), detect any malicious or fraudulent activity, as well as the following: Hosting and backend infrastructure, Traffic optimization and distribution, Analytics, managing contacts and sending messages, SPAM protection and Infrastructure monitoring.
4.5.2 Marketing Communications
Where required by applicable law, BCI may use Personal Data to send Users marketing, promotional or other communications only where the User has provided the required consent. Users may withdraw their consent or unsubscribe from such communications at any time by using the unsubscribe mechanism provided in the communication or by contacting BCI through the contact details provided in this Privacy Policy. 
4.5.3 For specific information about the Personal Data used for each purpose, the User may refer to the section “Detailed information on the processing of Personal Data”.

4.6 Detailed information on the processing of Personal Data
Personal Data is collected for the following purposes and using the following services:
4.6.1 Analytics: The services contained in this section enable the Owner to monitor and analyze web traffic and can be used to keep track of User behavior.
4.6.2 Hubspot – Contact Management, Forms and Website Analytics
BCI uses HubSpot to support certain website functions, including contact forms, contact management, website analytics and communications. When you submit information through a form on our Website, such as your name, email address, company or other information you choose to provide, this information may be collected and processed through HubSpot for the purpose of responding to your request, managing our relationship with you and, where you have provided consent, sending relevant communications. Where consent has been provided, BCI may also use Hubspot to manage and send marketing or promotional communications. Users may withdraw their consent or unsubscribe from such communication at any time.
4.6.3 Hosting and backend infrastructure: This type of service has the purpose of hosting Data and files that enable this Website to run and be distributed as well as to provide a ready-made infrastructure to run specific features or parts of this Website.
Some services among those listed below, if any, may work through geographically distributed servers, making it difficult to determine the actual location where the Personal Data are stored.
4.6.4 Infrastructure monitoring: This type of service allows the Owner to monitor the use and behavior this Website’s components so its performance, operation, maintenance and troubleshooting can be improved. Which Personal Data are processed depends on the characteristics and mode of implementation of these services, whose function is to filter the activities of this Website.
4.6.5 SPAM protection: This type of service analyses the traffic of this Website, potentially containing Users' Personal Data, with the purpose of filtering it from parts of traffic, messages and content that are recognized as SPAM.
4.6.6 Traffic optimization and distribution: This type of service allows the Owner to distribute the content of this Website using servers located across different countries and to optimize performance. Which Personal Data are processed depends on the characteristics and the way these services are implemented. Their function is to filter communications between the Owner and the User's browser. Considering the widespread distribution of this system, it is difficult to determine the locations to which the contents that may contain Personal Information of the User are transferred.

4.7 Sharing of Personal Data
4.7.1 The owner may share Personal Data with:
•    Other BCI Group entities
•    Hubspot
•    Technology, hosting, and IT service providers
•    Legal, tax, and audit advisors
•    Regulatory authorities where required by law
4.7.2    BCI does not sell Personal Data.

 

    5. The Rights of Users

Users may exercise the following rights regarding their Data processed by the Owner:
5.1 Users have the right to withdraw consent where they have previously given their consent to the processing of their Personal Data.
5.2 Users have the right to object to the processing of their Data if the processing is carried out on a legal basis other than consent. Further details are provided in the dedicated section below.
5.3 Users have the right to learn if Data is being processed by the Owner, obtain disclosure regarding certain aspects of the processing and obtain a copy of the Data undergoing processing.
5.4 Users have the right to verify the accuracy of their Data and ask for it to be updated or corrected.
5.5 Users have the right, under certain circumstances, to restrict the processing of their Data. In this case, the Owner will not process their Data for any purpose other than storing it, including direct marketing.
5.6 Users have the right, under certain circumstances, to obtain the erasure of their Data from the Owner.
5.7 Users have the right to receive their Data in a structured, commonly used and machine-readable format and, if technically feasible, to have it transmitted to another controller without any hindrance. This provision is applicable provided that the Data is processed by automated means and that the processing is based on the User's consent, on a contract which the User is part of or on pre-contractual obligations thereof.
5.8 Users have the right to bring a claim before their competent data protection authority.
5.9 Users in the UAE have the right to lodge a complaint with the UAE Data Office in respect of any alleged violation of the UAE PDPL. Where the GDPR applies, EU Users also have the right to lodge a complaint with the supervisory authority in the EU Member State of their habitual residence, place of work, or the place of the alleged infringement.
5.10 Users have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, unless such processing is authorised under the UAE PDPL.
5.11 BCI shall respond to Data Subject requests within the timeframes prescribed by the Applicable Data Protection Law. BCI reserves the right to verify the identity of any person making a request and to refuse requests that are manifestly unfounded, excessive, or repetitive, in accordance with applicable law. BCI may charge a reasonable fee for manifestly unfounded or excessive requests.

 

    6. Details about the Right to Object to Processing

6.1 Where Personal Data is processed for a public interest, in the exercise of an official authority vested in the Owner or for the purposes of the legitimate interests pursued by the Owner, Users may object to such processing by providing a ground related to their particular situation to justify the objection.
6.2 Users must know that, however, should their Personal Data be processed for direct marketing purposes, they can object to that processing at any time without providing any justification. To learn, whether the Owner is processing Personal Data for direct marketing purposes, Users may refer to the relevant sections of this document.
6.3 Any requests to exercise User rights can be directed to the Owner through the contact details provided in this document. These requests can be exercised free of charge and will be addressed by the Owner as early as possible and always within one month.

 

    7. Cookies and Website Tracking

7.1 BCI uses cookies and similar technologies to support functionality, enhance user experience, and analyze performance.
7.2 Non-essential cookies require your consent and may be managed through the cookie banner.
7.3 To learn more, the User may consult the Cookie Policy. (hyperlink)

   8. Additional Information about Data Collection and Processing

8.1 The User's Personal Data may be used for legal purposes by the Owner in Court or in the stages leading to possible legal action arising from improper use of this Website or the related Services.
8.2 The User declares to be aware that the Owner may be required to reveal personal data upon request of public authorities.
8.3 To the maximum extent permitted by the UAE PDPL and other Applicable Data Protection Law, BCI shall not be liable for any indirect, incidental, consequential, or special damages arising out of or in connection with the processing of Personal Data, including but not limited to loss of profits, business interruption, or loss of data, except where such liability arises from BCI’s wilful misconduct or gross negligence.
8.4 The User agrees to indemnify and hold harmless BCI, its officers, directors, employees, agents, and affiliates from and against any claims, liabilities, damages, losses, and expenses (including reasonable legal fees) arising out of or in connection with: (a) the User’s provision of inaccurate, incomplete, or misleading Personal Data; (b) the User’s breach of this Policy or any Applicable Data Protection Law; or (c) any unauthorized use of the Website or Services by the User.
8.5 BCI shall not be liable for any failure or delay in performing its obligations under this Policy where such failure or delay results from circumstances beyond BCI’s reasonable control, including but not limited to acts of God, natural disasters, war, terrorism, cyber-attacks, government actions, pandemics, or failure of third-party systems or infrastructure (“Force Majeure Event”).

   9. Additional Information about User's Personal Data

In addition to the information contained in this privacy policy, this Website may provide the User with additional and contextual information concerning particular Services or the collection and processing of Personal Data upon request.

   10. Data Breach Notification

10.1 In the event of a Personal Data breach that is likely to result in a risk to the rights and freedoms of Data Subjects, BCI shall notify the relevant supervisory authority, including the UAE Data Office where applicable, without undue delay and in accordance with the timeframes prescribed by the Applicable Data Protection Law. Where the GDPR applies, BCI shall notify the competent EU supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.
10.2 Where the breach is likely to result in a high risk to the rights and freedoms of Data Subjects, BCI shall also notify the affected Data Subjects without undue delay, unless one of the exceptions under the Applicable Data Protection Law applies, including an applicable exception under the GDPR.
10.3 BCI maintains internal procedures for identifying, assessing, recording, and reporting Personal Data breaches in accordance with the UAE PDPL and the GDPR where applicable.

   11. System Logs and Maintenance

For operation and maintenance purposes, the Owner and any third-party services may collect files that record interaction with this Website (System logs) or use other Personal Data (such as the IP Address) for this purpose.

   12.  Data Protection Officer

12.1 Where required by the UAE PDPL, the GDPR, or other Applicable Data Protection Law, BCI shall appoint a Data Protection Officer (“DPO”). The DPO may be contacted at: [DPO Contact Email]. For EU Users, the relevant BCI EU entity’s EU representative and/or DPO may be contacted at: [EU representative/DPO contact]. The DPO shall oversee compliance with this Policy and Applicable Data Protection Law. 

 

    13. Security Measures

13.1 BCI implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing, including but not limited to: (a) encryption of Personal Data in transit and at rest; (b) access controls and authentication mechanisms; (c) regular security assessments and audits; (d) staff training on data protection and information security; and (e) incident response and business continuity plans. These measures are reviewed and updated periodically to address evolving risks and technological developments.

   14. Information not Contained in This Policy

More details concerning the collection or processing of Personal Data may be requested from the Owner at any time. Please see the contact information at the beginning of this document.

   15. Handling “Do Not Track” Requests

This Website does not support “Do Not Track” requests.

   16. Children’s Privacy

16.1 BCI services are not intended for children under the age of 18 (or such other age as prescribed by the UAE PDPL or other Applicable Data Protection Law). Where the GDPR applies to information society services offered directly to a child, BCI will obtain consent or authorisation from the holder of parental responsibility where required by Article 8 GDPR; the relevant age threshold is 16, or a lower age between 13 and 16 set by the applicable EU Member State.
16.2 We do not knowingly collect Personal Data from children.
16.3 If BCI becomes aware that it has collected Personal Data from a child without appropriate parental or guardian consent, including consent required under Article 8 GDPR where applicable, BCI shall take steps to delete such data promptly.
 

    17. Changes to this Privacy Policy

17.1 The Owner reserves the right to make changes to this privacy policy at any time by notifying its Users on this page and possibly within this Website and/or - as far as technically and legally feasible - sending a notice to Users via any contact information available to the Owner. It is strongly recommended to check this page often, referring to the date of the last modification listed at the bottom.
17.2 Should the changes affect processing activities performed on the basis of the User’s consent, the Owner shall collect new consent from the User, where required.
17.3 Material changes to this Policy shall be communicated to Users at least thirty (30) days prior to taking effect. Continued use of the Website or Services after the effective date of any changes shall constitute the User’s acceptance of such changes.

   18. Language

This Privacy Policy may be made available in multiple languages. In the event of any inconsistency between language versions, the English version shall prevail.

 

   19. Governing Law and Jurisdiction

This Privacy Policy shall be governed by and construed in accordance with the laws of the United Arab Emirates, including the UAE PDPL. Any dispute arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the competent courts of the Emirate of Dubai, United Arab Emirates. BCI reserves the right to bring proceedings in any other court of competent jurisdiction at its sole discretion. Nothing in this paragraph deprives EU Data Subjects of any mandatory protections available to them under the GDPR, including the right, where provided by the GDPR, to lodge a complaint with a supervisory authority in their habitual residence, place of work, or the place of the alleged infringement, or to bring proceedings before a competent court in accordance with the GDPR.

   20. Limitation of Claims

Any claim or cause of action arising out of or related to the processing of Personal Data under this Policy must be filed within one (1) year from the date on which the Data Subject became aware, or ought reasonably to have become aware, of the facts giving rise to the claim, failing which such claim shall be time-barred to the fullest extent permitted by applicable law.

 

   21. Severability

If any provision of this Policy is found to be invalid, illegal, or unenforceable by a court or regulatory authority of competent jurisdiction, such invalidity, illegality, or unenforceability shall not affect the remaining provisions of this Policy, which shall continue in full force and effect.

   22. Entire Agreement

This Policy, together with the Terms and Conditions and the Cookie Policy, constitutes the entire agreement between BCI and the User with respect to the processing of Personal Data in connection with the Website and Services, and supersedes all prior or contemporaneous communications and proposals, whether oral or written, relating to the subject matter hereof.