PRIVACY NOTICE

Last Updated: August 2026

Name: AOP Capital Ltd.

Contact: + 971 4 452 0683 | [email protected]

Address: Office C-1002A Burj Daman, DIFC PO Box: 507042 Dubai, UAE

Web: AOP Capital Ltd

1. INTRODUCTION

AOP Capital Ltd (“AOP”, “we”, “us” or “our”) respects your privacy and is committed to protecting your Personal Data.

AOP is a financial services company established in the Dubai International Financial Centre (“DIFC”) and authorised and regulated by the Dubai Financial Services Authority (“DFSA”).

For the purposes of the DIFC Data Protection Law No. 5 of 2020, as amended (the “Data Protection Law”), AOP acts as a Controller in respect of Personal Data for which it determines the purposes and means of Processing.

This Privacy Notice explains how AOP collects and Processes your Personal Data, the purposes and lawful bases for such Processing, how your Personal Data may be shared or transferred, how long it may be retained, and your rights under the Data Protection Law.

2. PERSONAL DATA WE COLLECT

The Personal Data we collect and Process will depend on the nature of our relationship with you and the products or services being provided or arranged.

We may Collect and Process the following categories of Personal Data:

• Identity and identification data –including your name, date and place of birth, nationality, gender, residential address, photograph, signature, passport or other identification document details, residency and visa information.
• Contact data –including your residential or correspondence address, email address and telephone number.
• Financial and economic data –including bank account details, income, assets, liabilities, investment portfolio information, financial history, source of wealth, source of funds and tax residency information.
• Transaction and service data –including information concerning products and services provided or arranged by AOP, transactions, payments, beneficiaries and account information.
• Professional and employment data –including your occupation, employer, employment history, professional experience, education and remuneration, where relevant.
• Client profile and suitability data –including your investment objectives, financial circumstances, risk tolerance, capacity for loss, investment knowledge and experience and preferences, where applicable.
• Compliance and due diligence data –including information obtained for identification and verification, sanctions and politically exposed person (“PEP”) screening, adverse media screening, anti-money laundering and counter-terrorist financing (“AML/CFT”) and other legal or regulatory compliance purposes.
• Communications and correspondence data –including information provided through forms, emails, telephone or video calls, meetings and other communications with AOP.
• Technical and usage data –including information relating to your use of AOP’s website and electronic systems, where applicable.
• Marketing and communications data –including your preferences regarding communications, invitations, updates or marketing materials from AOP, where applicable.

Where you are associated with a corporate client, counterparty or service provider, we may also Process Personal Data relating to you in your capacity as a director, shareholder, beneficial owner, authorised signatory, representative, employee or other associated individual.

3. HOW WE OBTAIN YOUR PERSONAL DATA

We may obtain Personal Data directly from you, including through:

• client onboarding and application documentation;
• meetings, telephone calls, video calls, emails and other correspondence;
• the provision of products or services;
• forms or information submitted through our website or other communication channels; and
• other interactions with AOP.

We may also obtain Personal Data from third parties and publicly available sources, including:

• corporate clients, employers, representatives and authorised persons;
• financial institutions and counterparties;
• identity verification, e-KYC, screening and due diligence service providers;
• sanctions, PEP, adverse media and other compliance databases;
• public registers, government authorities and regulatory bodies;
• professional advisers and other service providers; and
• other lawful and appropriate sources.

4. HOW AND WHY WE USE YOUR PERSONAL DATA

AOP will only Process your Personal Data where there is an appropriate lawful basis under the Data Protection Law.

Depending on the circumstances, we may Process your Personal Data where:

• it is necessary for the performance of a contract with you or to take steps at your request before entering into a contract;
• it is necessary for AOP to comply with applicable legal or regulatory obligations;
• it is necessary for the legitimate interests pursued by AOP or a third party, provided those interests are not overridden by your interests or rights;
• you have provided your consent, where consent is the appropriate lawful basis; or
• the Processing is otherwise required or permitted under applicable law.

We may Process your Personal Data for purposes including:

• establishing, administering and managing our relationship with you;
• providing or arranging financial services;
• conducting client onboarding, identification and verification;
• assessing client classification, suitability and appropriateness, where applicable;
• conducting AML/CFT, sanctions, PEP, adverse media and other financial crime prevention checks;
• complying with applicable legal, regulatory, reporting and record-keeping obligations, including requirements imposed by the DFSA and other competent authorities;
• communicating with you regarding our services and our relationship with you;
• managing relationships with financial institutions, counterparties, service providers and professional advisers;
• maintaining our business operations, systems, records and internal controls;
• managing complaints, disputes, legal claims and regulatory enquiries;
• protecting the security and integrity of our systems, information and business operations; and
• conducting business development and providing information about our services, where permitted by applicable law.

Where we rely on legitimate interests, these may include operating and managing our business, providing and improving our services, protecting AOP and its clients, maintaining appropriate business and security controls, and communicating with clients and business contacts.

Where we rely on consent, you may withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of Processing carried out before your consent was withdrawn.

5. SPECIAL CATEGORIES OF PERSONAL DATA

AOP may Process certain Special Categories of Personal Data where necessary in connection with client identification, verification, due diligence or other applicable legal and regulatory requirements. This may include Personal Data processed through identity verification and e-KYC procedures, where applicable.

AOP will only Process Special Categories of Personal Data where such Processing is permitted under the Data Protection Law and will apply appropriate safeguards having regard to the nature and sensitivity of the Personal Data concerned.

6. SHARING YOUR PERSONAL DATA

We may share or provide access to your Personal Data where necessary for the provision of our services, the operation of our business, compliance with legal or regulatory obligations, or another lawful purpose.

Recipients may include:

• financial institutions, custodians and other counterparties involved in providing or arranging services;
• identity verification and e-KYC service providers used to support client identification, verification and due diligence;
• screening and other compliance service providers;
• information technology, cloud hosting, communications and other operational service providers;
• auditors, lawyers, consultants and other professional advisers;
• the DFSA, the DIFC Commissioner of Data Protection and other regulatory, governmental, judicial, law enforcement or competent authorities where disclosure is required or permitted; and
• other third parties where disclosure is necessary and lawful.

Where a third-party Processes Personal Data on our behalf, we require appropriate data protection and confidentiality arrangements in accordance with applicable requirements.

AOP does not sell your Personal Data.

7. INTERNATIONAL TRANSFERS

Your Personal Data may, where necessary, be transferred to, stored in or accessed from jurisdictions outside the DIFC.

Where Personal Data is transferred outside the DIFC, AOP will ensure that the transfer is undertaken in accordance with the Data Protection Law.

This may include transfers to jurisdictions recognised by the DIFC Commissioner of Data Protection as providing an adequate level of protection or, where the recipient is located in a jurisdiction that has not been recognised as adequate, the use of appropriate safeguards, transfer mechanisms, derogations or another lawful basis permitted under the Data Protection Law.

You may contact us using the details set out below if you would like further information regarding the safeguards applicable to international transfers of your Personal Data.

8. DATA RETENTION

AOP retains your Personal Data only for as long as necessary for the purposes for which it was Collected and Processed and to satisfy applicable legal, regulatory, accounting, reporting and record-keeping requirements.

The applicable retention period will depend on factors including:

• the nature and purpose of the Personal Data and Processing;
• the duration of our relationship with you;
• applicable legal and regulatory retention requirements, including relevant DFSA requirements;
• the need to establish, exercise or defend legal claims; and
• other legitimate regulatory or business requirements.

Where Personal Data is no longer required and there is no legal, regulatory or legitimate reason requiring its continued retention, it will be securely deleted, destroyed or anonymised, as appropriate.

9. SECURITY OF YOUR PERSONAL DATA

AOP maintains appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access and other forms of unlawful Processing.

Access to Personal Data is restricted to employees, service providers and other persons who require access for legitimate business purposes and who are subject to appropriate confidentiality and data protection obligations.

In the event of a Personal Data Breach, AOP will take appropriate steps to assess, contain and remediate the incident and will notify the DIFC Commissioner of Data Protection, affected Data Subjects and/or other competent authorities where required under applicable law or regulation.

10. YOUR RIGHTS

Subject to the conditions, limitations and exemptions under the Data Protection Law, you may have the right to:

• request access to your Personal Data and information regarding how it is Processed;
• request correction of inaccurate or incomplete Personal Data;
• request erasure of your Personal Data in certain circumstances;
• request restriction of the Processing of your Personal Data;
• object to the Processing of your Personal Data in certain circumstances;
• receive certain Personal Data in a structured, commonly used and machine-readable format and request its transfer to another Controller, where applicable;
• withdraw your consent at any time where Processing is based on consent;
• exercise applicable rights in relation to automated decision-making and Profiling, where relevant; and
• lodge a complaint with the DIFC Commissioner of Data Protection.

These rights are not absolute and may be subject to legal and regulatory requirements that require or permit AOP to continue Processing or retaining certain Personal Data.

If you wish to exercise any of your rights, please contact us using the details set out below. We may request information necessary to verify your identity before acting on your request.

11. MARKETING COMMUNICATIONS

Where permitted by applicable law, AOP may use your contact details to provide you with information regarding our services, updates, events or other communications that may be relevant to you.

Where consent is required for such communications, we will obtain the necessary consent.

You may ask us to stop sending marketing communications at any time by contacting us or using any unsubscribe mechanism provided in the relevant communication.

Opting out of marketing communications will not affect service-related, legal, regulatory or other communications that AOP is required or entitled to send in connection with its relationship with you..

12. CHANGES TO THIS PRIVACY NOTICE

AOP may update this Privacy Notice from time to time to reflect changes in our Processing activities, business operations or applicable legal and regulatory requirements.

Where changes are material, AOP will take appropriate steps to bring the updated Privacy Notice to the attention of affected Data Subjects where appropriate or required.

The current version of the Privacy Notice will be available from AOP upon request and, where applicable, through AOP’s website or other appropriate communication channels.

13. CONTACT US

If you have any questions about this Privacy Notice or how AOP Processes your Personal Data, or if you wish to exercise any of your rights under the Data Protection Law, please contact us:

AOP Capital Ltd
Office No. C-1002A, Burj Daman
Dubai International Financial Centre (DIFC)
PO Box 507042
Dubai, United Arab Emirates
Email: [email protected]

If you have concerns regarding the way in which AOP has Processed your Personal Data, you may contact AOP using the details above.