Privacy Notice

1. About this notice

Silah L.L.C-FZ ("we", "us", "our") operates MySilah.ae, a UAE-based digital financial marketplace and lead-management platform that connects customers with banks and licensed financial institutions in the United Arab Emirates. We act as an aggregator for both Conventional and Islamic (Sharia-compliant) financial products, including credit cards, personal loans, car loans, home loans and mortgages, bank accounts, and business-banking products.

We do not provide credit and we do not make lending decisions. Licensed banks and financial institutions independently review, underwrite and decide on applications in accordance with their own policies and regulatory obligations. We facilitate the introduction, generate and qualify leads, and help you compare and apply for products.

This Privacy Notice explains how we collect, use, share, and protect your personal data when you interact with us, whether you visit our website, use our mobile platform, request a product recommendation, complete identity verification, authorise a credit check, register as a Referral Partner (agent), or otherwise use our services (together, the "Platform"). It is issued in accordance with Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data (the "UAE PDPL") and its implementing regulations, and reflects our obligations under applicable UAE laws and Central Bank of the UAE regulations relevant to our activities.

If anything in this notice is unclear, please contact our Data Protection Officer using the details below.

2. Who we are and how to contact us

For the purposes of the UAE PDPL, Silah L.L.C-FZ is the data controller for the personal data described in this notice.

3. Scope of this notice

This notice covers personal data we process in operating the MySilah.ae marketplace (including generating personalised product recommendations, verifying your identity, assessing your eligibility for financial products, qualifying and distributing leads, and facilitating applications), and across all of our customer channels, including our website (https://mysilah.ae), our mobile platform, and our customer-support channels. It applies to both Conventional and Islamic (Sharia-compliant) products available on the Platform.

This notice applies to personal data we process about:

• Customers and prospective customers: individuals who use the Platform, request a recommendation or quote, submit an enquiry, complete identity verification, or apply for a financial product through us;
• Authorised representatives: persons authorised to act or enquire on behalf of a customer;
• Website and platform users: visitors to mysilah.ae and users of our mobile platform;
• Referral Partners: agents, sub-agents and super agents who register on the Platform to introduce prospective customers and submit leads.

We act as the data controller for the personal data we process in operating the Platform, onboarding customers and Referral Partners, generating and qualifying leads, and assessing eligibility. Once we share your details with a bank or financial institution at your request, that institution acts as an independent data controller for its own evaluation, underwriting, approval and servicing activities, under its own privacy notice.

This notice does not apply to:

• Banks, financial institutions, credit bureaus, identity-verification providers and other third parties who act as separate controllers for their own purposes (please refer to their own privacy notices);
• Third-party websites or applications linked from our services.

4. The personal data we collect

The personal data we collect depends on the products and services you use and your relationship with us. The categories below describe the data we may process. Not all categories apply to every customer.

4.1 Identification and contact data

• Full name (as per Emirates ID or passport)
• Date of birth
• Nationality
• Residency status
• Emirates ID number
• Mobile number
• Email address

4.2 Identity-verification data (UAE PASS)

We integrate with UAE PASS (the UAE's national digital identity) and other approved verification services for secure customer verification. The information we receive through these services may include:

• Verified name
• Emirates ID information
• Mobile number
• Email address
• Nationality
• Date of birth

UAE PASS credentials and passwords are never stored by MySilah.ae.

4.3 Employment and financial profile

• Employer name
• Employment status
• Monthly income / salary information
• Banking preferences
• Financial-product requirements and preferences

4.4 Credit information

With your explicit authorisation, we may obtain, process and share your credit information from the Al Etihad Credit Bureau (AECB) and other lawful sources, solely for eligibility assessment and lead-qualification purposes. We do not make lending decisions; banks and financial institutions independently review and process applications in accordance with their internal policies and regulatory obligations.

4.5 Lead, enquiry and application data

• Product enquiries, recommendation requests and stated requirements
• Eligibility-assessment inputs and outcomes, and lead-qualification results
• Records of leads generated and the institutions to which your enquiry is referred
• Application-facilitation records and status updates

4.6 Digital and online interaction data

When you visit our website or use our mobile platform we automatically collect:

• IP address, approximate location derived from your IP address, and time-zone settings
• Device information (device type, model, operating system, screen size)
• Browser type and version, and language settings
• Pages viewed, links clicked, sessions, time spent and other usage analytics
• Referral URLs (the page that brought you to our services)
• Server logs (request times, HTTP status codes, error events)
• Cookies and similar technologies

4.7 Communications and recordings

• Records of calls to our customer-support team (calls may be recorded for quality, training, compliance and dispute-handling purposes)
• Emails, SMS, in-app messages, web-chat transcripts and other written correspondence
• Feedback, complaints, survey responses and reviews you submit to us

4.8 Internal operational data

We also generate and hold operational records related to your relationship with us, including:

• Customer reference numbers, lead identifiers and case identifiers
• Lead-source and onboarding-journey information
• Internal risk assessments, approval workflows and exception logs
• Audit logs and activity history across our internal systems

4.9 Referral Partner data

If you register as a Referral Partner (agent, sub-agent or super agent), we also collect and process:

• Registration and profile data: name, email address, mobile number (which we verify with a one-time password sent by WhatsApp), Emirates ID number, nationality, city and company name, and, for agencies and super agents, trade licence details where provided;
• Identity-verification data received through UAE PASS, as described in section 4.2;
• Payout and bank details: account holder name, bank name, account number, IBAN and SWIFT/BIC code, together with the cheque copy and bank letter you upload, your confirmation that the details are correct, and a record of who verified or rejected these documents and when;
• Referral and earnings records: the leads you submit, their status, and the rewards, commissions, holds and payouts relating to them;
• Your Super Agent code, or the Super Agent you are attached to, and the sub-agents attached to you;
• Customer details that you submit about prospective customers (such as name, mobile number, email address and requirements). You are responsible for having the customer's informed consent before submitting their details, and we use that information only as described in this notice;
• Support tickets, messages and attachments you send to us, and your login and activity history on the Platform.

5. Sensitive personal data

Under the UAE PDPL, certain categories of data are treated as "sensitive personal data", including data revealing a person's health, biometric characteristics, ethnic or racial origin, political opinions, religious beliefs, or criminal record.

In the ordinary course of operating the Platform we do not seek to collect sensitive personal data. Identity verification through UAE PASS and approved providers is performed on those providers' own systems, and any biometric processing involved takes place there; we receive only verified identity attributes (such as your name and Emirates ID information) and a confirmation that verification succeeded. We do not receive or store biometric templates.

We may process criminal-record, regulatory or sanctions-related information only where it forms part of screening required of us or our partners by law, or where it arises in connection with the investigation of suspected fraud or misuse of the Platform. Where any sensitive personal data is processed, it is subject to additional access controls within our systems and is shared only with parties that have a clear need to receive it.

6. Sources of the personal data we hold

We obtain personal data from the following sources:

• Directly from you: when you use the Platform, complete a form, verify your identity, authorise a credit check, contact our support team, or apply for a product;
• From your representative: for example, a person you have authorised to act or enquire on your behalf;
• From Referral Partners: where a Referral Partner submits your details as a prospective customer;
• From UAE PASS and our identity-verification providers: verified identity attributes and verification outcomes;
• From the Al Etihad Credit Bureau (AECB) and other lawful credit-information sources: where you have authorised us to obtain your credit score information;
• From service providers acting on our behalf: IT, hosting, communications, analytics and similar providers;
• From public and regulatory sources: UAE government databases (where we are authorised to query them) and similar bodies;
• From our affiliates: to the extent permitted by your consents and applicable law.

7. Why we use your personal data and our legal basis

We process your personal data only where we have a lawful basis to do so under the UAE PDPL. The table below summarises our main purposes and the corresponding legal basis.

Where we rely on your consent (in particular for obtaining your credit score information, sharing your data with banks and financial institutions, and sending you marketing), you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal. Some services depend on certain consents and may not be available if you withdraw them.

8. Automated decision-making and profiling

Some of our onboarding, eligibility-assessment and fraud-prevention processes use automated tools that analyse the data you provide and the data we generate (for example, your profile data and, where authorised, your credit information) to produce eligibility indications, product matches and lead-qualification outcomes.

We do not make lending decisions. The final decision to approve, decline or price any financial product rests with the bank or financial institution, under its own processes. Under the UAE PDPL, you have the right to object to decisions made solely on the basis of automated processing where those decisions produce legal effects or similarly significantly affect you. If you would like a human to review any automated outcome on our side, please contact us.

9. Who we share your personal data with

We share your personal data with the categories of recipient listed below, where it is necessary for the purposes described in this notice and subject to appropriate safeguards.

9.1 Banks and licensed financial institutions

With your consent, we share the personal data necessary to qualify and refer your enquiry (and to enable you to apply for a product) with the banks and licensed financial institutions whose products you select or for which you are matched. Once your details are shared, each institution acts as an independent data controller and processes your data for evaluation, underwriting, approval and servicing under its own privacy notice. We do not control how participating institutions process your personal data once shared, and we recommend that you review their respective privacy policies.

9.2 Al Etihad Credit Bureau (AECB)

Where you have authorised a credit check, we share the identifying information necessary to obtain your credit information from the AECB, and we receive and process the resulting credit data for eligibility assessment and lead qualification.

9.3 UAE PASS and identity-verification providers

We share the identifying information necessary to verify your identity with UAE PASS and our approved identity-verification providers, who carry out these checks under contractual data-protection terms.

9.4 Service providers acting on our behalf (processors)

We engage third parties to provide IT, cloud-hosting, communications, customer-service, document-storage, marketing-technology and analytics services. These providers act on our instructions under contractual data-protection terms and are not permitted to use your data for their own purposes.

9.5 Affiliates

We share limited personal data with our affiliates to enable linked services, single sign-on, customer-relationship management, internal audit and risk management. Each affiliate processes data under its own privacy notice and under intra-group data-protection arrangements.

9.6 Regulators, authorities and law-enforcement

We disclose personal data where required by law or in response to a lawful request, including to:

• The Central Bank of the UAE (CBUAE), where applicable
• The UAE Data Office and other UAE federal and local data-protection authorities
• The Meydan Free Zone Authority and other relevant licensing authorities
• Courts, public prosecutors, police and other law-enforcement bodies

9.7 Professional advisers

We share personal data, where necessary, with our auditors, lawyers, accountants and other professional advisers, who are bound by duties of confidentiality.

9.8 In the context of a corporate transaction

If we sell, restructure, merge, demerge, or transfer all or part of our business, we may share personal data with the counterparty and its advisers, subject to appropriate confidentiality and data-protection safeguards.

9.9 Super Agents (Referral Partners)

If you are a sub-agent, the Super Agent you are attached to can see your name, email address, mobile number and the leads you submit, together with the status of those leads and the commission the Super Agent earns on them. A Super Agent cannot see the customer's mobile number or email address on those leads, or your own commission. If a Super Agent's account is deactivated, its sub-agents are detached from it.

We do not sell your personal data.

10. International transfers

Some of the recipients listed above may be located outside the UAE, such as global cloud providers and certain service providers.

Under the UAE PDPL, we transfer personal data outside the UAE only where one of the following applies:

• The destination country has been recognised by the UAE Data Office as providing an adequate level of protection;
• The transfer is covered by an appropriate contractual mechanism (such as standard contractual clauses or binding corporate rules) that imposes equivalent data-protection obligations on the recipient;
• The transfer is necessary for the performance of a contract with you or for the conclusion or performance of a contract in your interest;
• The transfer is necessary to comply with a legal obligation, to defend legal claims, to protect the vital interests of a data subject, or for another lawful purpose recognised under the PDPL;
• You have given your explicit consent to the transfer, having been informed of the risks involved.

You can request information about the safeguards in place for a specific transfer by contacting our DPO.

11. Payment-card data

We do not collect, process or store payment-card data. Applications for, and any payments relating to, financial products are completed directly between you and the bank or financial institution you choose, under that institution's own arrangements and security controls.

12. How long we keep your personal data

We keep personal data only for as long as we need it for the purposes set out in this notice, or for as long as we are required to keep it by law.

The period for which we retain any particular category of personal data is determined by reference to:

• the nature and purpose of the processing, and whether an ongoing relationship or service is in place;
• our legal and regulatory obligations, including applicable anti-money-laundering, Central Bank, tax and accounting record-keeping requirements;
• the statutory limitation periods applicable to potential legal claims under UAE law;
• the need to handle complaints, disputes and regulatory investigations; and
• legitimate business needs, such as fraud prevention and information security.

Our internal Records Retention Schedule sets out the specific periods that apply to each category of data, and you may request a summary by contacting our Data Protection Officer. After the applicable retention period, we securely delete the data or anonymise it so that it can no longer be associated with you. We may retain anonymised or aggregated data indefinitely for analytical and statistical purposes. Payout, bank-verification and reward records of Referral Partners are kept for the periods required by applicable accounting, tax and anti-money-laundering rules.

13. Cookies and similar technologies

Our website and mobile platform use cookies and similar technologies for the following purposes:

• Strictly necessary: to enable core functionality, security, session management and fraud prevention (cannot be disabled);
• Functional: to remember your preferences and settings;
• Analytics: to understand how our services are used and to improve them;
• Marketing: to deliver and measure the effectiveness of advertising.

You can manage non-essential cookies through the cookie banner on our website and through your browser settings. Disabling cookies may affect some functionality.

14. Minors

Our services are intended exclusively for adults aged 18 or over. We do not knowingly market to or collect personal data from minors, and we do not facilitate applications for minors. If you believe a minor has provided personal data to us directly, please contact our DPO so we can delete it.

15. Security of your personal data

We apply technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. These measures include encryption in transit and at rest for sensitive data, access controls based on the principle of least privilege, network segmentation, logging and monitoring, security operations centre (SOC) monitoring, regular vulnerability and penetration testing, employee training, vendor due diligence, and incident-response procedures.

No system can be guaranteed to be entirely secure. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the UAE Data Office and affected individuals in accordance with our legal obligations.

You can help us protect your data by using a strong, unique password for your account, not sharing your credentials or one-time passwords, and promptly reporting any suspicious activity to us.

16. Your rights under the UAE PDPL

Subject to the conditions and limits set out in the UAE PDPL, you have the following rights in relation to your personal data:

• Right to information: to be informed about how we process your personal data (this notice is the principal way in which we provide that information);
• Right of access: to request a copy of the personal data we hold about you and certain information about how we process it;
• Right to rectification: to ask us to correct personal data that is inaccurate or incomplete;
• Right to erasure: to ask us to delete personal data, where we no longer have a lawful basis to keep it (this right is subject to our legal and regulatory retention obligations, which mean we may not always be able to delete data on request);
• Right to restriction of processing: to ask us to limit how we use your personal data in specified circumstances;
• Right to data portability: to receive certain personal data you have provided to us in a structured, commonly used, machine-readable format, or to have it transmitted to another controller, where technically feasible;
• Right to stop processing: to object to processing carried out for our legitimate interests or for direct marketing, and to withdraw consent at any time where we rely on consent (without affecting the lawfulness of prior processing);
• Rights in relation to automated decision-making and profiling: see Section 8;
• Right to contact the DPO: to raise any concern about how we process your personal data;
• Right to lodge a complaint with the UAE Data Office.

To exercise any of these rights, contact our Data Protection Officer using the details below. We may need to verify your identity before responding. We will respond within the period required by the UAE PDPL and its implementing regulations. There is normally no charge, but we may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, as permitted by law.

17. Contacting the Data Protection Officer and lodging a complaint

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing our compliance with the UAE PDPL and addressing data-protection enquiries and complaints.

Data Protection Officer email: support@mysilah.ae

Postal address: Data Protection Officer, Silah L.L.C-FZ, Meydan FreeZone, Dubai, UAE

If you are not satisfied with how we have handled your personal data or your request, you have the right to lodge a complaint with the federal data-protection regulator.

We would, however, appreciate the opportunity to address your concerns directly before you escalate to the regulator.

18. Changes to this notice

We may update this notice from time to time, for example to reflect changes in our services, in the law, or in regulatory guidance. When we make material changes, we will post the updated notice on our website, update the "Last updated" date at the top, and, where appropriate, notify you directly. Please review this notice periodically.

19. Governing law

This Privacy Notice and any matter arising from or in connection with it is governed by the laws of the United Arab Emirates, including the UAE PDPL and its implementing regulations.

MySilah.ae is a trading name of Silah L.L.C-FZ.