Last updated: 21 July 2025
Understanding Our Privacy Policy
1. Definitions
| Term | Meaning |
|---|---|
| "Personal Data" | Any information relating to an identified or identifiable natural person. |
| "Processing" | Any operation performed on Personal Data. |
| "Controller" | The natural or legal person that determines the purposes and means of Processing. |
2. Who is the Controller?
MST UK Holdings Ltd (company no. 15917084, UK) and MST-Holdings LLC-FZ (Dubai, UAE) act as joint Controllers for all Processing described in this notice. Both entities' contact: info@mst-hldgs.com. (The footer of our website displays these entities.)
3. How we collect Personal Data
- Directly from you – web forms, e-mails, calls, meetings
- Automatically – cookies, server logs, device identifiers
- From third parties – KYC vendors, credit-reference agencies, public registers
4. Categories of Personal Data
| Category | Examples | Source |
|---|---|---|
| Identification | Name, passport / Emirates ID, nationality | You, KYC |
| Contact | Business e-mail, phone number, postal address | You |
| Professional | Job title, employer, regulatory status | You, public registers |
| Transactional | Mandate letters, funding terms, payment instructions | You, counterparties |
| Technical | IP address, browser type, time-zone, click-stream | Cookies, logs |
5. Purposes & Legal Bases
| Purpose | UK legal basis (Art 6 UK GDPR) | UAE legal basis (PDPL) |
|---|---|---|
| Responding to enquiries, onboarding clients | Contract (b) | Consent or contractual necessity (Art 4 PDPL) |
| Performing KYC / AML screening | Legal obligation (c) | Compliance with UAE AML rules (Art 4 PDPL) |
| Sending market insights & event invites | Consent (a) or Legitimate interests (f) | Consent |
| Internal analytics & website security | Legitimate interests (f) | Legitimate interests |
6. Marketing choices
You may opt out at any time via the "unsubscribe" link or by e-mailing info@mst-hldgs.com.
7. Cookies & similar technologies
Our site currently uses strictly-necessary and analytics cookies only.
| Cookie | Provider | Type | Purpose | Expiry |
|---|---|---|---|---|
| _ga / _gid | Google Analytics | Analytics | Visitor statistics | 2 yrs / 24h |
| elementor | WordPress/Elementor | Functional | Page caching | Persistent |
| wordpress_logged_in_ | WordPress | Necessary | Keeps users logged in to admin area | Session |
| cookie_notice_accepted | MST Holdings | Necessary | Stores cookie-consent choice | 6 months |
Cookie consent is requested on your first visit; non-essential cookies load only after you accept them.
8. Disclosures
We share Personal Data only when necessary:
- Intra-group transfers between UK and Dubai offices
- Banks, custodians and regulated partners named on our website
- Professional advisers (lawyers, auditors) under duty of confidentiality
- Regulators, courts or law-enforcement when legally required
9. International transfers
- UK ↔ Dubai: rely on the UK International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses plus supplementary measures.
- Dubai ↔ UK: rely on PDPL-compliant contractual clauses or, if operating in the DIFC, DP Law 2020 adequate-jurisdiction list.
10. Security measures
- Encryption in transit (TLS 1.3) and at rest (AES-256)
- Tier-III data-centre hosting with ISO 27001 certification
- Role-based access with multi-factor authentication for privileged accounts
- 24/7 intrusion detection and quarterly penetration testing
11. Data retention schedule
| Record type | Retention period |
|---|---|
| KYC / AML files | 6 years after relationship ends (UK Money-Laundering Regs) / 5 years (UAE Cabinet Decision 10 of 2019) |
| Contractual documents | 7 years post-termination |
| Marketing lists | Until opt-out or 2 years of inactivity |
| Website logs | 12 months |
12. Your rights
| Right | UK residents (UK GDPR) | UAE residents (PDPL) |
|---|---|---|
| Access | ✔ | ✔ |
| Rectification | ✔ | ✔ |
| Erasure ("Right to be forgotten") | ✔ | ✔ |
| Restrict processing | ✔ | ✔ |
| Object to processing | ✔ | ✔ unless overriding interest |
| Data portability | ✔ | ✔ |
| Withdraw consent | ✔ | ✔ |
| Complaint to regulator | ICO | UAE Data Office |
If operating from the DIFC, you also enjoy the rights set out in DP Law 2020.
13. How to exercise your rights
E-mail info@mst-hldgs.com (preferred) or write to the addresses in Section 2. We respond within 30 days (UK) or one calendar month (UAE). Complex requests may be extended by up to two further months; we will notify you of any extension.
14. Automated decision-making & profiling
We do not conduct automated decisions that produce legal or similarly significant effects.
15. Children
Our services target corporate and professional clients. We do not knowingly collect data from persons under 18 and will delete such data if discovered.
16. Complaints
- UK: Contact the Information Commissioner's Office (ICO) via ico.org.uk or +44 303 123 1113.
- UAE (mainland): Contact the UAE Data Office via u.ae.
- DIFC: Contact the DIFC Commissioner of Data Protection via difc.ae.
17. Changes to this policy
We review this notice annually or when regulatory changes occur. Material changes will be posted on this page and, where appropriate, sent by e-mail.