DIFC Courts

ONLINE PRIVACY NOTICE

This Privacy Notice is effective as of 19th June 2025

Introduction

The Dubai International Financial Centre Courts and/or its affiliates (collectively “we”, “us”, “our”, “DIFCC” or “DIFC Courts”) is a platform for delivering legal excellence in the Middle East. We provide a suite of services, including but not limited to, dispute resolution services, wills services (including drafting and digital assets wills services), practitioner registration services, Pro Bono services, and the Tejorui digital vault service (together the “Services”) which are available to corporate entities and individuals in the Dubai International Financial Centre (“DIFC”) and beyond.

The DIFC Courts collects, uses, and shares personal data of its Service users and others which is important for its operational services and to permit it to carry out various ancillary activities. In doing so, the DIFC Courts is subject to the Dubai International Financial Centre (DIFC) Data Protection Law No. 5 of 2020 as amended, superseded or replaced (“DIFC DP Law”).

The DIFC Courts is committed to safeguarding the privacy of the personal data of Services users that it collects, uses, and shares in accordance with the DIFC DP Law. We take our legal, professional, and ethical duties and obligations to protect personal data seriously. We have a robust information security management programme in place. Further, we have achieved ISO27001 certification for our technical and organisational security controls across a broad spectrum of systems and processes. These measures are monitored, reviewed, and regularly enhanced to meet our professional responsibilities and the needs of our Services users.

1. Scope and application

By virtue of the transparency requirements of the DIFC DP Law, this Privacy Notice is formulated to describe how and why the DIFC Courts processes the personal data of Service users i.e., any individuals located anywhere in the world who access or use DIFC Courts Services, our apps, or who provide their personal data to us for other reasons (“Data Subjects”, “you” or “your” ”Services users”). You acknowledge and agree that if you fail to provide us with the requested personal data, we may not be able to provide you with our Services or otherwise fulfil your requests. The Data Controller in relation to your personal data is: DIFC Courts, Level 3, Precinct Building 5 (South), The Gate District, Dubai International Financial Centre (DIFC), Dubai, United Arab Emirates.

2. Collection of information

Information you give us

This Privacy Notice applies to personal data you provide us when making use of our Services. You may do this by filling in forms or registering on our website or app, or by corresponding with us by telephone, post, email or any other digital or electronic form. For example, it includes information you provide when you:

  • (a) contact us to submit DIFC Courts claims;
  • (b) register a will;
  • (c) claim inheritance as a beneficiary of a will;
  • (d) access and use the digital assets will service;
  • (e) register as a practitioner or wills draftsman or access and use the will draftsman service;
  • (f) request for a Pro Bono service;
  • (g) access and use the Tejouri digital vault service;
  • (h) register for newsletters or other subscription services;
  • (i) download and register to use any of our apps;
  • (j) share data via any of our apps’ social media functions;
  • (k) report a problem with our apps, or any of our Services.

If you contact us, we will, as a minimum, keep an electronic record of such correspondence, including personal data shared at that time, in order to reply or process it as per your request. The personal data you give us may include your name, gender, home address, email address and phone number, certain device information, username, password, occupation, employer address, Emirates ID, passport details, nationality, photograph, and other information you choose to provide.

To the extent you provide us with the personal data of any individual other than yourself; for example, any executor, witness or beneficiary details during wills registration, you hereby confirm that you have a lawful basis (e.g. the consent of the relevant individual(s)) to enable our processing of their personal data. We process all such personal data on the understanding that consent has been obtained from individuals whose personal data is provided to us when you use our Services or apps and you hereby confirm that all such consents, in accordance with the DIFC DP Law, have been secured. You agree to provide us with evidence of securing such consents promptly upon our request.

Information we collect about you and your device

Each time you use our Services or apps, in addition to any information you provide us as part of our Services (e.g., information about your will or legal dispute) we may and often will, automatically collect the following information:

  • (a) technical information, including the type of mobile device you use, a unique device identifier (for example, mobile network information, your mobile operating system, the type of mobile browser you use, device token, device type, time zone setting) (“Device Information”);
  • (b) details of your use of our Services or apps including, but not limited to, traffic data, weblogs and other communication data, and the resources that you access (“Log Information”);
  • (c) location information if the Services or apps use GPS technology to determine your current location. If you wish to use the feature, you may be asked to opt-in to your data being used for this purpose.

If you do not intend to share certain personal data with us or do not intend for the DIFC Courts to use or share it for certain purposes (to the extent possible and in accordance with applicable laws and information in this notice), you may change your preferences at any time.  Where applicable, please check with your device provider's instructions for further information about how to do this.

Other information we may collect through your use of the Services or apps

When you use any Services or apps, we may collect personal data including demographic information; for example, information that you submit, or that we collect, which may include, but is not limited to, date of birth, current residence, username, time zone setting, IP address, SMS data, transaction information, business activities and services/ distribution locations, browsing history information, searching history information, and registration history information (“Demographic Information”).

3. Use of personal data

We may use personal data provided to us by you or collected about you to:

  • (a) provide, maintain, and improve our apps and Services, including, for example, to facilitate payments, send receipts, provide products and services you request (and send related information about them), develop new features that will enhance your user experience and our efficiency, provide customer support to users, authenticate users, and send administrative messages, whether information-only or as required by applicable law;
  • (b) perform internal regulatory, administrative, and operational requirements, including, for example, to prevent fraud or abuse of our Services; to troubleshoot software bugs and operational problems; to conduct permitted data analysis, testing, and research; to ensure you and DIFC Courts are complying with internal or external legal requirements, including those that necessitate use of digital systems; and to monitor usage and activity trends;
  • (c) send you communications we think will be of interest to you based on your previous interactions with us, including information about our Services, promotions, news, and DIFC Courts events, where permissible under the DIFC DP Law, and according to any other applicable laws;
  • (d) notify you about changes to this Privacy Notice, or our apps and Services;
  • (e) allow you to participate in any interactive features of our apps and Services;
  • (f) keep our apps and Services safe and secure; or
  • (g) personalise and improve the Services, to the extent permissible by applicable law.

The lawful basis upon which we process the personal data will be subject to the Services that you were using. Typically, this will include where:

  • (a) you, as a Services user, have given consent;
  • (b) processing is necessary for the performance of a contract to which you, as the Services user is a party, or in order to take steps at your request prior to entering into such contract;
  • (c) processing is necessary for compliance with applicable laws, including Applicable Data Protection Law;
  • (d) processing is necessary for the performance of a task carried out by the DIFC Courts in the interests of the DIFC or in exercise of DIFC Courts powers and functions; or
  • (e) processing is necessary for the purpose of our legitimate interests, to the extent permitted under Applicable Data Protection Law. These legitimate interests include fraud prevention, ensuring network and information security, detecting possible criminal acts or threats to public security, marketing and internal administrative purposes.

4. Processing, storage, and transfer of personal data

We will take all steps reasonably necessary to ensure your personal data is processed fairly and lawfully, in accordance with the DIFC DP Law, other applicable laws and this Privacy Notice. By submitting your personal data , you hereby acknowledge that such personal data may be transferred, stored and processed in order for the DIFC Courts to perform its general administrative functions is necessary and will be done in a proportionate, lawful manner, including but not limited to responding to enquiries you raise via the apps or Services, oversight of the business entities registered in the DIFC’s jurisdiction and maintaining contacts for future informational or promotional activities. Unless otherwise notified, the DIFC Courts does not ordinarily rely solely on automated decision making when processing your personal data.

5. Retention of Personal Data

To preserve the integrity of our databases, to deliver the Services or provide the apps on behalf of all users, for research, analytics, and statistics purposes and to ensure compliance with applicable laws and regulations, the DIFC Courts will retain your personal data for a reasonable length of time, ranging from 5 years to indefinitely, as specified in our Data Retention Policy. This length of time will be determined by a range of factors including:

  • The nature of the personal data
  • The circumstances in which the personal data was obtained
  • The nature of the Services the personal data relates to
  • Our data retention obligations under applicable laws and regulations
  • Our legitimate interest in operating our business in the most customer-focused and professional way

We will erase or put beyond active use your personal data upon request, unless we are required to retain it in accordance with the DIFC DP Law or other applicable laws or to perform the Services, in which case we will align with applicable principles such as purpose specification and data minimisation.

6. Transfer of Personal Data

In order to conduct our operations and fulfil our regulatory obligations, we may transfer the personal data described in this Privacy Notice to and from, and process and store it in, the United Arab Emirates (where applicable or required) and with processors in other countries, some of which may have less protective data protection laws than those where you may reside. In all such cases, and generally for any processing operations, we take appropriate security measures to protect your personal data in accordance with this Privacy Notice and the DIFC DP Law including by entering into standard contractual clauses approved by the DIFC Commissioner of Data Protection with the recipients of your personal data. You may contact us using the details provided under section 10 below if you would like to obtain a copy of our standard contractual clauses. The DIFC Courts is ISO 27001 certified, and all information security policies are strictly enforced. For further details, please refer to security section below.

7. Sharing of personal data

We may share personal data which we collect about you as described in this Privacy Notice or as otherwise described at the time of collection or sharing, including as follows:

  • (a) with third parties to provide you with the Services that you requested; or
  • (b) with third parties with whom you choose to let us share your personal data.

Other types of data sharing

We may also share your personal data in the following circumstances, to the extent permitted by DIFC DP Law and other applicable laws:

  • (a) with DIFC Courts subsidiaries and affiliated entities
  • (b) with vendors, consultants, marketing and advertising partners, and other service providers who need access to such personal data to carry out work on our behalf or to perform a contract we enter with them;
  • (c) if we otherwise notify you and you provide your affirmative opt-in to share your data, where needed;
  • (d) in response to a request for information by a competent authority or government entities if we determine that such disclosure is in accordance with, or is otherwise required by any applicable law, regulation, or legal process;
  • (e) with law enforcement officials, government entities or authorities, or other third parties as required by applicable law; and
  • (f) with third parties in an aggregated and/or anonymised or pseudonymised form that cannot reasonably be used to identify you.

Government data sharing

In some circumstances, we are legally obliged to share information with public authorities, including law enforcement. For example, we may be required to cooperate with supervisory authorities in handling complaints or investigations. In any scenario, we will attempt to satisfy ourselves that we have a lawful basis on which to share the information, document our decision making, and satisfy ourselves we have a legal basis on which to share the information.

We may also share information in the event of the non-payment including of a monetary penalty or court ordered costs. If the debt remains outstanding after the specified timeframe for payment, no payment plan is in place or an agreed payment plan is not being adhered to, we may initiate formal proceedings to recover the full amount of the unpaid penalty.

As a result, the DIFC Courts will share personal data with the litigation and recovery specialists it instructs to allow them to identify assets, if any, and undertake recovery action through the courts.

8. Your rights and choices

Marketing and preferences

The DIFC Courts supports your legal rights to opt-in or subsequently opt-out of receiving communications from us and our partners. You have the option to ask us not to process your personal data for marketing and communications purposes and to remove it from our database, to not receive future communications or to no longer receive our apps or Services.

You may change your preferences at any time.

Please note that we may continue to send you transactional or service-related emails despite your desire to not receive promotional or marketing email messages.  Additionally, please note that if you elect to opt-out of or unsubscribe from receiving promotional or other similar emails or messaging from one of our Services or the apps, you may continue to receive promotional emails from our other websites, providers, or other, non-affiliated marketers whose services you may have accessed via the Services or apps.

Finally, while we may remove your individual contact information from our professional contacts database, please be aware that if such information is in a different, third party's marketing directory through your request or election, you will need to request erasure with such third party directly.

Access to and correction of your personal information

The DIFC DP Law provides certain rights to you in relation to your personal data. These include the rights to:

  • (a) Request details about the personal data that we process, and obtain a copy of the data that we hold about you (to the extent this is not in breach of a legal obligation of professional secrecy to which we are subject in relation to Services user data entrusted to us and that would, therefore, prevent us from informing the relevant data subjects);
  • (b) Correct or update your personal data subject to the above;
  • (c) Port personal data that you have provided to us, in machine readable format, to yourself or another service provider;
  • (d) Erase the data that we hold about you;
  • (e) Restrict or object to our processing;
  • (f) Object to our processing:
    • (i) based on grounds relating to the individual’s particular situation, where the processing is based on the legitimate interest of the DIFC Courts or our third parties;
    • (ii) where personal data is being processed for direct marketing purposes; or
    • (iii) where any decision based solely on automated processing, including profiling, produces legal consequences concerning you or other seriously impactful consequences and to require such decision to be reviewed manually.
  • (g) Not to be discriminated against in pricing and Services for exercising any of your rights;
  • (h) Where consent is the basis for processing your personal data, you may decline to give us your consent, or to withdraw consent to the processing at any time. Please note this may make it impossible for us to provide effective Services. 

These rights are not absolute and are subject to various conditions prescribed under the DIFC DP Law.

In some cases, the exercise of these rights (erasure, objection, restriction, or the withholding or withdrawing of consent to processing) may be impracticable to comply for the purposes of achieving our lawful obligations and functions or provide effective Services.

If you wish to exercise any of the above rights, please contact our Data Protection Officer:

Ruksana Ellahi​​​​

Legal Counsel & Data Protection Officer

Level 3, Precinct Building 5 (South), The Gate District, Dubai International Financial Centre (DIFC)
Dubai, United Arab Emirates

(a) Email: dp@difccourts.ae / dataprotection@difccourts.ae

(b) Telephone: +971 4 427 3333

If you are unhappy with our response, you may make a complaint to the DIFC Commissioner of Data Protection’s Office:

Dubai International Financial Centre Authority
Level 14, The Gate Building, Dubai International Financial Centre (DIFC)
Dubai, United Arab Emirates
commissioner@dp.difc.ae
+971 4 362 2222

9. Security precautions

The DIFC Courts makes every effort to ensure that your personal data is secure. We are dedicated to maintaining our data protection and security policies, periodically reviewing them, and making sure that the DIFC Courts employees are aware of them and fully comply with them. Regrettably, no data transmission over the Internet can be guaranteed to be absolutely secure. As a result, the DIFC Courts cannot warrant or guarantee the security of any personal data you transmit to us, and you do so at your own risk.

The DIFC Courts has established policies and procedures for securely managing information and protecting personal data against unauthorised access. We continually assess our data privacy, information management and security practices. We do this in the following ways:

  • (a) Establishing policies and procedures for securely managing information;
  • (b) Limiting employee access to viewing only necessary information to perform his or her duties;
  • (c) Protecting against unauthorised access to personal data by using data encryption, authentication, and virus detection technology, as required;
  • (d) Requiring service providers with whom we do business to comply with relevant data privacy legal and regulatory requirements;
  • (e) Monitoring our websites through recognised online privacy and security organisations;
  • (f) Engaging in regular third-party audits of our policies and practices; and
  • (g) Conducting background checks on employees and providing training to our employees.

If you have any further questions about our security and processing activities, please contact the DIFC Courts team using the contact details given below. To the extent permitted by applicable law, the DIFC Courts excludes liability for any loss, destruction, unlawful transmission, or access of personal data by a third party through unlawful means. The DIFC Courts also exclude liability where any such loss, destruction or unlawful transmission or access was not the fault of the DIFC Courts.

10. Cookies

We have to collect some data from your computer or mobile device while you use this website or app. We need this data to make the website/app work, to keep it secure, and to comply with regulations. This data is collected by us by placing cookies on your computer/device. A cookie is a small text file that is unique to the web browser on your computer or mobile device. The DIFC DP Law require that we set such collection methods to collect the bare minimum, necessary cookies to operate the relevant website or app. 

We will also seek your consent, via our Cookie Banner, to collect additional data while you use our website/app. This additional data will help us to study how you use our site and Services so we can improve them; decide which of our Services may be relevant for you; serve targeted advertising and gather insight about the types of visitors to the website/app. We do not use cookies to “see” other data on your computer/mobile device or determine your email address.

Detailed information about our cookie usage including the types of cookies we set, and the information collected using them, is available on our Cookie Banner which appears as a pop up when you visit our website or app.

You can alter Cookies settings by choosing the appropriate option on the Cookie Banner, but this may limit your ability to access certain areas of the Services. You can also use the ‘Help’ or ‘Settings’ menu of your browser to learn how to change your Cookie preferences.

Alternatively, you may wish to visit an independent source of information, www.aboutcookies.org which contain comprehensive information on how to alter settings or delete cookies from your computer as well as more general information about cookies.

11. Changes to this Privacy Notice

The DIFC Courts may change this Privacy Notice from time-to-time and without notice. If we make significant changes in the way we treat your personal data, or to the Privacy Notice, we will endeavour to provide you with a notice through the apps or Services, or by some other means, such as email. Your continued use of the apps or Services after any change to this Privacy Notice will constitute your acknowledgment of those changes. We encourage you to periodically review this Privacy Notice for the latest information on our privacy practices. We provide links to this Privacy Notice through:

  • (a) The apps or Services
  • (b) Referencing it in the Services terms.
  • (c) Incorporating it into our contracts, agreements, and other documents as necessary or appropriate.

12. Contact Us

If you have any questions, comments and requests related to this Privacy Notice, or if you have any complaints related to how the DIFC Courts processes your personal data, please contact:

Ruksana Ellahi​​​​

Legal Counsel & Data Protection Officer

Level 3, Precinct Building 5 (South), The Gate District, Dubai International Financial Centre (DIFC) Dubai, United Arab Emirates
dp@difccourts.ae
Tel: +971 4 427 3333

Should you wish to contact the DIFC Commissioner of Data Protection’s Office:

Dubai International Financial Centre Authority
Level 14, The Gate Building, Dubai International Financial Centre (DIFC)
Dubai, United Arab Emirates
commissioner@dp.difc.ae
+971 4 362 2222