Data Protection Policy
How Pistos Group complies with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and the rights it gives you.
The law we work under
The United Arab Emirates regulates personal data through Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, known as the PDPL, overseen by the UAE Data Office. Pistos Group L.L.C-FZ acts as the data controller for the data described in our privacy policy.
Where we handle data on a client's behalf during an engagement — filing with an authority, submitting to a bank — we act as a processor on that client's instructions.
The basis on which we process
We process personal data on one of four bases, and we can tell you which applies to any particular piece of data.
- Your consent, where you submit an enquiry form or ask us a question
- Performance of a contract, once you engage us
- A legal obligation, including anti-money-laundering, know-your-customer and tax record-keeping duties
- Our legitimate interest in running and securing the business, where that does not override your rights
Your rights under the PDPL
- Access — to be told what we hold and to receive a copy
- Correction — to have inaccurate or incomplete data put right
- Erasure — to have data deleted where no legal duty requires us to keep it
- Restriction — to limit how we use data while a dispute is resolved
- Portability — to receive your data in a structured, machine-readable format
- Objection — to object to processing based on legitimate interest
- Withdrawal of consent — at any time, without affecting what was lawful beforehand
Where erasure does not apply
Anti-money-laundering and tax rules require us to keep client identification and transaction records for a minimum period, currently five years from the end of the relationship. We cannot delete those records on request during that period, and we will tell you plainly when that is the reason rather than giving you a vague refusal.
Transfers outside the UAE
Our hosting and email providers operate servers outside the UAE. Where personal data leaves the country we rely on the transfer conditions permitted by the PDPL, including transfers to jurisdictions with an adequate level of protection and contractual safeguards with our providers.
Where you instruct us to deal with an authority, a bank or an adviser in another country, the transfer is made on your instruction and for the purpose you gave us.
Breach notification
If a breach occurs that is likely to prejudice the privacy, confidentiality or security of your data, we will notify the UAE Data Office and, where the risk to you warrants it, notify you directly. We will tell you what happened, what data was affected and what we are doing about it.
Making a complaint
Raise it with us first at hello@pistos.ae — most things are resolved faster that way. If you are not satisfied with our response, you have the right to complain to the UAE Data Office.
Last updated
9 October 2026