How we handle your personal data.

This notice explains how Pangolin Partners FZE ("Pangolin Partners", "we", "us") collects, uses, shares and protects personal data when you visit this website, contact us or work with us. We work with clients and counterparties in many countries, so we aim to meet the standards of the data protection laws that apply to our work, including the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, and equivalent laws in other jurisdictions where we operate.

1. Who we are

Pangolin Partners FZE is the controller of your personal data. We are registered in Dubai, United Arab Emirates (Licence No. L-2196), at 04-00 Sheikh Rashid Tower, Dubai World Trade Centre, Dubai, UAE.

For any question about this notice or your personal data, contact Duncan White, Managing Partner, at duncan@pangolin-partners.com.

2. The personal data we collect

• Enquiries. When you use our enquiry form or contact us, we collect your name, email address, whether you are a buyer or owner, the asset type, stage and region you are interested in, anything you include in your message, and your confirmation that you have read this notice.
• Correspondence. Records of emails, calls and meetings with you, and your contact and professional details.
• Client and counterparty information. When we enter into a confidentiality agreement, mandate or introduction, we may collect information about you and the entity you represent, such as identity documents, company details, ownership information, proof of funds or proof of title, and your investment criteria.
• Data room access. When we invite you to a private data room, we use your email address to grant access. Our data room provider may record when the room is accessed.
• Technical data. Our website host automatically processes technical information, such as your IP address, browser type and the pages requested, to deliver the site and keep it secure.

We do not ask for, and ask you not to send us, sensitive personal data (such as health, religious or biometric information) unless it is required by law.

3. How we use your data and our legal bases

• To respond to your enquiry and discuss how we might work together. Our legal basis is taking steps at your request before entering into an agreement, or our legitimate interest in responding to business enquiries.
• To provide our services, including sourcing assets, making introductions and managing mandates. Our legal basis is performing our agreement with you or your organisation, or our legitimate interests in running our business.
• To verify parties and prevent fraud, including checks on identity, ownership and source of funds before introductions. Our legal basis is compliance with legal obligations and our legitimate interest in conducting transactions safely.
• To keep records and meet legal obligations, including accounting, tax and anti-money laundering requirements.
• To keep in touch about opportunities relevant to you, where you have asked us to or where we have an existing relationship and the law allows it. You can ask us to stop at any time.
• To operate and secure this website. Our legal basis is our legitimate interest in a reliable and secure website.

Where we rely on your consent, you can withdraw it at any time. This does not affect processing that took place before you withdrew it.

4. Who we share it with

We treat your information as confidential. We never sell personal data. We share it only:

• With counterparties, such as a buyer, owner or their advisers, only where this is part of a transaction you have asked us to progress, and normally after a confidentiality agreement is in place.
• With service providers who process data on our behalf under contract, including Netlify (website hosting), Web3Forms (delivering enquiry form submissions to our inbox) and Google (business email, document storage and data rooms).
• With professional advisers, such as lawyers, accountants and auditors, under duties of confidentiality.
• With authorities, where we are required to by law or to protect our legal rights.

5. International transfers

We are based in the UAE and work internationally, and our service providers may process data in other countries, including the United States and the European Union. Where we transfer personal data across borders, we take steps required by applicable law to protect it, such as relying on adequacy decisions, standard contractual clauses or other approved safeguards.

6. How long we keep it

We keep personal data only for as long as we need it for the purposes above. Enquiries that do not lead to further work are normally deleted within 24 months. Client, transaction and verification records are kept for as long as our relationship lasts and afterwards for as long as legal, tax and regulatory record-keeping rules require, which is commonly up to six years.

7. How we protect it

We use appropriate technical and organisational measures to protect personal data, including encrypted connections to this website, access controls on our accounts and data rooms, and sharing confidential documents only with named recipients.

8. Your rights

Depending on where you live and the law that applies, you may have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to delete your data;
• ask us to restrict or stop certain processing, or object to processing based on our legitimate interests;
• receive your data in a portable format;
• withdraw your consent where we rely on it.

To make a request, email duncan@pangolin-partners.com. We may need to confirm your identity first, and we will respond within the time required by law. You also have the right to complain to a data protection authority, such as the UAE Data Office, the UK Information Commissioner's Office or the supervisory authority in your EU country. We would welcome the chance to address your concern first.

9. Cookies and similar technologies

This website does not use analytics, advertising or tracking cookies, and it does not load fonts, scripts or images from third-party servers. The only item it stores in your browser is a small setting that remembers you have seen our privacy notice, which is strictly necessary and does not identify you. Our cookie policy explains this in full.

Links to other websites, such as LinkedIn and Google Drive, take you to services that have their own privacy and cookie policies.

10. Children

Our services are intended for professional and adult private clients. We do not knowingly collect personal data from anyone under 18.

11. Changes to this notice

We may update this notice from time to time. The date at the top shows when it was last changed.