We, at FL BUSINESS MANAGEMENT CO. L.L.C ("we", "our", and "us"), prioritize privacy and aim to ensure that you feel secure when we handle your personal data. We are dedicated to safeguarding your integrity through our diligent efforts. This privacy policy (the "Privacy Policy") is applicable to individuals utilizing our website http://openbankingaccount.com (the "Web-site"). In the following sections, we elucidate the reasons behind processing your personal data, outline your rights in this regard, specify the legal basis governing our data handling practices, and detail the duration for which we retain your information. 1. Who oversees the processing of your personal data? FL BUSINESS MANAGEMENT CO. L.L.C is responsible for the processing of your personal data. Kindly be aware that we also handle data on behalf of our partners. If you have any inquiries concerning this matter or if you wish to exercise your rights under data protection legislation, please reach out to us via our email address info@flconsul.org. 2. The personal data required from youIn general, furnishing personal data to us is not obligatory. However, specific information must be provided to use the Web-site and obtain our services. The situations necessitating the provision of personal data are outlined in the charts below, where the legal basis is indicated as "Performance of a contract" or "Legal obligation". Failure to provide such personal data may, for instance, result in the unavailability of our services. 3. Who has access to your personal data and for what reasons?Your personal data is primarily processed by us and our partners. This implies that our employees and representatives handle your personal data only to the extent necessary for them to fulfill their work duties. It is necessary for us to share your personal data with our suppliers, partners, and subsidiaries to facilitate the efficient operation of our business. We bear the responsibility for any sharing of your personal data with such suppliers, partners, or subsidiaries and ensure the security of your personal data when shared with third parties. We may disclose your personal data to the following recipients: · Our IT suppliers, who will process your personal data on our behalf as processors, ensuring the functionality of our IT system and the efficient operation of our business. The sharing of your personal data is limited to the extent necessary for our suppliers to fulfill their contractual obligations with us, strictly in accordance with our instructions. This applies to all detailed schedules listed below. · If you receive our newsletters or participate in surveys, we will share your personal data with the company that provides the system for sending newsletters or conducting surveys. · Our affiliated partners. The sharing of your personal data is limited to what is necessary for our affiliated partners to fulfill their obligations either with us or directly with you. The partners will process your personal data as controllers since you are also a customer of the partner. There may be some overlap in the information we process and control about you and the information the partners processes and controls. More details on this can be found here. · Analytic services are primarily offered by Google Ireland Limited, and the checkbox service to confirm that you are not a robot is also provided by Google Ireland Limited. Consequently, Google processes your personal data on our behalf and in accordance with our instructions as our processor. Subsequently, Google processes your personal data as a controller. For more details about Google's processing, refer to this link. 4. Where is your personal data processed? We and our processors handle your personal data within the EMEA. In certain situations, we may transfer your personal data outside of the EMEA to our IT suppliers who process personal data as our data processors and in accordance with our instructions. Such transfers only occur in compliance with relevant data protection legislation, ensuring that your personal data is transferred outside the EMEA only when an appropriate level of protection is guaranteed. 5. Comprehensive explanation of how we handle your personal data The following charts provide a detailed description of why we process your personal data, the categories of personal data we process, the legal basis for processing according to the Federal Decree Law No. 45 of 2021 Regarding the protection of personal data, and the duration for which we process your personal data. The legal basis serves as the foundation for our processing of your personal data in accordance with the Federal Decree Law No. 45 of 2021 Regarding the protection of personal data. This information, in part, is required due to legal obligations and may seem extensive and intricate. If you have any questions about how we process your personal data, please feel free to reach out to us. Our contact details are available at the beginning of this Privacy Policy. 6. Processing which we are solely responsible for If you use the Web-site. 7. Purpose of processing · Application processing; · conclusion of an agreement with you for providing our services; · communication with you as required to fulfill our contractual obligations. 8. Personal data we process · Name; · date of birth; · gender; · marital status; · nationality; · e-mail; · phone numbers. 9. Legal basis for processing The processing is essential for us to initiate and fulfill the contract we have with you regarding your obtaining of our services. If the data is not provided to us, we will be unable to help you. Legitimate interest The processing of personal data will be conducted based on our legitimate interest in verifying that you are not a robot. To prevent Google Analytics from using your personal data, you can download and install this browser add-on. Occasionally, various cookies may be employed. If these cookies are non-essential to the service, we process the data with your consent. In such instances, you have the option to withdraw your consent at any time. Duration of storage: We will retain your personal data until the point of account deletion at the latest, though certain data may be deleted earlier. Google will continue to store your personal data for their own purposes, and you will receive separate notification from Google regarding such storage. 10. To send newsletters, surveys and keep you informed Purpose of processing · Send information about news, marketing, offers and invitations ("newsletters"); · Send surveys with enquiries related to aspects of our service, the wider market which we cater to or potential future developments. Personal data we process · E-mail address; · Telephone number; · Information as to whether you wish to receive such communications; · The results from surveys are anonymous so we do not process any answers from you as personal data. Legal basis for processing Legitimate interest The processing of personal data will be carried out based on our legitimate interest to send marketing material, provide broader information, and gather survey results to enhance our service and decision-making processes. Duration of storage: We will process your personal data for this purpose as long as you maintain the Web-site. You have the option to unsubscribe or object to receiving newsletters, surveys, and marketing at any time. If you choose to object to receiving marketing from us, we will maintain a record of this in our "unsubscribe-list" to ensure that you do not receive further such materials. Additionally, you can actively specify your preferences in your account settings at any time, indicating whether you wish to receive newsletters and/or participate in surveys. 11. Your rights when we process your personal data (a) Right to information and access You possess the right to confirm whether we are processing your personal data. This includes comprehensive details such as: ü the purpose of the processing; ü categories of processed personal data; ü recipients or categories of recipients with whom personal data may be shared, especially if located in third countries; ü expected retention times for storage or the criteria used to determine such durations; ü information about your rights to have personal data corrected, deleted, or its processing limited, as well as your right to object to such processing; ü your right to file a complaint with a supervisory authority; ü any application of automated decision-making, including profiling in accordance with Federal Decree Law No. 45 of 2021 regarding the protection of personal data; ü if personal data is transferred to a third country or international organization, your right to information about the measures, in line with Federal Decree Law No. 45 of 2021 regarding the protection of personal data, taken to ensure an appropriate level of data protection Moreover, you have the right to obtain a copy of the personal data we process. Additional copies may incur a reasonable fee for administrative costs if requested, and if provided through email, the information will be delivered in a common electronic format. (b) Right to rectification You have the right to rectify any inaccuracies in your personal data that we are processing and to request the completion of any incomplete personal data. Specifically, in alignment with the purpose, you are entitled to supplement any incomplete personal data. Whenever feasible and with reasonable efforts, we will notify each recipient with whom the personal data has been shared of any corrections made. If you wish to obtain further details about these recipients, please feel free to reach out to us. Our contact information is available at the beginning of this policy. (c) Right to erasure ("the right to be forgotten") Under certain circumstances, you have the right to request the deletion of your personal data. It's important to note that we not only process personal data for our own purposes but also act as data processors on behalf of venues. If you request the deletion of your personal data, we will address the request in relation to our own processing. However, if you also want a venue to stop processing your personal data, you must directly contact the venue. In detail, you have the right, and we have the obligation, to delete your personal data without undue delay if any of the following conditions apply: ü personal data are no longer necessary for the purposes for which they were collected or processed; ü you object to the processing pursuant to Federal Decree Law No. 45 of 2021 Regarding the protection of personal data, and there are no legitimate reasons for the processing that outweigh your reasons, or you object to the processing in accordance with Federal Decree Law No. 45 of 2021 regarding the protection of personal data; ü personal data have been unlawfully processed; ü personal data must be deleted to fulfill a legal obligation under UAE law or any applicable national law to which we are subject. In cases where we have made your personal data public and are required to delete it, we will take reasonable steps, including technical measures, to inform other data controllers of your request and that they should delete any links to, or copies or reproductions of, specific personal data. Please be aware that our obligation to delete and notify does not apply to the extent processing is necessary for the following reasons: ü to exercise the right to freedom of expression and information; ü to fulfill legal obligations under UAE law or applicable national law to which we are subject; ü to be able to establish, assert, or defend legal claims. We will delete your personal data upon your request, provided that we do not have an obligation to retain the personal data in accordance with applicable laws and regulations. We will notify each recipient with whom the personal data has been shared of any deletion that has taken place, as described above, unless this proves to be impossible or entails a disproportionate effort. For information about these recipients, you are welcome to contact us. Our contact information is provided at the beginning of this Privacy Policy. (d) Right to restrict processing Under certain circumstances, you also have the right to request that we restrict our processing of your personal data. In detail, this right applies if: ü you dispute the accuracy of the information (but only for the time necessary to verify); ü the processing is unlawful, and you oppose the deletion of personal data, instead requesting a restriction on the use of the data; ü you need the personal data to assert or defend legal claims, even though we no longer need the data for our purposes; ü you have objected to the processing in accordance with Federal Decree Law No. 45 of 2021 regarding the protection of personal data, and we have not yet assessed whether our legitimate interest in the processing outweighs your legitimate reason for restricting the processing of your personal data. If the processing referred to above is restricted, such personal data (excluding storage) may only be processed with your consent or to establish, assert, or defend legal claims, or to protect the rights of any other persons, or for reasons of public interest. Furthermore, we will notify you before ceasing to restrict any processing. We will also notify each recipient to whom the personal data has been disclosed of any restriction on processing as described above unless it proves impossible or entails a disproportionate effort. If you want information about these recipients, you are welcome to contact us. Our contact information is provided at the beginning of this Privacy Policy. (e) Right to data portability Under certain circumstances, you have the right to receive your personal data from us in a structured, commonly used, and machine-readable format and, where technically feasible, have it transferred to another company (known as "data portability"). In detail, the right to data portability applies to personal data that you have provided to us in a structured, widely used, and machine-readable format, provided that the processing is based on the legal basis of the performance of a contract and the processing is automated. It's important to note that exercising the right to data portability does not impact the application of Federal Decree Law No. 45 of 2021 regarding the protection of personal data, which does not apply to processing necessary for the performance of a task of general interest or part of the exercise of authority performed by us. Furthermore, your right to data portability must not adversely affect the rights and freedoms of others. (f) Right to withdraw your consent and object to processing You have the right to object to our processing of your personal data when the processing is based on the legal basis of "legitimate interest," and we will always consider your objection. Additionally, you have the right to withdraw any consent you have given us, either partially or completely. For instance, you can withdraw consent for the use of your data in marketing and profiling activities, such as sending newsletters, surveys, or providing customized suggestions. More information on this is available in the charts above. In detail, if you object, we may cease processing your personal data unless we can demonstrate compelling legitimate reasons for the processing that outweigh your interests, rights, and freedoms, or if the processing is necessary for the determination, exercise, or defense of legal claims. (g) Right to lodge a complaint with a supervisory authority You always have the right to lodge a complaint with a supervisory authority, and you may do so in the EMEA member state where you live, work, or where an alleged infringement of applicable data protection laws has occurred. Regarding the balancing of interests' assessments when processing personal data based on the legal basis of "legitimate interests," as stated above, we conduct a thorough assessment to ensure that our legitimate interest for the processing outweighs other concerns. This assessment is carried out diligently, with the aim of achieving a fair balance. If you seek more information about any aspect of how we process your data or wish to exercise any of your rights, please feel free to contact us. Our contact information can be found at the beginning of this Privacy Policy. 12. Data breaches If we become aware that a data breach has occurred, we will notify any relevant supervising authorities not later than Seventy-two (72) hours after having become aware of it. 13. Storage and International Transfer of Data The services are supported by a network of computers, cloud-based servers, and other infrastructure and information technology, including, but not limited to, third-party service providers. We and our third-party service providers store and process your personal data in the United Arab Emirates and elsewhere in the world. We will protect your personal data as described in this Privacy Policy if your personal data is transferred to other countries, and have entered into appropriate data-processing agreements with our third-party service providers to this end. By using our Web-site, you consent to your personal data being transferred to other countries, including countries that have different data protection rules than your country. Please contact us if you require further information. 14. Changes to the Privacy Policy We are at all times entitled to change the way we use, collect, transmit and process personal data and such other information as we may deem necessary. This Privacy Policy may therefore be amended from time to time in order to reflect the latest changes. Please re-visit this Privacy Policy regularly to stay informed about how we collect, process and share your personal data.