Data Protection and Privacy Policy

Welcome to the website of The Gulf Capital Market Association, NPIO (GCMA). Your privacy is important to us.

You are here > GCMA > Data Protection and Privacy Policy
The Gulf Capital Market Association NPIO (GCMA) adheres to a policy that respects the privacy of its website and app users.


Effective Date: 20th March 2026

Make an Inquiry

The Organization

The Gulf Capital Market Association NPIO and/or its affiliates and entities (collectively “GCMA”, “we” or “us”) value your security and privacy and aim to comply with DIFC Law No. 5 of 2020 (the “DP Law”).

GCMA’s authorized purposes are to promote the development of the Middle East capital market.

Our Contact Details:

The Gulf Capital Market Association

Gate Village Building 4, Level 3
Dubai International Financial Centre
PO Box 113355
Dubai, United Arab Emirates

Telephone: +971.4.401.9944

For General Data Protection and Privacy Policy Inquiries

Email: info@gulfcapitalmarket.org 

DIFC Registered Number: 0863

We Respect the Privacy and Protect the Data of Our Users

GCMA respects the privacy of our website services and app users. In accordance with the DIFC Data Protection Law No. 5 of 2020 (DP Law) and as applicable in our terms of use, GCMA collects information about you when you use or access our website, use GCMA email addresses for contact purposes, or avail of other web-based products and services (collectively, the “Online Website Services”) as well as through other interactions and communications you have with us, such as our Member Portal, an all-in-one, cloud-based SaaS platform designed for our Members and event-driven organizations to manage memberships, events, and communications.

This online data protection and privacy policy (the “Policy”) sets out the basis on which any information, including any personal data, we collect from you, or you provide to us, will be processed by GCMA. Each time you access or use the Online Website Services or provide us with information, by doing so, you acknowledge the practices described in this Policy. For use of specific services, such as GCMA’s differing services, you always have the right to opt-in when you submit information. These services include:

  • Newsletter sign-up 
  • Become a Member 
  • Contact Us 
  • Financial Market Foundation Courses 
  • Fixed Income Certificate (FIC) Courses 
  • Sustainable Finance Courses  

To use the Online Website Services, or other forms of direct communication, you have consented freely, without ambiguity, for a specific and informed purpose (Article 12 of the DP Law).  You can withdraw at any time (Article 32 of the DP Law).

Member’s Portal

The Glue Up platform serves as the centralized Portal for our Members, providing a streamlined digital ecosystem for professional engagement. It acts as the primary interface for Members to manage their profiles, access exclusive industry resources, and handle membership renewals. Glue Up helps us serve our Members by consolidating event registrations, networking opportunities, and updates into a single secure hub.

Glue Up’s Privacy Policy is here.

Legal basis for processing: The primary legal basis for processing data via Glue Up is Article 10 of the DP Law. This relates to processing that is necessary for the performance of a contract to which the data subject is a party (i.e., your membership agreement).

Legitimate interest: Our use of Glue Up is essential for the administration of your membership. We have a legitimate interest under Article 10 to provide a secure Member Portal that facilitates professional networking, event registration, and the management of member credentials. Without this processing, we would be unable to provide the core digital services and self-service features expected as part of the membership experience.

Newsletter Updates

We use a third-party service, Mailchimp to send out our Newsletters and administer our mailing list. 

Mailchimp’s Privacy Policy is here.

Legal basis for processing: The legal basis for using Mailchimp is Article 10 (Consent) for external marketing and maintaining updates to our Members across all our operational activities.

Legitimate interest: We utilize Mailchimp to ensure our Members remain informed of critical industry updates, regulatory changes, and organizational news. Our legitimate interest under Article 10 lies in maintaining professional standards and ensuring the timely dissemination of information that is vital to the performance and alignment of our Members. We ensure that all such communications provide a clear, immediate ‘opt-out’ mechanism in accordance with your rights.

GCMA’s Partners and Technical Service Providers

To ensure the technical integrity, security, and availability of services for our Members, we partner with select organizations that support our operational infrastructure. Our current partners include The Communications Group, CME Group, and the International Capital Market Association (ICMA).

We share data with these partners only as necessary to maintain a secure and reliable service environment. For further information on how these organizations handle your data, you may review their respective Privacy Policies:

The Communications Group’s Privacy Policy is here.

CME Group’s Privacy Policy is here.

International Capital Market Association’s (ICMA) Privacy Policy is here. 

Legal basis for processing: We need to maintain an online presence, to engage with new and existing Members about our services, or to respond to inquiries to better serve the User.

Legitimate interest:  These interests are necessary for our operations and do not override your fundamental Privacy Rights.

  • Member Support and Retention: To provide a central, online presence where new and current Members can access information and stay informed.
  • Acquisition and Growth: To showcase GCMA’s services, attract new Members and expand the professional capital markets community.
  • Educational Delivery: To highlight interactive courses and certifications that are essential to the professional development of our Members in cooperation with the International Capital Market Association (ICMA) and with CME Group.
  • Communication and Engagement: To offer a direct line of communication via contact forms, allowing us to respond to industry queries and provide support efficiently.
  • Technical Integrity: To ensure our services are hosted in a secure, high-performing environment.

All data captured via the Online Website Services and email is stored in secure environments that comply with the standards set out in this Policy.

Your Statutory Rights Statement

Your Rights under the DIFC Data Protection Law (DIFC DP Law No. 5 of 2020), you possess fundamental statutory rights regarding your personal data. These include the:

  • Right of Access: Request a copy of the data we hold about you.
  • Right to Rectification: Request correction of inaccurate data.
  • Right to Erasure: Request deletion of data (the “Right to be Forgotten”).
  • Right to Object/Restrict: Object to processing for direct marketing.
  • Right to Data Portability: Request transfer of data to another Controller.
  • Right to Non-Discrimination: GCMA will not discriminate against you (in price or service) for exercising any of these rights.

If you believe your rights have been breached, you have the right to lodge a complaint with the DIFC Commissioner of Data Protection.

Lodge a Data Protection Complaint

To lodge a complaint, the contact details are:

  • Authority: Office of the Commissioner of Data Protection
  • Address: Level 14, The Gate, DIFC, PO Box 74777, Dubai, UAE
  • Email: commissioner@dp.difc.ae 
  • Website: www.difc.ae/business/operating/data-protection/ 
  • Online Portal: Complaints to be submitted via their “Report a Breach” or “Lodge a Complaint” forms on the DIFC Client Portal if you have access.

Privacy Policy Overview

1. Scope and application

This Policy applies to persons (“Users”) anywhere in the world who access or use GCMS’s Online Website Services.

2. Collection of Information

Information you give us

This is Personal Identifiable Data (“Personal Information” or “Personal Data”) you submit to us by providing information or filling in forms through our Online Website Services or by corresponding with us (for example, by telephone, by post, at an event, by email, or any other digital or electronic form). It includes, for example, information you provide when you register, consent and opt-in to some or all of our Online Website Services, download information, and share data via our One Website Services, including social media. 

If you contact us, we will keep at least an electronic record of such correspondence, including personal information shared at that time, in order to reply or process it as per your request. The personal information you give us may include your name, address, e-mail address and phone number, certain device information, username, password, residential building, work address, photograph, and other registration information you choose to provide.

Our Online Website Services collects and processes Personal Data for specific, lawful purposes only, or for the performance of tasks carried out in your interests or the interests of GCMA.

The Online Website Services are not targeted, intended, or expected to be used by children. Providing information for specific services or purposes, as directed by GCMA processes, content, or contact information regarding or about children is expressly prohibited.

Whether you are signing up for a newsletter, registering for a course, or making a general inquiry, we only collect the minimum information necessary to serve you.

Legal basis for processing: Under Article 10 of the DP Law, we process your personal information under the following legal frameworks:

  • For General Inquiries and Newsletter Sign-ups: We rely on Article 10 (Consent). By voluntarily providing your details via our contact forms or subscription boxes, you provide us with clear affirmative consent to contact you regarding your specific request.
  • For Memberships and Course Registrations: We rely on Article 10 (Contractual Necessity). Processing your data is essential for us to fulfill our obligations to you, such as providing course materials, issuing certifications, and managing your member portal access.
  • For Service Improvement and Security: We rely on Article 10 (Legitimate Interests).

Legitimate interest: We collect and process your information to maintain a high-functioning professional ecosystem. Our legitimate reasons include:

  • Service Delivery: Providing access to our Members’ Portal, specialized educational courses, events, and ensuring the smooth administration of professional services.
  • Communication: Responding to your inquiries effectively and keeping you updated on industry developments that are relevant to your professional interests.
  • Business Optimization: Analyzing how our services, including events and course content, are used so we can improve our offerings and ensure our platforms (such as the Member Portal) remain secure and user-friendly.
  • Relationship Management: Maintaining an accurate record of our Members to provide tailored support and opportunities.

You have the right to withdraw consent or object to the processing of your personal data at any time by contacting our Data Protection Officer or using the ‘opt-out’ links in our communications.

Contact details for our Data Protection Officer

Sensitive Personal Information

Sensitive personal information is information about an individual that reveals their racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic information, biometric information for the purpose of uniquely identifying an individual, information concerning health or information concerning a natural person’s sex life or sexual orientation.

We do not knowingly or intentionally collect sensitive personal information from individuals, and you must not submit sensitive personal information to us.

If, however, you inadvertently or intentionally transmit sensitive personal information to us, you will be considered to have explicitly consented to us processing that sensitive personal information. If we do not have a legal basis to process that information, we will delete your information.

Information we collect about you and your device

Each time you use our Online Website Services, we may and often automatically collect the following information:

  • Technical information, including the type of mobile device you use, a unique device identifier (for example, mobile network information, your mobile operating system, the type of mobile browser you use, device token, device type, time zone setting (“Device Information”).
  • Details of your use of our Online Website Services, including, but not limited to, traffic data, web logs and other communication data, and the resources that you access (“Log Information”).
  • Location information may be used by the Online Website Services to determine your location. If you wish to use the particular feature, you may be asked to opt-in to your data being used for this purpose.

If you do not wish to share certain data with us or do not want us to use/share it for certain purposes (to the extent possible, in accordance with applicable laws and information in this notice), you can alter your preferences at any time. Where applicable, please check with your device provider’s instructions for further information about how to do this.

You have the right to object to our use of profiling described in this section. You can do that by opting out of cookies and similar technologies in accordance with the method described in the relevant section below. If you do not want us to process your actual IP address (usually the IP address assigned to you by your Internet Service Provider) when you visit our website, you can use a Virtual Private Network (VPN) or a free service such as Tor.

You can find out more about our use of cookies and similar technologies (including the legal basis on which we use them) and how to opt out of them in our Cookies Policy.

Use of profiling for web analytics

Our web analytics service, Google Analytics, collects information such as your location (based on your IP address) and your behavior (based on cookies) when you access our website (such as the pages you visit, what you click on, and the time you spend on our website). We will only process information from cookies if you have consented to us setting cookies on your computer in accordance with our Cookies Policy. 

Information collected about you is anonymized and stored on an aggregate basis.  

Cookies will be used to track and store information about your behavior and device on our website unless you have opted out of receiving such cookies by changing your browser settings and your location will be analyzed based on your IP address. We may target advertisements based on the level of interest we receive from certain visitors and their behavior on our website.

Legal basis for processing: Our legal basis for the collection of data via Google Analytics is your explicit consent under Article 10. We only deploy these cookies and begin data collection once you have opted-in via our cookie management banner on our website.

Legitimate interest: For the subsequent processing and analysis of anonymized, aggregated data, we rely on our legitimate interests to monitor and improve our digital services.

Other information we may collect through your use of the online website services

When you use any Online Website Services, we may collect Personal Data, including demographic information, for example information that you submit, or that we collect, which may include, but is not limited to, post code, age/birth date, current residence, hometown, gender, username, mobile network information, your mobile operating system, the type of mobile browser you use, time zone setting, device location, IP address, SMS data, transaction information, business activities and services/distribution locations, browsing history information, search history information, and registration history information (“Demographic Information”).

Information we collect includes: 

  • First Name and Last Name
  • Company name or business name
  • Email Address
  • Region
  • Industry Sector
  • Telephone Number (mobile and/or landline)
  • IP address
  • Information from cookies
  • Information about your computer or device e.g. device and browser type
  • Demographic information
  • Information about how you use our website (e.g. which pages you have viewed
  • The time when you view them and what you clicked on
  • The geographical location from which you accessed our website (based on your IP address)
  • Future communication preferences

Legal basis for processing: Under Article 10 of the DP Law, we process your personal information under the following legal frameworks:

  • For General Inquiries and Newsletter Sign-ups: We rely on Article 10 (Consent). By voluntarily providing your details via our contact forms or subscription boxes, you provide us with clear affirmative consent to contact you regarding your specific request.
  • For Memberships and Course Registrations: We rely on Article 10 (Contractual Necessity). Processing your data is essential for us to fulfill our obligations to you, such as providing course materials, issuing certifications, and managing your member portal access.
  • For Service Improvement and Security: We rely on Article 10 (Legitimate Interests).

Legitimate interest: We collect and process your information to maintain a high-functioning professional ecosystem. Our legitimate reasons include:

  • Service Delivery: Providing access to our Members’ Portal, specialized educational courses, events, and ensuring the smooth administration of professional services.
  • Communication: Responding to your inquiries effectively and keeping you updated on industry developments that are relevant to your professional interests.
  • Business Optimization: Analyzing how our services, including events and course content, are used so we can improve our offerings and ensure our platforms (such as the Member Portal) remain secure and user-friendly.
  • Relationship Management: Maintaining an accurate record of our Members to provide tailored support and opportunities.

3. Use of Personal Data – How We Utilize Your Information 

We use the Personal Data you provide or that we gather during your interactions with us for the following purposes:

  • Service Delivery and Optimization: To operate, manage, and refine our Online Website Services. This includes enabling financial transactions, issuing confirmations, and delivering specific products or services you have requested. We also use this data to build new features or deliver new services that improve user experience, better Member services, provide technical support, verify identities, and distribute essential service updates or legally mandated notifications.
  • Operational Integrity and Compliance: To meet our internal administrative and regulatory obligations. This involves detecting and preventing fraudulent activity, resolving technical bugs, and performing comprehensive data research and testing. We also analyze usage patterns to ensure our systems comply with both internal standards and external legal requirements.
  • Tailored Communications: To send you updates, news, and promotional information that align with your interests and past engagement with us. These communications are conducted strictly in accordance with DP Law and other relevant regulations.
  • User Engagement and Safety: To keep you informed of updates to our terms or services, enable your participation in interactive site features, and maintain the overall security of our digital environment.
  • Personalization: To customize your experience by suggesting content, referrals, or advertisements that match your individual preferences, provided such activities remain compliant with the standards set by DP Law.

Legal basis for processing: In accordance with Article 10 of the  DP Law, GCMA processes your personal data under the following legal frameworks:

  • Contractual Necessity: We process data to deliver the Online Website Services you have requested, including processing membership applications, facilitating payments, managing the Member’s Portal, and providing customer support. This is essential for us to fulfill our agreement with you as a Member or User.
  • Consent: We rely on your clear, affirmative consent for tailored communications and marketing updates. This applies when you opt-in to receive news, promotions, or event information that we believe will be of interest to you.
  • Legitimate Interests: We process data for Operational Integrity, Personalization, and Safety. This allows us to improve our efficiency, prevent fraud, and customize your experience, provided these interests do not override your fundamental privacy rights.
  • Legal Obligation: We process certain data to comply with internal regulatory and external legal requirements, including mandatory administrative messages or tax-related reporting.
  • GCMA conducts a formal process: We ensure our interests do not override your fundamental rights.

Legitimate interest: For the processing activities where we rely on Article 10 of DP Law, GCMA has identified the following legitimate interests:

  • Enhancing User Experience: We have a legitimate interest in analyzing usage trends to develop new features and Personalize our services. This ensures GCMA’s Online Website services remain relevant, user-friendly, and efficient for all Members.
  • Maintaining Security: It is a legitimate interest for both parties to keep our Online Website Services safe. This includes troubleshooting software bugs, conducting research to prevent abuse, and securing our digital infrastructure.
  • Professional Engagement: To foster a vibrant professional community, we have a legitimate interest in aligning with the professional preferences of our Members to better serve our Members at all times.
  • Operational Transparency: We have an interest in notifying you about changes to our policies or services to ensure you are always aware of how GCMA operates and how your data is managed.

4. Processing Data, Data Storage, Data Transfer of Personal Data and Retention

We are committed to handling your Personal Data with the highest standards of integrity and transparency. Our operations are governed primarily by DP Law; however, we also align our practices with the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection, the EU and UK General Data Protection Regulations (GDPR), and relevant United States privacy frameworks (such as the CCPA/CPRA). By providing your information, including device logs and demographic details, you acknowledge that such data is processed as necessary for GCMA’s administrative, regulatory, and professional functions.

To maintain a professional network and fulfill our regulatory duties, GCMA may transfer, store, and process your data within the United Arab Emirates or via third-party processors located in other jurisdictions. We recognize that some countries may have different levels of data protection. In such instances, we implement rigorous safeguards and adequacy assessments to ensure your information remains protected according to this Policy and international best practices.

GCMA does not utilize fully automated decision-making processes that result in legal consequences for our users. Any profiling conducted for the purpose of personalizing your experience (such as recommending courses or events) is performed with human oversight and in compliance with the transparency requirements for data protection standards.

We rely on the information you provide to remain accurate. You hold the right to access, rectify, or request the deletion of your records at any time. In line with the Right to be Forgotten (found in a number of global data protection laws, including DP Law), we will remove or de-identify your data upon request, provided we are not legally obligated to retain it for audit, regulatory, or service-delivery purposes. We strictly adhere to the principles of Purpose Specification and Data Minimization, ensuring we only keep what is strictly necessary.

As part of our statutory functions, GCMA may occasionally process information or details related to professional certifications and applications. This information is handled under a strict internal Privacy and Data Protection by Design protocol, ensuring it is accessible only to authorized personnel and managed in accordance with the most stringent legal requirements.

To ensure the continuity of our services and compliance with UAE and international financial regulations, we retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the duration of your membership or as required by statutory limitation periods of up to 5 years for financial records.

Legal basis for processing:

GCMA processes and transfers your information globally under the following statutory grounds from DP Law:

  • Contractual Necessity: The transfer and storage of your data (including to international processors like Glue Up or Mailchimp) are essential for the performance of our contract with you. This enables us to provide the Member’s Portal, process membership dues, and deliver professional services regardless of your location.
  • Legal & Regulatory Obligation: We retain and process certain data to comply with mandatory laws. This includes financial auditing, anti-money laundering (AML) requirements, and reporting to the DIFC Commissioner.
  • Appropriate Safeguards for International Transfers: For data outside of the United Emirates, we rely on safe countries like those in the US/EU/UK and on Standard Contractual Clauses (SCCs). This ensures that even when your data moves globally, it receives protection to these standards.

Legitimate interest:  Under Article 10, GCMA has the following business interests that are necessary for our operations and do not infringe upon your fundamental rights:

  • Global Administrative Efficiency: As an organisation, it is in our legitimate interest to utilize cloud processors and database management systems (often based in the US or Europe) to ensure our Member services are reliable, fast, and secure.
  • Data Integrity and Security: We have a legitimate interest in retaining data for a reasonable period to protect against fraud, troubleshoot technical issues across our network, and maintain the historical and current accuracy of professional information issued by or provided to GCMA.
  • Business Continuity: We maintain back-up and archival systems in geographically diverse locations to ensure that Member records are never lost due to localized technical failures or regional disruptions.

5. Sharing of Personal Data

Through our Online Website Services, we may share Personal Data that we collect about you as described in this Policy or as described at the time of collection or sharing, including as follows:

Through our Online Website Services

We may disclose your Personal Data in the following circumstances:

  • Strategic Partnerships and Service Fulfillment: With selected third-party partners to deliver specific services or promotions that you have opted into. This occurs when a service is provided through a joint initiative or a specialized offering between GCMA and an external partner.
  • Third Party Integration: With external platforms, applications, or websites that you have explicitly authorized to connect with our ecosystem. This includes third-party services that link with our API (Application Programming Interface) or online platforms, as well as instances where we integrate with their specific digital tools to enhance your user experience.

Legal basis for processing: 

  • Contractual Necessity: Sharing data with third parties to provide a service you requested is essential for GCMA to fulfill its contractual obligations to you (e.g., if a third party facilitates a specific member benefit).
  • Consent: When you choose to let us share your data with other apps or via API integrations, we rely on your clear, affirmative consent provided at the point of integration.

Legitimate interest:

  • Enhanced Interoperability: We have a legitimate interest in allowing our systems to integrate with other professional tools. This provides our Members with a more seamless digital workflow, without requiring manual data entry across multiple platforms.
  • Service Expansion: It is in our legitimate interest to collaborate with partners to offer a broader range of valuable and professional opportunities that we could not deliver independently.

Extended Disclosures and Third-Party Sharing

Extended Disclosures and Third-Party Sharing.  In addition to our standard operations, we may share your Personal Data under the following circumstances:

  • Corporate Affiliates: With our affiliated organizational entities, provided such sharing is conducted within the boundaries of applicable privacy statutes.
  • Service Partners and Operations: With external vendors, professional consultants, and marketing specialists who assist in our day-to-day operations. These providers are granted access only to the data necessary to perform specific tasks on our behalf or to fulfill contractual mandates we have established with them.
  • User-Authorized Sharing: In any scenario where we provide you with specific notice and obtain your clear, affirmative “opt-in” to distribute your information to a specific third party.
  • Legal and Regulatory Mandates: When we are formally requested to provide information by a government body or competent regulatory authority. We will disclose such data if we conclude that the request aligns with, or is mandated by, current legislation, judicial processes, or administrative regulations.
  • Law Enforcement and Safety: With relevant authorities or law enforcement agencies when necessary to comply with the law, protect the safety of our users, or defend our legal rights.
  • Organizational Transitions: In the event of, or during the formal discussions regarding a merger, the sale of GCMA assets, corporate restructuring, financing, or the acquisition of our operations by another entity.
  • Anonymized Insights: With third parties in a format that has been aggregated, pseudonymized, or otherwise stripped of identifying characteristics, ensuring the data can no longer be reasonably linked back to you as an individual.

Legal basis for processing:

  • Contractual Necessity: Sharing data with vendors and service providers is essential for GCMA to function and deliver our agreed-upon services (e.g., cloud based member’s portal or payment processing).
  • Legal Obligation: Disclosures to government entities or law enforcement are performed to meet our mandatory duties under law.
  • Consent: For any User-Authorized Sharing or marketing-specific partnerships, we rely on your explicit opt-in.
  • Legitimate Interests: Sharing data for Organizational Transitions, or in Anonymized form, is conducted to support the long-term viability and growth of GCMA.

Legitimate interest:

  • GCMA has a legitimate interest in collaborating: GCMA has a legitimate interest in collaborating with specialized vendors and consultants to ensure our Online Website Services are professional, secure, and technologically advanced.
  • Organization Transitions: In the event of an organizational restructuring, it is in our interest to ensure the seamless transition of Members’ records to maintain service continuity. We use anonymized data sharing to contribute to broader industry insights and improve our offerings, without compromising individual privacy.

We do not sell your personal information to third parties or marketers outside of GCMA.

If we receive information about you from a third party in error and/or do not have a legal basis to process that information, we will delete your information.

Mandatory Disclosures to Public and Regulatory Authorities

Legal Mandates and Enforcement: In specific instances, GCMA is under a statutory obligation to disclose personal information to law enforcement agencies or public authorities. This typically occurs in response to formal court orders or when cooperating with supervisory bodies during active investigations or the resolution of formal grievances.

Regulatory Cooperation: We may also exchange information with other regulatory entities to support their mission or our own organizational objectives. Before any such transfer occurs, we perform a rigorous internal review to confirm a valid, lawful basis for the disclosure. This process is fully documented to ensure accountability and to verify that the sharing remains proportionate and legally sound.

Debt Recovery and Financial Obligations: In the event of an unresolved monetary penalty or an outstanding fine, GCMA may be required to share data to facilitate recovery. If a payment deadline passes without a settled plan or adherence to agreed terms, we may initiate formal legal proceedings. In these cases, relevant personal data will be shared with authorized litigation and recovery specialists to identify assets and execute court-mandated recovery actions.

Global Data Sharing Standards: GCMA ensures that all exchanges of personal data with government bodies, whether within the UAE or internationally, align with DP Law and Government Data Sharing Policies. This internal framework ensures that any request for information from a government entity is handled in a manner that is consistently fair, lawful, and respectful of individual privacy rights.

Legal basis for processing:

  • Legal Obligation: This is the primary basis for responding to court orders, law enforcement, and supervisory authorities. We are legally required to comply with the judicial and regulatory frameworks of the law.
  • Public Task / Statutory Functions: Sharing data with other regulatory bodies to further their objectives is often necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in GCMA.
  • When responding to requests from authorities: we would ensure the request is valid, documented, and adheres to the Public Authority Personal Data Sharing Directive and will only be provided for the specific, lawful purpose requested.  GCMA will only provide the minimum necessary data to fulfill the request. 

Legitimate interest:  

  • GCMA maintains a legitimate interest: In ensuring the financial integrity of its operations and the enforcement of its regulations. This includes the recovery of unpaid penalties through specialized third parties.
  • GCMA has a legitimate interest: In participating in the broader regulatory ecosystem of the DP Law to prevent financial crime and maintain the professional standards of the Capital Markets. We ensure that any such data sharing is strictly limited to what is necessary and is governed by the DP Law and Data Sharing Policy.

6. Your Rights and Choices

Managing your marketing preferences

GCMA fully respects your right to control how we communicate with you. 

Opt In or Opt Out at Any Time: You may opt-in to, or subsequently withdraw from, our mailing lists or other forms of communication at any time. You have the right to object to all processing of your data based on legitimate interests. You have the right to request that we cease processing your Personal Data for updates and promotional purposes, remove your details from our marketing databases, or discontinue your access to our Online Website Services.

Transactional vs. Promotional Messaging: Please be aware that even if you opt-out of marketing communications, GCMA may still send you transactional or service-related messages (such as payment receipts or portal updates) that are essential for managing your account. Additionally, unsubscribing from one specific GCMA platform may not automatically unsubscribe you from third-party providers or non-affiliated marketers you accessed through our links; in those cases, you must contact those entities directly.

Third-Party Directories: If your contact details reside in a third-party marketing directory due to your previous interactions with them, GCMA cannot remove that data on your behalf. You will need to contact those third parties personally to request deletion.

GCMA Supports Users’ Legal and Statutory Rights: You have the right to opt-in or subsequently opt-out of receiving communications from our partners and us. You have the option to ask us not to process your Personal Data for marketing purposes and to remove it from our database, and not receive future communications.

You may change your preferences at any time

Your Right to Information Access: You maintain the permanent entitlement to review the personal data GCMA holds regarding your information. This right of access is accessible to you at any time and for any purpose, provided the request aligns with the frameworks established by DP Law and other relevant international privacy statutes.

Ensuring Data Accuracy and Completeness: GCMA is committed to maintaining precise records. Consequently, you have the right to request the correction of any details you believe are erroneous. Furthermore, if you find that the information we possess is insufficient or missing key details, you are entitled to ask us to finalize and complete those records to ensure they are correct.

Rights to Restriction, Deletion, and Portability:  You are entitled to request that GCMA limit how your data is handled, remove your records permanently, or facilitate the transfer of your information to another entity. These protections, including the Right to be Forgotten and data portability, are honored in accordance with the specific provisions of the DP Law and other relevant international privacy regulations.

Fees and Response Timelines:  In most cases, exercising your right to access your data is provided as a free service. Under standard DP Law requirements, we aim to fulfill your request within a one-month timeframe. However, should a request be exceptionally complex or require significant manual labor, GCMA reserves the right to charge a proportionate administrative fee to cover these additional costs, as permitted by law.

Resolution of Data Queries and Third-Party Updates:  Should you contact us regarding a potential error in your Personal Data, GCMA will take steps to validate the information and rectify any confirmed inaccuracies before responding to your request. In instances where it is necessary or appropriate, we will also strive to notify external partners or organizations that have previously received the incorrect data. Please be aware, however, that GCMA does not control the internal refresh cycles of third-party platforms. Consequently, some external sites may continue to display outdated information until their systems are updated or until you contact them directly to request a correction in their specific records.

Commitment to Non-Discrimination:  In accordance with DP Law, GCMA guarantees that you will not face any form of discrimination for exercising your privacy rights. We will not withhold services, alter our pricing, or reduce the quality of your experience based on your choice to utilize your legal protections. Any general adjustments to our service terms or benefits will only be made if they are objectively justified and applied consistently to all individuals, regardless of their data protection requests.

To Initiate a Data Subject Access Request

To initiate a Data Subject Access Request or to review our full internal policy regarding your privacy rights, please contact our Data Protection Officer:

7. Data Security and Protection Protocols

Our Commitment to Security: GCMA prioritizes the protection of your Personal Data within our infrastructure. We employ a dedicated team to manage our privacy and security frameworks, conducting frequent reviews to ensure our internal culture remains focused on robust data protection. However, it is important to note that no digital transmission over the internet can be classified as entirely impenetrable. Consequently, while we strive for the highest security standards, GCMA cannot provide an absolute guarantee regarding the security of data sent to us online, and such transmissions are conducted at your own discretion.

Safeguarding Your Information: We have implemented comprehensive strategies to manage data securely and defend against unauthorized intrusion. Our approach to privacy and information security is subject to continuous evaluation through the following measures:

  • Policy Governance: Maintaining strict internal protocols for the secure handling of all information.
  • Controlled Access: Restricting staff access to Personal Data, ensuring that employees only interact with the information necessary to fulfill their specific roles.
  • Technical Defense: Deploying advanced encryption, multi-factor authentication, and robust threat detection software to block unauthorized access.
  • Vendor Accountability: Mandating that all external partners and service providers adhere to rigorous data privacy regulations and legal standards
  • Independent Verification: Utilizing periodic third-party audits to evaluate our security practices and policy effectiveness.
  • Vetting and Education: Performing thorough background checks on our personnel and providing ongoing data protection training.

Inquiries and Liability: For further details regarding our security measures or processing methods, please contact GCMA’s Data  Protection Officer or consult our Terms of Use. To the extent allowed by law, GCMA disclaims any liability for data breaches resulting from third-party fraud or other incidents occurring through no fault of our organization.

Breach Notification: GCMA is committed to notifying the DIFC Commissioner of Data Protection, and where the breach is likely to result in a high risk to the User’s rights and freedoms to the affected data subjects, without undue delay and where feasible, no later than 48 hours after becoming aware of the breach.

8. Cookies

A Cookie is a specialized text file assigned to your computer or mobile device’s web browser, designed to remember your settings and optimize your navigation of our platform. At GCMA, we utilize Cookies to analyze general website traffic patterns, which allows us to refine and improve the overall user experience. Our use of Cookies is strictly limited to site performance; we do not use them to access private files on your device or to identify your personal email address.

You can review our full Cookie Policy here.

Managing Your Cookie Preferences

While most web browsers are configured to accept Cookies automatically, GCMA  adheres to the Privacy by Design principles of the DP Law. This means we limit our default collection to the absolute minimum required for our website and portal to function securely.

Direct Control via GCMA’s Website: You have full control and authority over your data. You can explicitly manage, enable, or disable specific categories of Cookies at any time through the Cookie Management Tool located directly on our website.

Browser and External Controls: In addition to our on-site tool, you can adjust your preferences through your browser’s Settings or Help menus. Please be aware that disabling certain Cookies may impact the functionality of the Member’s Portal or restrict access to specific interactive features.

For broader guidance on managing or deleting Cookies across various platforms, you may consult independent resources such as www.aboutcookies.org. For mobile devices, please refer to your device manual or service provider for specific instructions on managing privacy settings.

Third-Party Connections: GCMA’s platforms may feature links to external websites that are owned and managed by independent third parties (“External Sites”). We provide these links purely for your convenience and as a resource for further professional insight. However, the inclusion of any link does not imply an endorsement by GCMA of the reliability, accuracy, or opinions expressed on those external platforms.

Disclaimer of Responsibility: You acknowledge that GCMA maintains no control over, and holds no responsibility for, the content or availability of these External Sites. Should you have questions or concerns regarding the material found on an external link, we recommend contacting GCMA or the specific site’s administrator or webmaster directly.

User Assumption of Risk: Choosing to access third-party websites via links on our Online Website Services is done entirely at your own discretion and risk. GCMA expressly disclaims any liability for losses, damages, or complications that may arise from your use of, or reliance on, the content found on external websites.

10. GCMA Premises, Courses and Events: Security Records and On-Site Assets

Visitor and Security Logs: GCMA maintains physical security records, including entry and exit logs for all guests and Members visiting our designated facilities, including events. This information is collected to ensure the safety of our occupants and the security of our infrastructure, and it is managed strictly in accordance with this Privacy Policy.

Management of Abandoned Property: To the extent allowed by relevant legislation, GCMA does not assume responsibility for any items, documents, or digital media, whether containing Personal Data or confidential business information, left behind after an individual vacates our premises or an event. Following the issuance of formal notice to departing occupants, and upon the conclusion of the specified notice period, GCMA reserves the right to dispose of or remove any remaining property, materials, or information at its absolute discretion and at the owner’s expense.

Third-Party Managed Facilities: Please note that properties, rooms, or event premises within the DP Law jurisdiction that are not directly owned or operated by GCMA (or its associated entities) are not governed by this specific Policy. However, the management of such third-party properties is independently required to adhere to the DP Law as it applies generally to all entities operating within the free zone.

11. Policy Updates and Amendments

Periodic Revisions: GCMA reserves the right to modify this Privacy Policy as our services evolve and as legal requirements change. While minor adjustments may occur without direct notification, we will make every effort to inform you of any material changes regarding how we manage your Personal Data. Such notifications may be delivered through the Member Portal, our main website, or via direct email.

By continuing to utilize GCMA’s Online Website Services after these updates are published, you acknowledge that you have been informed of and understand the revised practices. We recommend that you revisit this page regularly to stay updated on our current privacy protocols. Access to this Policy is maintained through:

  • Direct links on our Online Website Services;
  • Specific references within our Terms of Use.

Data Protection Oversight: In compliance with DP Law, GCMA has designated a Data Protection Officer (DPO) to oversee our data protection and privacy strategy and address any inquiries or grievances regarding the handling of your personal information. You may reach our DPO via the contact details here:

12. Children’s Privacy

Because we care about the safety and privacy of children online, we comply with the Children’s Online Privacy Protection Act of 1998 (COPPA). COPPA and its accompanying regulations protect the privacy of children using the internet. We do not knowingly contact or collect information from persons under the age of 18. The website is not intended to solicit information of any kind from persons under the age of 18.

It is possible that we could receive information pertaining to persons under the age of 18 by the fraud or deception of a third party. If we are notified of this, as soon as we verify the information, we will, where required by law to do so, immediately obtain the appropriate parental consent or, if we are unable to obtain such parental consent, we will delete the information, as we have no legal basis to process the information. 

Support and Regulatory Inquiries

Internal Resolution: If you have any questions, concerns, or requests regarding how GCMA handles your personal information, we encourage you to contact us first. Our team is committed to resolving any privacy or data protection-related issues transparently and efficiently.

Lodging a Formal Complaint: Under the DIFC Data Protection Law No. 5 of 2020, you have the right to escalate your concerns to the regulator if you believe a Controller or Processor is in breach of the law.

Useful Contact Information