Privacy Policy

Comply Sphere Advisory FZCO

Effective Date: October 2026
Last Updated: October 2026

Introduction

Comply Sphere Advisory FZCO (“Comply Sphere”, “we”, “our” or “us”) is a company established in Dubai, United Arab Emirates, under the International Free Zone Authority (IFZA).

We are committed to protecting personal information and processing it responsibly, securely and transparently.

This Privacy Policy explains how we collect, use, store, share and protect personal information when individuals:

• Visit our website at www.complysphereadvisory.com.

• Contact us or request a consultation.

• Engage with our independent sanctions advisory and risk management consultancy services.

• Use our digital risk assessment tools, including Nexus™ by Comply Sphere Advisory.

• Complete our Free Sanctions Exposure Scan.

• Download publications, guides or other resources.

• Subscribe to our regulatory insights or other communications.

We process personal information in accordance with applicable data protection legislation, including the UAE Federal Decree-Law No. 45 of 2021 concerning the Protection of Personal Data and, where applicable, the UK General Data Protection Regulation (UK GDPR) and EU General Data Protection Regulation (EU GDPR).

This Privacy Policy does not replace any specific privacy or confidentiality provisions agreed under a separate client contract.

1. Who We Are

Comply Sphere Advisory FZCO provides independent risk management consultancy, sanctions-related advisory services, technology consultancy and software-based risk assessment solutions.

Our services are advisory and decision-support in nature.

We do not provide outsourced compliance operations, undertake ongoing operational sanctions screening on behalf of clients, approve or execute client transactions, or assume responsibility for clients’ regulatory compliance functions.

Clients remain responsible for their own operational decisions, regulatory obligations and compliance arrangements.

For personal information collected through our website and our own business operations, Comply Sphere Advisory FZCO generally acts as the data controller.

Where we process personal information on behalf of a client under specific contractual instructions, our role may differ and will be determined by the applicable agreement and data protection legislation.

2. Information We Collect

2.1 Information You Provide

Depending on how you interact with us, we may collect:

• Full name and professional contact details.

• Business email address and telephone number.

• Company name, job title and business address.

• Information submitted through contact forms or consultation requests.

• Information provided during client onboarding and business enquiries.

• Information voluntarily submitted through risk assessment tools.

• Information included in correspondence, feedback or service requests.

• Subscription preferences and communication records.

We ask users not to submit unnecessary personal information, sensitive personal data or confidential third-party information through general website forms.

2.2 Information Collected Automatically

When you access our website, we may collect certain technical information, including:

• IP address.

• Browser type and device information.

• Operating system.

• Website pages visited.

• Date and time of access.

• Referring website.

• Website interaction and performance information.

• Cookies and similar tracking technologies.

This information may be collected through our website hosting, security, analytics and other configured technologies.

Further information is available in our Cookie Policy.

2.3 Information from Third Parties

Where lawful and relevant to our business activities, we may obtain information from:

• Publicly available corporate records.

• Official sanctions and regulatory publications.

• Commercial compliance and risk information providers.

• Professional networking platforms.

• Business referral sources.

• Corporate clients and authorised representatives.

We use such information only where reasonably necessary for legitimate business, advisory, contractual or compliance purposes and where permitted by applicable law.

3. How We Use Personal Information

We may process personal information to:

• Respond to enquiries and consultation requests.

• Provide independent advisory and risk management consultancy services.

• Administer client relationships and contractual engagements.

• Provide access to software-based assessment and decision-support tools.

• Generate requested risk assessment reports and analytical outputs.

• Maintain and improve our website and digital services.

• Provide requested publications and regulatory insights.

• Send marketing communications where legally permitted.

• Protect our systems against unauthorised access, fraud and misuse.

• Maintain appropriate business, financial and contractual records.

• Comply with applicable legal and regulatory obligations.

• Investigate complaints and resolve disputes.

• Develop and improve our consultancy and technology services.

We do not sell personal information to third parties.

4. Legal Grounds for Processing

Our legal grounds for processing personal information depend on the relevant activity and applicable data protection legislation.

Where the UK GDPR or EU GDPR applies, these grounds may include:

Where UAE data protection legislation applies, we process personal information on an applicable lawful basis, including consent or a recognised statutory exception.

We do not assume that a lawful basis available under UK or EU legislation automatically applies under UAE legislation.

Where consent is required, we seek it before the relevant processing and provide an appropriate means to withdraw it.

5. Artificial Intelligence and Automated Risk Assessment

Certain Comply Sphere services, including Nexus™ and selected digital assessment tools, may use automated analysis, third-party data services and artificial intelligence to generate risk-related information.

These technologies may support:

• Sanctions exposure identification.

• Counterparty and jurisdictional risk analysis.

• Ownership and control assessment.

• Transaction risk indicators.

• Risk scoring and analytical narratives.

• Identification of matters requiring further review.

Automated outputs are intended to support informed professional assessment.

They do not constitute legal advice, a regulatory determination, a guarantee of sanctions compliance or a substitute for independent professional judgement.

Our tools do not independently authorise, prohibit, approve or execute transactions on behalf of users.

Users remain responsible for reviewing the underlying information, assessing its accuracy and making their own compliance and commercial decisions.

Where automated analysis involves personal information, we apply appropriate data protection safeguards and applicable legal requirements.

We do not intentionally use information submitted through our tools to train publicly available artificial intelligence models without an appropriate lawful basis and any consent required by applicable law.

Where third-party AI or data-processing providers are used, the processing arrangements are governed by the applicable service terms, contractual safeguards and privacy requirements.

6. Nexus™ and Digital Assessment Tools

When users access Nexus™ or other Comply Sphere assessment tools, information submitted may be processed to produce the requested analytical output.

Depending on the tool and information supplied, this may include:

• Company and counterparty details.

• Relevant ownership and control information.

• Transaction characteristics.

• Jurisdictions and geographic exposure.

• Financial institution information.

• Sanctions-related risk indicators.

• Supporting information voluntarily provided by users.

Information may be processed using our technology infrastructure and appropriately selected third-party technology or information providers.

Users should ensure that they are authorised to submit information relating to other individuals or organisations.

Where personal information is submitted, users must have an appropriate lawful basis for doing so.

Assessment outputs may contain information derived from third-party databases, public records or automated analytical processes.

Such information may be incomplete, outdated or subject to interpretation.

Comply Sphere does not guarantee the accuracy or completeness of third-party information.

Specific contractual terms, acceptable-use requirements and disclaimers applicable to Nexus™ or other digital tools may apply separately.

7. Sharing and Disclosure

We may share personal information with appropriate third-party service providers where necessary for legitimate business purposes.

These may include:

• Website hosting and cloud infrastructure providers.

• Software and technology service providers.

• Risk information and sanctions data providers.

• Artificial intelligence service providers, where applicable.

• Email and communication service providers.

• Customer relationship management providers.

• Website analytics and marketing technology providers.

• Payment service providers.

• Professional advisers, including legal, accounting and insurance advisers.

We require service providers processing personal information on our behalf to maintain appropriate confidentiality, security and data protection arrangements.

We may also disclose information where required by applicable law, a court order, a competent authority or another legally valid obligation.

We do not disclose client information to unrelated third parties for their independent marketing purposes without an appropriate lawful basis.

8. Confidentiality

We recognise that information submitted during advisory engagements and risk assessments may be commercially sensitive.

We implement reasonable administrative, technical and organisational measures to protect information against unauthorised access, misuse, loss or disclosure.

Confidential information received during a professional engagement is also subject to the confidentiality provisions of the applicable contractual agreement.

Users should not submit confidential transaction documents, sensitive personal information or other restricted material through general website contact forms unless an appropriate secure submission arrangement has been agreed.

9. Data Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, subject to applicable legal, contractual and regulatory requirements.

Retention periods may depend on:

• The nature of the information.

• The purpose of processing.

• Applicable statutory recordkeeping requirements.

• Contractual obligations.

• Security and fraud-prevention needs.

• Potential legal claims or disputes.

Our general retention approach is as follows:

Where information is no longer required, we take reasonable steps to securely delete, anonymise or otherwise dispose of it.

Certain information may remain temporarily in secure backups or be retained where legally required.

10. Information Security

We use appropriate technical and organisational measures designed to protect personal information.

Depending on the relevant system, these may include:

• Encrypted website connections.

• Access controls and authentication.

• Secure hosting infrastructure.

• Restricted administrative access.

• Software maintenance and security updates.

• System monitoring and logging.

• Backup and recovery arrangements.

• Confidentiality obligations for authorised personnel and service providers.

Security measures are reviewed as appropriate to the nature and sensitivity of the information processed.

Although we take reasonable precautions, no electronic transmission or storage system can be guaranteed to be entirely secure.

11. Your Data Protection Rights

Depending on the applicable legislation and circumstances, individuals may have rights concerning their personal information.

These may include the right to:

• Request access to personal information.

• Request correction of inaccurate or incomplete information.

• Request deletion where legally applicable.

• Withdraw consent where processing is based on consent.

• Object to certain processing activities.

• Request restriction or cessation of processing where applicable.

• Request transfer of personal information where legally available.

• Obtain information about certain automated processing activities.

• Raise a complaint with an appropriate data protection authority.

These rights are subject to applicable legal conditions, exceptions and limitations.

To exercise a relevant right, contact:

info@complysphereadvisory.com

We may request reasonable information to verify identity before responding to a request.

We will respond in accordance with applicable legal requirements.

12. Marketing Communications

We may provide regulatory insights, publications, business updates and information about our advisory or technology services.

Where legally required, we obtain consent before sending direct marketing communications.

Marketing communications are separate from service-related and contractual communications.

Recipients may unsubscribe from marketing communications using any available unsubscribe mechanism or by contacting:

info@complysphereadvisory.com

Subject: Unsubscribe

Withdrawal of marketing consent does not affect processing that is otherwise legally permitted or required.

13. Cookies and Website Analytics

Our website may use cookies and similar technologies to support:

• Essential website functionality.

• Website security.

• Performance monitoring.

• Audience measurement and analytics.

• Marketing attribution and campaign measurement, where enabled.

We may use services such as Google Analytics and LinkedIn-related website measurement technologies.

Non-essential cookies or tracking technologies will be used subject to applicable consent and privacy requirements.

Further information, including available choices and controls, is provided in our separate Cookie Policy.

14. International Data Transfers

Comply Sphere operates from the United Arab Emirates and may engage technology or service providers located in other jurisdictions.

Consequently, personal information may be processed or stored outside the UAE or the country in which an individual is located.

Where international transfers occur, we apply appropriate safeguards required by applicable data protection legislation.

Depending on the circumstances, these may include:

• Appropriate contractual data protection arrangements.

• Recognised international transfer mechanisms.

• Standard Contractual Clauses where applicable.

• Security and confidentiality controls.

• Other lawful transfer mechanisms recognised by relevant legislation.

We assess international processing arrangements in accordance with applicable legal requirements.

15. Third-Party Websites and Services

Our website and publications may contain links to independent third-party websites, databases or services.

We do not control the privacy practices or security arrangements of independent third-party websites.

Users should review the relevant privacy policies before providing personal information to those organisations.

16. Children’s Privacy

Our website, consultancy services and technology solutions are intended for businesses and professional users.

They are not directed towards individuals under the age of 18.

We do not knowingly collect personal information directly from children through our business services.

If we become aware that personal information has been collected inappropriately, we will take reasonable steps to address the matter in accordance with applicable law.

17. Changes to This Privacy Policy

We may amend this Privacy Policy to reflect changes in:

• Applicable laws or regulatory requirements.

• Our business activities.

• Our technology services.

• Data processing arrangements.

• Operational or security practices.

The latest version will be published on our website with an updated revision date.

Where changes materially affect processing activities and applicable law requires additional notification or consent, we will take appropriate steps.

18. Contact Information

For privacy-related enquiries, requests or concerns, please contact:

Comply Sphere Advisory FZCO
International Free Zone Authority (IFZA)
Dubai, United Arab Emirates

Email: info@complysphereadvisory.com
Website: https://www.complysphereadvisory.com

Privacy enquiries: info@complysphereadvisory.com

© 2026 Comply Sphere Advisory FZCO. All rights reserved.