Privacy Policy
Last updated: [02 September 2026]
1. Who we are
Sun Management Consultants, Office No. 1504–1505, Burj Al Salam, Sheikh Zayed Road, Dubai, UAE (“we”, “us”), together with our employees and directors, is the controller of personal data collected through www.sundubai.net (the “Website”) and in the course of providing our services. We are committed to protecting your privacy and handling your personal data lawfully, fairly and securely.
2. Scope and applicable law
2.1 This Policy applies to personal data of Website visitors, people who contact us, prospective and existing Clients, and the shareholders, directors, beneficial owners, authorized signatories and representatives of corporate Clients.
2.2 We process personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“PDPL”) and its executive regulations as issued, Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrimes, and the record-keeping and reporting obligations of Federal Decree-Law No. 10 of 2025 on AML/CFT/CPF and its Implementing Regulation (Cabinet Resolution No. 134 of 2025).
2.3 By using the Website or our services, you acknowledge this, Policy. Where we rely on your consent, we will ask for it clearly and separately.
3. Personal data we collect
3.1 Information you give us:
- contact details: name, job title, company, email, telephone, address;
- enquiry and engagement details, including information in documents you share for our services;
- identity and due diligence data required by AML law: passport, Emirates ID, visa, nationality, date of birth, proof of address, trade licence and corporate documents, Ultimate Beneficial Owner (UBO) details, Politically Exposed Person (PEP) status, source of funds and source of wealth;
- payment information: transaction reference, amount, date and payer name. Card numbers are collected directly by our payment gateway and are not accessible to us.
3.2 Information collected automatically: IP address, browser and device type, pages visited, time spent referring website, through cookies and similar technologies (see Section 9).
3.3 Information from third parties: sanctions, PEP and adverse-media screening databases, public company registers, government portals, and people who refer you to us.
3.4 You do not need to register or provide personal data to browse the Website. If you choose not to provide information we need for legal compliance, we may be unable to provide our services.
4. Why we use your data and our legal basis
| Purpose | Legal basis under the PDPL |
|---|---|
| Responding to enquiries and sending proposals | Your request and steps before entering into a contract |
| Providing and invoicing our services | Performance of our contract with you |
| Identity verification, CDD, EDD, UBO checks and ongoing monitoring | Compliance with legal obligations under UAE AML law |
| Screening against the UAE Local Terrorist List, UN Consolidated List and other sanctions lists | Compliance with legal obligations (Cabinet Decision No. 74 of 2020) |
| Reporting suspicious transactions to the UAE FIU via goAML | Compliance with legal obligations |
| Accounting, VAT and tax records | Compliance with legal obligations (Federal Decree-Law No. 8 of 2017; Federal Decree-Law No. 28 of 2022) |
| Preventing fraud and securing the Website | Legal obligation and protection of our legitimate rights |
| Website analytics | Consent (non-essential cookies) |
| Newsletters and marketing emails | Consent, which you may withdraw at any time |
We do not use your personal data for decisions based solely on automated processing that produce legal effects for you.
5. AML and regulatory disclosures
5.1 UAE AML law requires us to verify identities, screen against sanctions lists, keep records and report suspicious transactions to the UAE Financial Intelligence Unit. We may also be required to disclose information to the Ministry of Economy and Tourism, the Executive Office for Control and Non-Proliferation (EOCN), the Federal Tax Authority, the police, the Public Prosecution and the courts.
5.2 The law prohibits us from telling you that a report has been made or that information has been requested by an authority. Your rights in Section 12 may therefore be restricted where exercising them would prejudice an investigation or breach this prohibition.
6. Who we share your data with
We do not sell, trade or rent your personal data. We share it only with:
- our payment gateway and acquiring bank, to process payments;
- IT, hosting, email, cloud and screening service providers acting on our instructions;
- professional advisers such as lawyers, auditors and insurers, under duties of confidentiality;
- companies within Sun Management Group, where needed to deliver your services;
- government authorities, regulators and courts where required by law (Section 5);
- a buyer or successor in the event of a merger, acquisition or restructuring.
All service providers must keep your data confidential and secure and use it only for the purposes we specify. Anonymised, non-identifiable statistics may be used for business analysis.
7. Transfers outside the UAE
Some of our service providers may store or process data outside the UAE. We transfer personal data abroad only as permitted by Articles 22 and 23 of the PDPL, for example to countries with adequate data protection, under a contract with appropriate safeguards, or where necessary to perform our contract with you.
8. Security
We use technical and organisational measures appropriate to the risk, including encrypted (HTTPS) connections, access controls, restricted staff access on a need-to-know basis, staff confidentiality and training, and secure storage of due diligence documents. No internet transmission is completely secure, so please avoid sending sensitive documents by unencrypted email where a secure alternative is offered.
9. Cookies and third-party advertising
9.1 The Website uses essential cookies to function and, with your consent, analytics cookies to understand how it is used. You can manage or refuse cookies through our cookie banner or your browser settings; refusing non-essential cookies will not stop you using the Website.
9.2 Advertisements on the Website may be selected and delivered by third parties such as ad networks and agencies. These parties may use cookies, web beacons and similar technologies to collect information about your activity on this and other websites in order to show you relevant advertisements. We do not control or have access to this information, and their practices are governed by their own privacy policies.
10. Retention
| Record type | Retention period |
|---|---|
| CDD and identity documents, transaction records, screening results and AML correspondence | At least 5 years after the business relationship ends or the transaction date, or longer if a competent authority requires |
| Accounting, invoice and VAT records | At least 5 years from the end of the relevant tax period, or longer as required by tax law |
| Engagement files | [5] years after the engagement ends |
| Enquiries that do not lead to an engagement | [2] years from last contact |
| Marketing preferences | Until you withdraw consent |
After these periods, data is securely deleted or anonymized.
11. Data breaches
If a personal data breach is likely to affect your privacy or rights, we will notify the UAE Data Office and, where required, you, in line with the PDPL and its executive regulations.
12. Your rights
Subject to the PDPL and the legal restrictions in Section 5, you may:
- request access to, and a copy of, your personal data;
- request correction of inaccurate or incomplete data;
- request erasure of data we no longer need, unless we must keep it by law (for example, AML and tax records);
- request restriction of, or object to, certain processing;
- request transfer of your data to another controller in a structured, readable format;
- withdraw consent at any time, without affecting earlier processing;
- object to decisions based solely on automated processing.
To exercise these rights, email [privacy@sundubai.net] with proof of identity. We will respond within [30] days. If you are unhappy with our response, you may complain to the UAE Data Office.
13. Children
The Website and our services are not directed at persons under 18. We do not knowingly collect personal data from children.
14. Offline information
This Policy also covers personal data you give us offline, for example in meetings or on paper forms, when it relates to our services.
15. Changes to this Policy
We may update this Policy to reflect changes in law or our practices. The updated Policy takes effect when published on the Website, with the “Last updated” date shown above. We will notify Clients of material changes by email.