Privacy notice and regulatory disclosures
Issued by Jewel Box, Dubai, United Arab Emirates. Delineates the statutory lawful bases, international data transfers, and retention schedules governing verified makers and buyers.
Strict lawful bases
UAE PDPL has no legitimate-interests basis. Every processing activity maps strictly to Statutory Obligation, Contractual Necessity, or Granular Consent.
5-year AML retention
Pursuant to UAE Cabinet Resolution No. 134/2025, transaction dossiers, beneficial owner records, and assay certificates are retained for a statutory minimum of 5 years.
Dual-role integrity
Maker supply data and buyer purchasing records are held under one unified legal entity without cross-competitor disclosure or catalogue de-anonymisation.
1. Data controller and statutory reach
The data controller will be the Jewel Box legal entity being formed in the United Arab Emirates. Its registration number and registered address will be published here once issued.
This notice governs processing under:
- UAE Personal Data Protection Law (Federal Decree-Law No. 45/2021): Applies to processing in the United Arab Emirates.
- EU General Data Protection Regulation (Regulation 2016/679): Applies extraterritorially to transactions with buyers in the European Union.
- South Africa Protection of Personal Information Act (POPIA Act 4/2013): Applies to maker onboarding and document submission originating in the Republic of South Africa.
2. Lawful bases for processing
Unlike European data frameworks, the UAE Federal Personal Data Protection Law does not recognise a "legitimate interests" legal ground. Consequently, Jewelbox anchors every category of processing to one of three statutory bases:
A. Statutory Legal Obligation (AML / CFT): Processing of Ultimate Beneficial Owner (UBO 25%+) passports, trade licences, and sanctions re-screening against UN Security Council and UAE Local Terrorist lists is mandated by UAE Federal Decree-Law No. 10 of 2025 and Cabinet Resolution No. 134 of 2025.
B. Contractual Necessity: Processing of trade orders, FIFO physical piece allocation, electronic signatures under Federal Decree-Law No. 46/2021, and invoice generation is necessary to perform our sales and consignment contracts.
C. Prior Granular Consent: Storage of non-essential performance telemetry, buyer notification preferences, and cookie tokens requires prior affirmative consent, stored as immutable first-class consent records.
3. Processing for makers vs. buyers
A company may hold both supply and purchase capabilities. We enforce strict role-based data partitioning:
- Makers: KYB documents, bank accounts, assay results, and remittance records are confidential. Maker identities are completely stripped from buyer-facing catalogue listings and invoices to enforce disintermediation controls.
- Buyers: Trade credentials and credit limits are utilised strictly for order gating and compliance review. Pricing and transaction records are not disclosed to competitors.
4. International data transfers and onward restrictions
Where personal data is transferred internationally (including to verified makers and buyers), transfers are protected by standard contractual clauses, an appointed representative, and a data-transfer schedule containing mandatory onward-transfer restrictions.
5. Statutory record retention
Pursuant to Ministry of Economy guidelines for Dealers in Precious Metals and Stones, records that reconstruct a transaction — including inspection readings, certificate numbers, bank settlement histories, and compliance evaluations — are retained for a minimum of five (5) years following the termination of the business relationship or completion of the transaction.
6. Data subject rights and contact channel
Authorised natural persons representing trading entities may request confirmation, access, correction, or lawful deletion of personal records by contacting the Data Protection Officer at:
Compliance & Data Protection Office • Jewelbox
Email: privacy@jewelbox.ch • Dubai, United Arab Emirates