Data Privacy Policy
LAST UPDATED 7 July 2026
This Data Privacy Policy (“Privacy Policy”) outlines how Mathieu Fabre Magnan Legal Consultants FZE (“MFM Legal Consultants”), a legal entity authorized and duly licensed by Dubai World Trade Centre (License number L-4496) and the Government of Dubai Legal Affairs Department (License number CF-2026-00190), having its registered address at Office No. 416-01-02-03-04 Level 04 Convention Tower, DWTC, Dubai, UAE, acting as the data controller, collects, uses, stores, transfers and protects personal data in accordance with the applicable data and privacy protection laws, including but not limited to UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and the EU General Data Protection Regulation (2016/679) (GDPR), where MFM Legal Consultants processes personal data of individuals located in the European Union or the European Economic Area.
We are committed to transparency, security, and upholding user rights regarding data privacy.
Acknowledgement and Agreement
By using our Website or Services, you acknowledge the practices described in this Privacy Policy and how we collect, use, share and protect your Personal Data. Where any processing is based on your consent, such consent will be sought separately and may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal. If you do not agree with this Privacy Policy, please refrain from using our Website or Services.
This Privacy Policy applies to our Website and Services and explains how we collect, use, and protect your Personal Data. It does not cover any Personal Data collected by third-party websites, applications, or services. When you visit third-party sites or use their services, please take a moment to read their privacy policies.
The Personal Data that we process includes:
- Basic details, such as your name, role/title, your relationship to a person, marital status, and your contact information (such as your email address, physical address, contact numbers);
- Identification information to enable us to check and verify your identity (e.g. your passport details or national identity number, utility provider details, tenancy contracts), and information collected from publicly available resources to verify the same;
- Demographic information such as gender, date of birth / age, nationality, salutation, title, and language preferences;
- Geolocation (approximate location derived from IP address, or precise location where you have enabled location sharing on your device and provided your consent);
- Information relating to the matter on which you are seeking our Services;
- Bank account, payment card details, or other financial information, if relevant to our engagement with you;
- Personal information provided to us by or on behalf of our clients, or generated by us in the course of providing services to them, which may include special categories of Personal Data ;
- Professional and educational information related to our employees, consultants and others such as their former or current employer and job title;
- Preferences, such as your stated interests, how often you would like to receive our newsletters, or other communications; and
- Any other information relating to you which you may provide to us.
In limited circumstances, we may process special categories of Personal Data, including health data, biometric data, data revealing racial or ethnic origin, religious or political beliefs, or other categories considered sensitive under Article 1 of the PDPL and Article 9 of the GDPR. We may also process information relating to criminal convictions and offences (Article 10 GDPR) where this is necessary for the establishment, exercise or defence of legal claims, or where authorised by applicable law. Such processing will be carried out only where strictly necessary for the provision of our Services or to comply with our legal and professional obligations.
We may collect your Personal Data from various sources, including but not limited to the following:
- Personal Data directly shared by you when you enter it in online forms available on our Website during the onboarding process of you as a client in accordance with applicable legislation and professional rules, for payment transaction information for our Services, records of your e-mails or messages when you contact us, by subscribing to our newsletters, publications, attending events, by applying for a job on our Website, engaging with Services, reporting issues with our Website or any other form of communication with us;
- Personal Data automatically collected by us through cookies, links, tracking technologies, etc. Cookies are small text files placed on your device when you visit a website. We may use:
- Strictly necessary cookies, which are essential for the operation of the Website;
- Analytics cookies, which help us understand how the Website is used and improve its performance; and
- Functionality or marketing cookies, where applicable, to support communications and event information.
Except for strictly necessary cookies, cookies will be used only with your consent, where required by applicable law. You can manage or withdraw your consent at any time through your browser settings or cookie preference tools. We may also collect limited technical information automatically, such as IP address, browser type, device information, and pages visited, for security, analytics, and Website administration purposes. Some cookies may be placed by third-party service providers acting on our behalf, who are required to apply appropriate security and confidentiality measures.
- If you link, connect, or log in to your account through a third-party social media service (such as Facebook, Google, Instagram, LinkedIn or others), that service may share certain information with us. This may include registration details and profile information from your account on that service. The type of information shared depends on the third party’s policies, your privacy settings, and the permissions you have granted.
- We may collect Personal Data about you from publicly available sources. This includes any information you voluntarily share in public forums, including social media platforms, blogs, discussion boards, and other publicly accessible channels.
Whether we receive your Personal Data directly from you or from a third party, we will only use your Personal Data if we have obtained your consent (where necessary), or if we have another lawful basis under the applicable data and privacy protection laws, including:
- presenting our Website and its content to you;
- offering information and answering your queries about the Services you request from us, along with updates on new offerings, promotions, and events;
- providing the Services you have requested and otherwise performing our contractual and professional obligations to you;
- managing payment transactions, including product and service fees, subscriptions, professional fees (while we do not store your credit card information);
- performance of a contract;
- compliance with a legal obligation;
- protection of vital interests;
- our legitimate interests in operating, securing, improving and marketing our Services, provided such interests are not overridden by your fundamental rights and freedoms;
- establishment, exercise, or defence of legal claims; or
- processing necessary to achieve a public interest objective in accordance with applicable law.
We may disclose your Personal Data to a recipient:
- for the purposes of outsourcing one or more of the purposes-related functions described above; and
- where you have not opted out of such communication.
- our affiliates and members of our network of legal professionals, on a need-to-know basis;
- service providers and processors engaged by us (including IT, cloud hosting, communication, payment processing, professional support and back-office providers), who are bound by written data-processing agreements containing the safeguards required under the PDPL and Article 28 GDPR;
- courts, tribunals, regulators, governmental and law-enforcement authorities, and other third parties where required by law, court order, regulatory request, or to establish, exercise or defend legal claims;
- professional advisors (such as auditors, insurers, banks and external counsel) engaged in connection with the operation of our business; and
- any successor entity in the context of a corporate restructuring, merger, acquisition or transfer of business, subject to confidentiality undertakings.
Cross-Border Transfer of Your Information
- the recipient jurisdiction provides an adequate level of data protection;
- the transfer is necessary for the performance of a contract or provision of legal services;
- the transfer is required for legal claims or public interest; or
- you have provided explicit consent to such transfer.
We will retain your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal, regulatory,accounting, and professional obligations. In determining the appropriate retention period we consider the nature and sensitivity of the Personal Data, the purposes for which we process it, the applicable statutory limitation periods, our obligations as legal professionals (including record-keeping requirements under UAE Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and its implementing regulations and applicable bar rules), and whether the purposes can be achieved by other means. Personal Data processed in connection withour Services to clients is typically retained for the duration of the engagement and for a period of at least five (5) years thereafter, unless a longer period is required by law or necessary to defend legal claims.
Personal data will be securely deleted, anonymised, or archived once retention is no longer required.
Our website may contain links to third-party websites for your convenience. If you click on these links, you will leave our Website. We do not control these third-party websites or their privacy practices, which may differ from ours. We do not endorse or make any representations about them.
This Privacy Policy does not apply to Personal Data you choose to provide to third parties. We encourage you to review the privacy policy of any website before submitting your Personal Data. If a third party shares your Personal Data with us, that sharing is governed by that third party’s own privacy policy.
You may exercise the following rights in relation to your Personal Data, subject to and in accordance with applicable data and privacy protection laws: (i) the right to be informed about how your Personal Data is processed; (ii) the right of access to your Personal Data; (iii) the right to rectification of inaccurate or incomplete Personal Data; (iv) the right to erasure (“right to be forgotten”); (v) the right to restriction of processing; (vi) the right to data portability, where applicable; (vii) the right to object to processing carried out on the basis of legitimate interests or for direct marketing purposes; (viii) the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you; and (ix) where processing is based on your consent, the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before such withdrawal. To exercise any of these rights, please contact us at notices@mfmlegalconsultants.ae. We may request information to verify your identity before responding. We will respond to your request within the timeframes prescribed by applicable law.
Personal Data Breaches
In the event of a personal data breach that poses a risk to individuals, we will notify the UAE Data Office and affected individuals where required by applicable law, and within the timeframes prescribed by the PDPL and its implementing regulations. Where the GDPR applies, we will notify the competent supervisory authority without undue delay and, where feasible, not later than seventy-two (72) hours after becoming aware of the breach, and we will notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms. We maintain internal procedures to detect, investigate, document and report personal data breaches in accordance with these requirements.
We also take appropriate steps to manage information security risks when sharing your Personal Data with third parties.
Please be aware that no data transmission over the Internet can be guaranteed as completely secure. While we strive to protect your information, we cannot guarantee the security of any data you transmit to us online. Any such transmission is at your own risk.
We have designated an internal data protection contact responsible for overseeing compliance with applicable data protection laws.
Attention: Compliance Officer
Postal address: PO Box 9978, Convention Tower, Dubai World Trade Center, Dubai, United Arab Emirates
EU representative: Mathieu Fabre-Magnan, CDAAP, 11 Boulevard Sébastopol 75001 Paris, France,
mathieu.fabre-magnan@mfmlegalconsultants.ae
Third Party Sites
Changes to this Privacy Policy