Privacy Notice

Personal Data We Collect

Prowa may collect business contact details and other information necessary to manage enquiries, client relationships, consultancy engagements and compliance activities, including:

• name, job title and employer;
• email address and telephone number;
• identification and corporate ownership information;
• correspondence and engagement records; and
• sanctions, PEP and adverse-media information where required for due diligence.

How We Collect Personal Data

Personal Data is primarily collected through direct contact with client representatives, including meetings, emails, telephone calls, engagement documents and onboarding processes. It may also be collected through the Prowa website, enquiry forms, public records and due-diligence sources.

How We Use Personal Data

Prowa uses Personal Data to:

• respond to enquiries;
• provide and administer consultancy services;
• manage client and business relationships;
• conduct client identification, sanctions, PEP and adverse-media screening;
• comply with legal and regulatory obligations;
• maintain business records; and
• protect Prowa's systems, information and legal interests.

Systems and Human Review

Prowa may use screening, research, communication and document-management systems to support its activities. Material findings and decisions are reviewed by authorised personnel.

Prowa does not make significant decisions about individuals solely through automated systems and does not currently use systems for High-Risk Processing Activities.

Sharing of Personal Data

Prowa may share Personal Data with authorised employees, professional advisers, IT and business-support providers, screening providers, regulators and public authorities where necessary or legally required.

Prowa does not sell Personal Data.

International Transfers

Where Personal Data is transferred outside the DIFC, Prowa applies appropriate legal, contractual and security safeguards.

Data Retention

Personal Data is retained only for as long as reasonably necessary for the relevant business, legal, contractual or compliance purpose. Client identification and due-diligence records may be retained for at least five years where required.

Security

Prowa applies proportionate physical, technical and administrative safeguards, including access controls, password protection, secure storage, confidentiality requirements and staff awareness measures.

Your Rights

Subject to applicable law, individuals may request access to, correction, deletion or restriction of their Personal Data, object to certain Processing or withdraw consent where consent is relied upon. Requests may be submitted to:

Complaints

Individuals may contact Prowa with any privacy concern. They may also submit a complaint to the DIFC Commissioner of Data Protection where applicable.

Updates

Prowa may update this Privacy Notice from time to time. The latest version will show its effective date.

Effective date 26 February 2026