Privacy Policy

This Privacy Policy explains how IBV Gold FZCO ("IBV Gold", "we", "us" or "our") collects, uses, stores, discloses and protects personal data when you visit our website, purchase gold, silver or platinum products from us, or otherwise interact with our business. It applies to all our web pages, our physical studios, and any related services. We are a licensed precious metals dealer registered with the Dubai Multi Commodities Centre (DMCC) Free Zone, United Arab Emirates. Because we deal in physical bullion, we are subject to UAE anti-money laundering (AML) and know-your-customer (KYC) obligations in addition to data protection law, and this policy explains how both apply to your information. We process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and, where applicable to visitors or customers based in the European Economic Area or United Kingdom, the General Data Protection Regulation ("GDPR"). By using our website or purchasing from us, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use our website or services.

1. Who We Are — The Data Controller

The data controller responsible for your personal data is:

• Legal entity: IBV Gold FZCO
• Registered address: Unit G-37, Almas Tower, Jumeriah Lake Tower, Dubai, UAE
• Privacy contact / DPO: infodubai@ibvglobal.com
• Phone: +971 4 589 8274

If we act as a processor on behalf of another entity (for example, a group company or payment partner), we will identify the relevant controller separately at the point of collection.

2. Information We Collect

2.1 Information you give us

• Identity data: full name, date of birth, nationality
• Contact data: email address, phone number, billing and delivery address
• Account data: username, password, order history, wishlist
• Transaction data: products purchased, order value, payment method (card details are processed by our payment provider and are not stored by us)
• KYC / AML data: for purchases at or above regulatory thresholds, or where otherwise required by UAE AML law and DMCC rules, we collect a copy of your passport or Emirates ID, proof of address, and — where relevant — source-of-funds or source-of-wealth information
• Communications: records of calls, emails, chat messages and enquiries you send us

2.2 Information collected automatically

• Technical data: IP address, browser type and version, device identifiers, operating system
• Usage data: pages visited, time and date of visit, time spent on pages, referring website, clickstream data
• Cookies and similar technologies, as described in our separate Cookie Policy

We do not knowingly collect special categories of sensitive data (such as health or biometric data) unless specifically required for identity verification, in which case we will explain the purpose and obtain any consent required by law.

3. How and Why We Use Your Data

We only process personal data where we have a valid legal basis to do so. The table below sets out our main purposes and the corresponding legal basis under the PDPL / GDPR.

4. Cookies

Our website uses cookies and similar tracking technologies, including for analytics (e.g. Google) and, where enabled, remarketing. Full details of the cookies we use, their purposes, duration, and how to manage your preferences are set out in our separate Cookie Policy, which forms part of this Privacy Policy.

5. Sharing and Disclosure of Your Data

We do not sell your personal data. We may share it with:

• Regulators and authorities: DMCC, the UAE Central Bank, the Financial Intelligence Unit, customs, and law enforcement, where required by AML/KYC law or a valid legal request
• Service providers: payment processors, delivery/logistics partners, IT hosting providers, and secure storage/vaulting partners, under contractual confidentiality and data protection obligations
• Professional advisers: auditors, insurers and legal counsel, where necessary
• Business transfers: a purchaser or successor in the event of a merger, acquisition or sale of assets, subject to equivalent protections

We disclose data to third parties only to the extent necessary for the purpose in question, and we do not permit them to use your data for their own independent marketing purposes without your consent.

6. International Data Transfers

Your data is primarily processed within the UAE. Where we transfer personal data outside the UAE — for example to a cloud hosting provider or payment processor located overseas — we will only do so where the destination country is recognised by the UAE Data Office as providing adequate protection, or where we have put in place appropriate safeguards such as standard contractual clauses, or where you have given explicit consent to the transfer, in line with Article 22 of the PDPL.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy. As a general guide:

• Order and transaction records: retained for the period required by UAE tax and commercial law (generally at least 5 years)
• KYC/AML records: retained for at least 5 years from the end of the business relationship, as required by UAE AML regulations
• Marketing data: retained until you withdraw consent or unsubscribe
• Website usage/cookie data: retained as set out in our Cookie Policy

Where retention is no longer required, we securely delete or anonymise the data.

8. Data Security

We maintain appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction, including encryption in transit, access controls, and restricted access to KYC/AML records on a need-to-know basis. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we will notify affected individuals and the relevant authority without undue delay in the event of a personal data breach that is likely to result in a risk to your rights, as required by the PDPL.

9. Your Rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request erasure of your data, subject to our legal retention obligations (in particular AML/KYC records, which we cannot delete early)
• Restrict or object to certain processing, including direct marketing
• Request a copy of your data in a portable format, where technically feasible
• Lodge a complaint with the UAE Data Office, or the relevant supervisory authority in your country of residence

To exercise any of these rights, contact us at infodubai@ibvglobal.com. We may need to verify your identity before actioning a request, and we will respond within the timeframe required by the PDPL.

10. Children's Privacy

Our website and services are not directed at, and we do not knowingly collect personal data from, individuals under the age of 18. If we become aware that we have inadvertently collected data from a minor, we will take steps to delete it.

11. Marketing Communications

We will only send you marketing communications by email, SMS, WhatsApp or phone where you have opted in, or as otherwise permitted by law. You can withdraw your consent at any time by using the unsubscribe link in our emails or by contacting us directly; this will not affect service or transactional communications relating to an order.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be highlighted on this page, together with an updated "Last updated" date. We encourage you to review this policy periodically.

13. Contact Us

If you have questions, concerns, or wish to exercise your rights under this policy, please contact us at:

Email: infodubai@ibvglobal.com
Phone: +971 4 589 8274
Post: Unit G-37, Almas Tower, Jumeriah Lake Tower, Dubai, UAE