Privacy Policy

1. Introduction

ESG Emirates Stallions Group P.J.S.C., together with its subsidiaries, affiliates and entities directly or indirectly controlled or managed by ESG (collectively, the "ESG Group"), is committed to protecting the privacy and security of Personal Information. This Privacy Policy applies to all websites owned, operated or managed by any member of the ESG Group unless a specific website publishes a separate supplemental privacy notice applicable solely to that website.

2. Policy Statement

This Privacy Policy outlines how ESG collects, uses, processes, stores, discloses, transfers and protects Personal Information in connection with the websites, services and business activities of the ESG Group.

ESG may amend or update this Privacy Policy from time to time to reflect changes in applicable law, regulatory requirements, business operations or information-processing practices. Unless otherwise required or permitted by applicable law, Personal Information will be processed in accordance with the Privacy Policy in effect at the time it was collected or as otherwise notified to the relevant individual.

For the purposes of this Privacy Policy, "user", "you" or "your" means any individual who:

accesses or uses any website, digital platform or online service operated by a member of the ESG Group;
corresponds or otherwise communicates with ESG or any member of the ESG Group;
submits enquiries, requests or other information to ESG;
applies, or is considering applying, for employment with ESG or any member of the ESG Group; or
otherwise provides Personal Information to ESG in connection with its business activities.

3. Information We Collect

"Personal Information" means any information relating to an identified or identifiable natural person and includes any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual.

ESG may collect, receive or otherwise process Personal Information where you access or use an ESG Group website, communicate with ESG, submit enquiries or applications, participate in recruitment processes, enter into commercial or contractual relationships with ESG, or otherwise voluntarily provide Personal Information to ESG through any lawful means.

3.1 Information Provided Through Website

We may collect information including:

Full name;
Email address;
Telephone number;
Job title or designation;
Company or organisation;
Country of residence;
Preferred language, where voluntarily provided;
Marketing or communication preferences, where applicable; and
Any other information voluntarily submitted through the Website.

ESG does not intentionally seek to collect Sensitive Personal Information unless such collection is necessary for a legitimate business purpose, legal or regulatory obligation, recruitment process or the performance of a contractual relationship. Where required by applicable law, ESG will obtain the individual's explicit consent or rely on another lawful basis before processing such information.

3.2 Recruitment Information

As part of ESG’s recruitment and candidate evaluation processes, we may collect:

Full name and contact information;
Email address and telephone number;
Nationality and age;
Academic and professional qualifications;
Skills and competencies;
Employment history;
Experience certificates and reference letters;
Curriculum vitae and supporting application documents;
Current or previous remuneration and benefits information;
Any other information reasonably necessary to assess an employment application.
Right to work or employment eligibility documentation, where required;

3.3 Technical and Usage Information

When you access or use the Website, we may automatically collect certain technical information, including:

Internet Protocol address;
Browser type and version;
Device type;
Operating system;
General geographic or demographic information;
Pages visited and actions taken on the Website;
Date, time and duration of Website visits; and
Information collected through cookies and similar technologies.
Device identifiers;
Session identifiers;
Log files;
Referring websites or URLs;

Further information regarding ESG's use of cookies and similar technologies is set out in the ESG Group Cookie Policy.

3.4 Payment and Financial Information

Where you engage in commercial transactions with ESG, make or receive payments, submit invoices, request refunds, enter into contractual arrangements, or otherwise participate in financial transactions with ESG, we may collect:

Bank account details, IBAN and SWIFT information;
Bank account details, IBAN and SWIFT information;
Tax registration numbers, VAT details and financial identification numbers where applicable;
Invoice details, purchase orders and supporting documentation;
Payment transaction history and payment references;
Limited payment card information where payments are processed through authorised payment providers.
Trade licence information;
Corporate registration details;
Authorised signatory details;
Proof of identity where required for verification or compliance purposes;

ESG does not intentionally retain full payment card numbers, CVV/security codes or other sensitive authentication data following transaction authorisation. Payment card transactions are processed through authorised third-party payment service providers that maintain appropriate security standards and regulatory compliance.

4. How We Use Personal Information

4.1 Purposes for Processing Personal Information

ESG may collect, use and otherwise process Personal Information for the following legitimate business, contractual, operational and legal purposes, where permitted or required by applicable law:

Verify your identity when accessing restricted areas of the Website or other ESG Group digital platforms;
Create, administer and manage user accounts;
Operate, maintain, secure and improve the Website and other ESG Group digital services;
Respond to enquiries, requests, complaints, applications or other communications;
Manage ESG's relationship with users, customers, suppliers, business partners and other stakeholders;
Facilitate communications and the provision of ESG's services;
Personalise the Website and improve the user experience;
Evaluate employment applications and administer recruitment processes;
Provide information regarding ESG's projects, services, activities, employment opportunities or corporate updates;
Monitor Website usage, performance, analytics and security;
Detect, investigate and prevent fraud, cyber threats, unauthorised access or other unlawful activities; and
Exercise or defend ESG's legal rights and comply with applicable legal or regulatory obligations.

4.2 Other Business and Operation Purposes

In addition to the purposes relating to the operation of the Website, ESG may process Personal Information in connection with its business activities, corporate governance, contractual relationships and legal obligations, including for the following purposes:

Compliance with applicable laws, regulations, contractual obligations and internal governance requirements;
Processing and administering supplier payments, customer refunds, employee reimbursements, payroll, procurement transactions, contract administration, invoice verification, settlement of financial obligations, fraud prevention, accounting, taxation, financial reporting, audit and regulatory compliance;
Responding to requests from courts, regulators, law enforcement agencies or other competent authorities;
Conducting corporate administration, governance, reporting, internal controls, compliance monitoring and risk management;
Preventing fraud, corruption, cyber threats, money laundering, sanctions breaches or other unlawful activities;
Protecting ESG's legal rights, assets, systems, employees, reputation and business interests;
Establishing, exercising or defending legal claims and managing disputes, investigations, litigation or arbitration;
Contacting individuals regarding ESG's services, projects, activities or to obtain feedback; and
Any other purpose that is compatible with the original purpose of collection or otherwise permitted or required by applicable law.

Access to the Website and other ESG Group digital platforms may be monitored, logged, reviewed or recorded where reasonably necessary to maintain the security, integrity and availability of ESG's systems, investigate suspected security incidents or unlawful activity, ensure compliance with applicable policies and terms of use, protect ESG's legal rights, or otherwise comply with applicable law.

ESG processes Personal Information only where there is a lawful basis for doing so under applicable law. Depending on the circumstances, this may include processing based on the individual's consent, the performance of a contract, compliance with a legal obligation, ESG's legitimate interests or any other lawful basis recognised under applicable data protection legislation.

5. User Consent

Where ESG relies on consent as the lawful basis for collecting or processing Personal Information, such consent will be obtained in accordance with applicable law. Where another lawful basis for processing applies, ESG may process Personal Information without obtaining consent to the extent permitted by applicable law.

The form and manner of obtaining consent may vary depending on the nature of the Personal Information, the purpose of processing and the applicable legal requirements. Consent may be obtained through:

Application, registration or enquiry forms that explain how the Personal Information will be used;
Signed or electronically submitted documents;
Tick boxes or other electronic consent mechanisms;
Written or electronic communications;
Verbal consent where information is collected by telephone or other recorded communications; or
Any other lawful method recognised under applicable law.

Where processing is based on consent, you may withdraw your consent at any time by contacting ESG using the contact details provided in this Privacy Policy or through any other available withdrawal mechanism. Withdrawal of consent will not affect the lawfulness of any processing carried out before the withdrawal became effective and will not affect any processing undertaken on another lawful basis.

Where consent is withdrawn, ESG may continue to process Personal Information where such processing is necessary to comply with applicable law, perform contractual obligations, establish, exercise or defend legal claims, or otherwise where another lawful basis for processing exists.

6. Disclosure of Information to Third Parties

ESG may disclose or otherwise make Personal Information available to third parties where such disclosure is necessary for the purposes described in this Privacy Policy, required or permitted by applicable law, necessary for the performance of a contract, or otherwise supported by a lawful basis for processing.

Personal Information may be shared with:

ESG subsidiaries, affiliates and other members of the ESG Group where necessary for legitimate business, operational, governance or administrative purposes;
Employees, directors, officers, representatives and authorised personnel who have a legitimate business need to access the Personal Information;
Service providers, consultants, contractors and professional advisers supporting ESG's operations;
Technology, hosting, analytics, communications and cybersecurity providers;
Technology, hosting, analytics, communications and cybersecurity providers;
Banks, payment service providers, licensed financial institutions, payment gateways, merchant acquirers, auditors, fraud-prevention providers and other financial service providers where necessary to process authorised transactions, prevent fraud, comply with financial regulations or fulfil contractual obligations;
Recruitment agencies, background-screening providers and professional reference providers;
Government authorities, regulators, courts, tribunals, law-enforcement agencies or other competent authorities where required or permitted by applicable law or pursuant to a lawful request;
Parties involved in litigation, arbitration, mediation, investigations, corporate restructurings, financings, mergers, acquisitions, disposals, joint ventures or the sale or transfer of business assets, where disclosure is necessary for the relevant transaction or proceeding; and
Other third parties where disclosure is authorised by the user or permitted by applicable law.

Where Personal Information is disclosed to or processed by third parties on behalf of ESG, ESG will take reasonable steps to ensure that such parties are subject to appropriate contractual confidentiality, security and data protection obligations and process Personal Information only for the authorised purposes and in accordance with applicable law.

7. Communications

Where permitted by applicable law and, where required, with your consent, ESG may use your contact information to communicate with you regarding its services, business activities, projects, employment opportunities, events, corporate announcements, regulatory disclosures, investor relations communications, operational updates and other information relevant to your relationship with ESG.

ESG may engage communications, technology and other authorised service providers to facilitate the delivery of such communications, subject to appropriate confidentiality and data protection obligations.

You may opt out of receiving promotional or marketing communications at any time by following the unsubscribe instructions included in the communication or by contacting ESG using the contact details provided in this Privacy Policy. Opting out of promotional communications will not prevent ESG from sending communications that are necessary to administer your relationship with ESG, comply with legal obligations, perform contractual obligations or provide important operational, security or account-related notices.

8. Sale of Personal Information

ESG does not sell, rent or commercially trade users' Personal Information.

ESG does not disclose Personal Information to third parties for their own independent marketing purposes unless the individual has provided consent or such disclosure is otherwise permitted by applicable law.

9. Third-Party Websites and Services

This Privacy Policy applies only to the collection and processing of Personal Information by ESG and members of the ESG Group. It does not apply to websites, applications, platforms or services operated by third parties.

The ESG Group websites may contain links to third-party websites, applications, platforms or services for your convenience. Such third parties operate independently of ESG and maintain their own privacy notices, terms of use and information-processing practices.

ESG does not control and is not responsible for the privacy practices, security, availability, content or information-processing activities of any third-party website, application or service. Access to or use of third-party websites is at the user's own discretion and subject to the applicable terms and privacy policies of those third parties. Users are encouraged to review the relevant privacy notices before providing any Personal Information.

10. Information Security

ESG implements appropriate administrative, physical, technical, electronic and organisational security measures designed to protect Personal Information against accidental, unlawful or unauthorised access, disclosure, alteration, destruction, loss or other forms of unauthorised or unlawful processing, taking into account the nature of the Personal Information, the purposes of processing and the risks associated with such processing.

ESG takes reasonable steps to ensure that Personal Information remains accurate, complete and, where necessary, up to date. Individuals are encouraged to notify ESG promptly of any changes to their Personal Information.

Although ESG implements appropriate security measures designed to protect Personal Information, no method of transmission over the internet or method of electronic storage is completely secure. Accordingly, ESG cannot guarantee the absolute security of Personal Information transmitted electronically to or from ESG.

Users transmit Personal Information electronically at their own risk.

Where ESG processes payment card information, payment transactions are encrypted during transmission and processed through authorised third-party payment service providers that maintain appropriate security standards, including, where applicable, compliance with the Payment Card Industry Data Security Standard (PCI-DSS). ESG does not intentionally retain sensitive authentication data, including CVV/security codes, following transaction authorisation.

10.1 Payment Security

ESG applies appropriate administrative, technical and organisational controls to safeguard financial and payment information against unauthorised access, disclosure, alteration, misuse, loss or destruction.

Payment transactions are processed through authorised financial institutions and secure third-party payment service providers that implement appropriate security measures in accordance with applicable legal, regulatory and industry requirements.

ESG does not intentionally retain sensitive authentication data, including full payment card verification values (CVV/CVC), following transaction authorisation. Where payment card information is processed, ESG takes reasonable steps to ensure that such information is handled securely and only for authorised business purposes.

11. International Data Transfers

Where necessary for ESG's business operations, corporate administration, the provision of services or the performance of contractual or legal obligations, Personal Information may be transferred to, accessed from, processed in or stored in jurisdictions outside the country in which it was originally collected.

Where such international transfers occur, ESG will implement appropriate contractual, technical and organisational safeguards to ensure that Personal Information receives a level of protection consistent with applicable data protection laws and this Privacy Policy.

Where required by applicable law, ESG will ensure that any international transfer of Personal Information is supported by an appropriate legal transfer mechanism or other lawful basis for such transfer.

12. Information Retention

ESG will retain Personal Information only for as long as is reasonably necessary to fulfil the purposes for which it was collected or otherwise processed, including to comply with applicable legal, regulatory, contractual, accounting, taxation, audit or reporting requirements.

Personal Information may also be retained where necessary to establish, exercise or defend legal claims, comply with litigation hold requirements, regulatory investigations or lawful requests from competent authorities, or otherwise where retention is required or permitted by applicable law.

Upon the expiry of the applicable retention period, and where there is no legal, regulatory or legitimate business reason to retain the Personal Information, ESG will take reasonable steps to securely delete, destroy, anonymise or otherwise irreversibly de-identify the Personal Information in accordance with its applicable records retention and information governance procedures.

13. Your Rights

Subject to applicable law and any applicable legal or regulatory limitations, individuals may have the right to:

Request access to their Personal Information;
Request the correction or updating of inaccurate, incomplete or outdated Personal Information;
Request the deletion or erasure of their Personal Information, where applicable;
Object to or request the restriction of certain processing activities, where permitted by applicable law;
Withdraw consent where processing is based on consent, without affecting the lawfulness of processing carried out before such withdrawal;
Request information regarding how their Personal Information is collected, used and processed;
Request, where applicable, a copy of their Personal Information in a structured or otherwise appropriate format;
Request, where applicable, the transfer or portability of their Personal Information;
Not be subject to a decision based solely on automated processing where such right exists under applicable law; and
Lodge a complaint with the competent supervisory or regulatory authority, where applicable.

Requests relating to Personal Information may be submitted using the contact details published on the relevant ESG Group Website.

ESG may request reasonable information to verify the identity and authority of the individual submitting the request before responding. ESG may refuse, limit or defer a request where permitted or required by applicable law, including where the request is manifestly unfounded, excessive, repetitive, would adversely affect the rights of others, or where ESG is otherwise legally entitled or required to retain or continue processing the Personal Information.

14. Children's Privacy

The Website is not intended for use by minors unless expressly stated otherwise. ESG does not knowingly collect or process Personal Information relating to minors without the consent of a parent or legal guardian where required by applicable law.

If ESG becomes aware that it has collected or processed Personal Information relating to a minor in circumstances where such collection or processing is not permitted under applicable law, ESG will take reasonable steps to delete, anonymise or otherwise securely dispose of the Personal Information as soon as reasonably practicable, unless retention is required or permitted by applicable law.

15. Changes to This Privacy Policy

ESG may amend, modify or update this Privacy Policy from time to time to reflect changes in applicable laws or regulations, business operations, technology, information processing practices or other operational or legal requirements.

Where appropriate, ESG will publish the updated Privacy Policy on the relevant ESG Group Website and update the revision date to indicate when the changes become effective.

Where required by applicable law or where the changes materially affect the manner in which Personal Information is processed, ESG may provide additional notice or obtain any consent required by applicable law before such changes become effective.

The updated Privacy Policy will become effective on the date specified in the revised version. Users are encouraged to review this Privacy Policy periodically to remain informed about how ESG collects, uses, processes, shares and protects Personal Information.

16. Contact Us

If you have any questions, requests or concerns regarding this Privacy Policy or the processing of your Personal Information, you may contact the relevant ESG Group entity through the contact details published on the applicable ESG Group Website or through the following contact details:

ESG Emirates Stallions Group P.J.S.C.
Abu Dhabi, United Arab Emirates
Website: www.esguae.com

ESG will endeavour to respond to privacy-related enquiries and requests within a reasonable period and in accordance with applicable law.