Privacy Policy & Data Protection.

Who We Are

Citizen Sure ('Citizen Sure', 'we', 'us', 'our') is a company with its registered office in Business Bay, Dubai, United Arab Emirates. Citizen Sure acts as a data controller. The Data Protection Officer is contactable at privacy@citizensure.com.

Definitions

"Personal data" means any information relating to an identified or identifiable living individual. "Processing" means any operation performed on personal data — collection, storage, retrieval, transmission, deletion. "Controller" determines purposes and means of processing; "Processor" processes on behalf of the controller. Citizen Sure acts as Controller in respect of website visitors and prospective clients, and as Controller (or jointly with co-counsel where applicable) for engaged clients.

Information We Collect

We collect information you provide directly: name, email, phone, nationality, country of residence, investment budget, programme interests, and any free-text notes. For engaged clients we collect additional information required by the issuing authority — passport scans, source-of-funds documentation, due-diligence questionnaires, and dependant information where applicable. Technical data (IP, browser, pages visited, referrer) is collected automatically via cookies and analytics — see our Cookie Policy for the full inventory.

How We Use Your Information

We process personal data to: respond to enquiries; prepare and submit applications under engagement; comply with due-diligence and anti-money-laundering obligations; send programme alerts and updates with your consent; improve the Website and its services; and meet our legal and regulatory obligations. We never sell your data. Sharing is limited to: (i) the relevant government authority for the programme you are applying to; (ii) vetted legal counsel, notaries, and translators bound by confidentiality; (iii) infrastructure and email service providers under written data-processing agreements; and (iv) where required by law or court order.

Legal Basis for Processing

We rely on the following lawful bases under applicable data protection law, including the PDPL: (a) contract performance for delivery of advisory services; (b) legitimate interests for responding to enquiries, securing the platform, and pursuing our regular business operations; (c) legal obligation for AML / KYC due diligence and tax-information reporting; (d) consent for marketing communications and non-essential cookies — withdrawable at any time without affecting the lawfulness of prior processing.

Sub-processors and recipients

We use vetted providers under written data processing terms, including: our client management platform (CitizenSure Connect, hosted in the UK and EU); email delivery providers for transactional, alert and newsletter email; Cloudflare for performance, security and bot protection (including Turnstile on our forms); Google Analytics 4 for usage measurement (with consent only); and, with marketing consent only, Google Ads and Meta, which receive hashed (SHA-256) email addresses and phone numbers, advert click identifiers and event references to measure our adverts and build advertising audiences. A current list with locations and safeguards is available on request.

Recognising returning visitors

If you allow analytics or marketing cookies, our server sets a random first-party identifier in your browser (cs_vid, up to 13 months) and records visits to key pages such as programmes, pricing, comparisons, booking and our tools. These records are anonymous until you identify yourself by submitting a form, booking, subscribing, signing in or clicking a link in one of our emails; they are then linked to your record so an adviser can understand your interests. We do not use device fingerprinting.

With marketing consent, and only if you also agreed to marketing emails, we may send a limited number of automated follow-up emails based on your return visits (for example a programme guide, or a reminder to finish booking a consultation). These do not have legal or similarly significant effects, every email can be unsubscribed from in one click, and unsubscribes always take priority. Visit records are deleted 13 months after your last visit. See the Cookie Policy for the full inventory.

International Data Transfers

Citizen Sure operates globally and may transfer personal data to other countries in connection with programme applications and engagement of regional counsel. International transfers are made under Standard Contractual Clauses, adequacy decisions, or equivalent safeguards required by applicable law. A copy of the relevant transfer mechanism is available on request.

Data Retention

Enquiry data is retained for 2 years from last contact, then erased or anonymised. Client engagement data — including AML / KYC records — is retained for 7 years from end of engagement under MLR 2017 obligations. Marketing data is retained until you withdraw consent. Application files held by issuing authorities are governed by that authority's retention policy. Erasure requests are honoured subject to mandatory retention obligations.

Your rights

Under applicable data protection law you have the right to: access your personal data; rectify inaccurate data; erase data (subject to legal retention obligations); restrict processing; object to processing based on legitimate interests and to direct marketing at any time; data portability; and withdraw consent at any time without affecting earlier processing. Access and erasure requests cover your website visit records, cookie choices, follow-up emails and advertising audience entries as well as your enquiries and account. Email privacy@citizensure.com; we respond within one month. You may also lodge a complaint with the competent data protection authority in the United Arab Emirates.

Automated Decision-Making

We do not use automated decision-making with legal or similarly significant effects. Programme-eligibility and due-diligence outcomes are reviewed by named human advisors. Bot-mitigation systems on the Website (rate-limit, captcha) make low-stakes access decisions automatically — these decisions can be challenged by emailing the address above.

Children's Privacy

The Website and Services are intended for adults. We do not knowingly collect personal data from children under 16. Where applications include dependant minors, the personal data of those minors is processed under the contract with the parent or legal guardian and held under the same retention and security safeguards as adult application data.

Marketing Communications

Marketing communications (newsletter, programme alerts) are sent only with your prior opt-in consent. Each email includes a one-click unsubscribe link; preferences are also editable via the link in the footer of any marketing email. Withdrawing marketing consent does not affect transactional or engagement-related communications, which we send under contract performance.

Security

Citizen Sure operates a documented information-security management programme. Personal data is stored on encrypted infrastructure with role-based access control and multi-factor authentication for all data-access roles. Data in transit is protected by TLS 1.3. Backups are encrypted and rotated weekly. We commission annual independent penetration testing and run a continuous security-monitoring stack. All staff handling personal data complete data-protection training on hire and annually thereafter.

Personal Data Breach

In the event of a personal data breach likely to result in a risk to the rights and freedoms of data subjects, we will notify the competent data protection authority in the United Arab Emirates without undue delay in accordance with applicable law and, where the risk is high, communicate with affected data subjects without undue delay. We maintain an internal breach register and conduct post-incident reviews to harden controls.

Cookies and tracking

Strictly necessary cookies are used without consent because the site cannot work without them. Functional, analytics and marketing cookies, the returning visitor identifier and server-side advertising measurement are used only after you opt in through the banner (in the UK, the EEA and Switzerland, nothing optional runs until you choose). You can change or withdraw your choices at any time from Cookie settings at the bottom of every page; withdrawing deletes your visit records. We keep proof of each choice (notice version, categories, time and a scrambled browser identifier).

Changes to this Policy

We may update this policy to reflect changes in law, technology, or our practices. The "Last updated" date reflects the most recent revision. Material changes will be flagged via the consent banner; non-material changes (clarifications, formatting) take effect on publication.

Contact Us About Privacy

For data-protection enquiries, contact privacy@citizensure.com or write to: Data Protection Officer, Citizen Sure, Business Bay, Dubai, United Arab Emirates. We respond to all legitimate requests within 30 days.

Questions about this policy?

Our Data Protection Officer is available to answer any questions about how we handle your personal data.