PRIVACY NOTICE

Scope and controller

This notice explains how personal data is handled when you visit this website, make an enquiry, participate in a meeting or engage with Grossman Risk&Capital. The legal entity identified as service provider in an engagement letter is the controller for data processed in connection with that mandate. For pre-engagement website enquiries, the business operating this website acts as controller.

Grossman Risk&Capital is a trading name used for advisory communications. The applicable contracting entity, governing terms and controller contact details are confirmed before a mandate begins.

Data we may receive

• Identity and contact details, professional role, organisation and preferred communication channel.
• Enquiry information, jurisdictions, meeting requirements, commercial context and correspondence.
• Information supplied under an engagement where it is relevant, lawful and proportionate to the agreed purpose.
• Technical and security information that hosting providers may process, such as IP address, browser type, timestamps and request logs.
• Information required to verify and manage a privacy request, complaint, conflict check or legal obligation.

Do not send sensitive material initially

The Private Intake form sends the information you enter to the designated Grossman Risk&Capital mailbox through a specialist form-delivery provider. The website does not store the form contents in a website database. Do not include identity documents, financial records, special-category data, privileged material, passwords, private keys or restricted case files in an initial enquiry. A suitable channel and handling protocol should be agreed first.

Purposes and legal bases

• To respond to an enquiry and take requested steps before a contract is entered into.
• To perform an agreed mandate and manage the professional relationship.
• To conduct proportionate conflict, integrity, sanctions, anti-money laundering and security checks where required or justified.
• To protect legitimate business interests, systems, rights and legal claims, balanced against the rights of affected individuals.
• To comply with applicable law, professional obligations, court orders and valid regulatory requests.
• Where consent is the appropriate basis, for the specific purpose described when consent is requested.

Data sources and fairness

Personal data may come directly from you, from a client or authorised representative, from professional advisers, from public or licensed sources, or from service providers engaged for a defined purpose. A client or third party providing personal data must have a lawful basis to do so. Information is assessed in context and is not treated as conclusive merely because it is available.

Sharing and processors

Data is shared only where necessary for the stated purpose, the mandate or a legal obligation. Recipients may include authorised personnel, vetted local specialists, professional advisers, hosting and security providers, and competent public authorities responding to a valid request. Appropriate confidentiality, access and purpose controls are applied according to the context.

We do not sell personal data or exchange it for targeted advertising value.

International transfers

Cross-border matters may require information to be accessed or processed in more than one jurisdiction. Before a transfer, the purpose, necessity, destination and applicable legal restrictions are considered. Where required, recognised safeguards such as adequacy decisions, contractual protections or another lawful transfer mechanism are used.

Retention

Unsuccessful or inactive initial enquiries are normally retained for no longer than 24 months unless a shorter period is appropriate or a longer period is required for legal, security, conflict or claims purposes. Client and mandate records are retained under the applicable engagement terms, legal requirements and documented need. Data is deleted, anonymised or securely restricted when it is no longer required.

Security and confidentiality

We use proportionate technical and organisational measures, including need-to-know access, channel selection, data minimisation and controlled disclosure. No internet transmission or storage method is risk-free. Confidentiality or privilege does not arise solely because an enquiry is sent; any specific protection must be confirmed in writing.

Your rights

Rights vary by jurisdiction and may be limited by confidentiality, legal privilege, the rights of others, prevention or detection obligations, legal claims or other statutory exemptions. Identity and authority may be verified before a request is actioned.

• Request access to, correction of or deletion of personal data.
• Request restriction, object to certain processing or request portability where applicable.
• Withdraw consent for future processing where consent is the legal basis.
• Ask for information about applicable transfer safeguards.
• Complain to the relevant supervisory authority or seek another remedy available under applicable law.

Children and automated decisions

This website and the advisory services are intended for business users aged 18 or over. We do not knowingly solicit children's data through this website. Website enquiries are not subject to solely automated decisions producing legal or similarly significant effects.

Applicable frameworks and updates

This notice is designed with regard to internationally recognised privacy principles and, where applicable, the EU GDPR, UK GDPR, the UAE Federal Personal Data Protection Law, DIFC Data Protection Law and other governing privacy rules. Applicability depends on the controller, data subject, processing activity and jurisdiction.

This notice may be updated to reflect operational, legal or technical change. The revision date at the top identifies the current version.