Privacy Policy

1. Who we are

Gnosis Partners (Gnosis, we, us) is a UAE organisation.

Gnosis is the controller of the personal data described in this policy. It decides why and how that data is processed.

2. Scope of this policy

This policy applies to personal data we process when you:

• visit this website;
• submit the Contact Us form or otherwise contact us;
• hold an account on, or use, the Allocator IQ (AIQ) platform;
• take part in an introduction, meeting or event arranged by Gnosis.

Our services are directed to institutional allocators and professional investors. They are not directed to individuals acting in a personal capacity as retail investors, or to persons under 18.

Managers and partners we introduce operate their own privacy policies. Those policies govern their use of your data.

3. Data we collect

Data you provide

• Contact Us form: name, work email, telephone number, organisation, role, allocator type, jurisdiction, areas of interest and any message you send.
• Professional profile: mandate focus, asset classes of interest, indicative allocation range and investor classification.
• Account data: login email, credentials (stored in hashed form) and multi-factor authentication settings.
• Correspondence: emails, meeting notes and call records with our team.
• Eligibility and compliance data: information needed to confirm professional or institutional status and to meet sanctions, anti-money laundering or licensing obligations.

Data collected when you use the platform

• Log-in times, session duration and access logs.
• Pages, programs and manager profiles viewed; searches, filters, saved screens and watchlists.
• Reports and factsheets generated or downloaded.
• Queries submitted to AIQ analytical tools.

Technical data

• IP address, browser type, device type, operating system and approximate location derived from the IP address.
• Cookie and similar identifiers (see Cookies and analytics).

Data from other sources

We may obtain business contact details from your organisation, public regulatory registers, company websites and professional databases. We do not seek special category data, such as health or religious information. Please do not send it to us.

4. Purposes and legal bases

We process personal data only where a lawful basis applies. The table sets out each purpose and the basis we rely on under the GDPR, where it applies.

Where UAE law applies, we process personal data with your consent or under a ground permitted by that law, such as performance of a contract or compliance with a legal obligation.

AIQ applies automated and AI-assisted analysis to manager and program data. We do not use it to make decisions about individuals that produce legal or similarly significant effects.

You may opt out of marketing communications at any time by using the unsubscribe link or through the Contact Us form.

5. Sharing your data

We do not sell personal data. We share it only as described below.

• Service providers: hosting and cloud infrastructure, email delivery, customer relationship management, analytics, security and IT support, and professional advisers. Each acts under written contract and on our instructions.
• Introduced counterparties: managers, allocators and partners in private markets, venture capital, art or Broadway production opportunities. We share your details with them only after you have given consent for that specific introduction, and we limit the data to what the introduction requires.
• Authorities: regulators, courts, law enforcement or tax authorities where the law requires it or to protect our legal rights.
• Corporate transactions: a buyer or successor in a merger, acquisition or reorganisation, subject to confidentiality and to this policy.

6. International transfers

Our service providers and introduced counterparties may be located outside the UAE, the European Economic Area or the United Kingdom. Where we transfer personal data across borders, we use a safeguard recognised by the applicable law, such as:

• a destination recognised as providing adequate protection;
• standard contractual clauses approved by the relevant authority;
• your explicit consent, where the law permits it as a transfer ground.

You may request details of the safeguard used for a given transfer through the Contact Us form.

7. Retention

We keep personal data only for as long as the purpose requires, or longer where the law obliges us to.

• Contact Us form submissions that do not lead to an account: 12 months from submission.
• Account and platform usage data: for the life of the account and 6 years after closure.
• Security and access logs: 24 months.
• Marketing preferences: until you opt out, then a suppression record to honour that choice.
• Compliance and eligibility records: for the period set by applicable law or licence conditions.

At the end of the period we delete the data or anonymise it so it no longer identifies you.

8. Security

We apply technical and organisational measures appropriate to the risk, including:

• encryption of data in transit (TLS) and at rest where supported by our providers;
• role-based access controls and multi-factor authentication for platform accounts;
• activity logging and monitoring;
• due diligence and contractual controls on service providers;
• staff confidentiality obligations.

No system is fully secure. If a personal data breach occurs, we will notify the relevant authority and affected individuals where the law requires it.

9. Cookies and analytics

Cookies are small files stored on your device. We use the following categories.

We do not use advertising or cross-site tracking cookies. You may change your choices through the cookie banner or your browser settings. Blocking strictly necessary cookies may prevent the platform from working.

10. Your rights

Depending on the law that applies to you, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• request erasure;
• restrict or object to processing, including processing for direct marketing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting processing carried out before withdrawal;
• not be subject to a decision based solely on automated processing that significantly affects you.

UAE. These rights arise under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).

EEA and United Kingdom. Where the EU GDPR or UK GDPR applies to our processing, you hold the rights set out in those laws.

To exercise a right, contact us through the Contact Us form. We may ask you to verify your identity. We aim to respond within one month, or within any shorter period set by law.

You may also complain to a supervisory authority, including the UAE Data Office or the authority in your country of residence or work.

11. Changes to this policy

We may update this policy to reflect changes in law, our services or our processing. We will post the revised version on this page with a new effective date. Where a change materially affects you, we will notify registered users by email or through the platform before it takes effect.