Data Privacy Policy

1. Introduction

Your privacy matters to us. This Data Privacy Policy (the "Policy") explains how Rain MENA FZE (the "Company", "we", "us", or "our") collects, uses, stores, shares, and protects your personal data when you:

• access or use our website or associated pages (the "Site");
• engage with us to use our products or services (the "Services");
• register, use, or engage with our platform or download our mobile application to make use of our Services (the "Platform");
• interact with us as part of our providing Services to third parties; or
• apply to work with us.

We are committed to protecting your information in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021 — "PDPL") and the VARA Rulebooks, including obligations relating to AML/CFT, technology, custody, and market conduct.

2. Purpose of this Policy

This Policy sets out our approach to any personal data we may collect from you or may have obtained from any relevant third parties, and the reasons for which we process your personal data in accordance with the data protection laws of the UAE, the Rulebooks issued by the Virtual Assets Regulatory Authority ("VARA"), and our internal Data Privacy Policy. Specifically, this Policy sets out:

• the categories of personal data we collect;
• the purposes for which we process your information;
• the lawful bases we rely on;
• how long we retain your information;
• with whom we may share your information; and
• your rights under applicable laws.

3. About Rain MENA FZE

Rain MENA FZE is incorporated in the United Arab Emirates and is licensed by VARA and complies with all applicable data privacy laws in the UAE, including the UAE Federal Decree-Law No. 45 of 2021 ("PDPL") on the Protection of Personal Data, its executive regulations and other regulatory requirements as may be imposed by the UAE Data Office from time to time, and the relevant Rulebooks issued by VARA.

We are subject to oversight by VARA and comply with all applicable UAE laws, including the PDPL, AML/CFT regulations, and relevant technology and cybersecurity standards.

A Data Privacy Officer ("DPO") has been appointed to oversee compliance, ensure accountability, and promote a culture of privacy across the organization. The DPO is responsible for privacy and compliance matters.

4. Personal Data We Collect

Depending on your interaction with us, including when you visit our Site or contact us, we may collect personal data across the following categories and in relation to the following groups:

4.1 Visitors to the Site or Platform

• Name, job title, and company; contact information (email, phone, social media handle).
• Demographic information such as address, preferences, and interests.
• Technical identifiers such as IP address, browser type, and cookies.
• Technical information, including the Internet Protocol (IP) address used to connect a computer to the Internet, login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, how often one uses the application, and other performance data.
• Usage data, including the full Uniform Resource Locators (URL), clickstream to, through and from our Site (including date and time), products viewed or searched for, page response times, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page.

4.2 Clients and Prospective Clients

• Identity and contact information.
• Full name and job title; contact information and demographic data, including but not limited to your phone number, email address, address, preferences, and where you work.
• Payment details.
• Know Your Customer ("KYC") and Anti-Money Laundering ("AML") information, including source of funds/wealth, identification documents, sanctions/PEP screening results.
• Information required as part of our KYC/AML procedures, including but not limited to source of funds, source of wealth, and PEP declaration statements.
• Information provided during onboarding or transactions.
• Financial information, including financial institution, account type, account number, profession and source of income, and account activity.
• Any other information that may be relevant for us to provide our Services.

4.3 Third Parties Linked to Clients

• Information about officers, beneficial owners, counterparties, advisors, or other individuals whose personal data is provided to us in connection with Services.

4.4 Recruitment Applicants

• CVs, education and employment history; contact details.
• Any diversity or health information you voluntarily provide (processed only with explicit consent or as permitted by law).

5. How We Use Your Personal Data

We process personal data for the following purposes:

• Regulatory and Compliance: to perform AML/CFT checks, sanctions screening, ongoing monitoring, and reporting suspicious transactions to the UAE Financial Intelligence Unit ("FIU") or VARA.
• Identity Verification and Onboarding: to onboard and verify you.
• Service Delivery: to verify identity, execute client instructions, manage relationships, and deliver Services.
• Legal Obligations: to comply with our legal obligations imposed by relevant authorities and regulators.
• Business Operations: to enforce contracts, protect rights and property, and ensure security of systems.
• System and Platform Improvement: to improve the performance of our Website, App, and/or Services.
• Recruitment: to assess applications and comply with equal opportunity obligations.
• Marketing: to send marketing communications (only with your consent).
• Analytics: to understand how users interact with our Site and improve Services.

6. Legal Basis for Processing

We only process personal data where permitted under applicable laws. We rely on the following lawful bases under the PDPL:

• Consent: where you have provided consent (e.g., for marketing, or processing sensitive data).
• Contractual Necessity: to perform Services you have requested.
• Legal Obligation: to comply with AML/CFT, sanctions, tax, and other regulatory requirements.
• Legitimate Interests: to improve our services, maintain security, and protect our rights.

7. Sharing Your Personal Data

We may share your information with:

• Regulators and Authorities: including VARA, the UAE Data Office, the FIU, courts, and law enforcement.
• Professional Advisers: such as lawyers, auditors, or consultants.
• Custodians and Banking Partners: only VARA-regulated custodians and UAE-licensed banks.
• Technology and Service Providers: for hosting, analytics, IT support, and data storage. such as KYC platforms and IT systems.
• Third Parties in Client Matters: such as arbitrators, experts, or counterparties.
• Corporate Transaction Counterparties: other parties in connection with corporate transactions or dispute resolution.
• Government Bodies or Law Enforcement: when we are legally required to do so.

All third parties are subject to due diligence and contractual obligations to apply equivalent standards of data protection and confidentiality. All third-party personal data sharing is governed by appropriate legal and contractual safeguards.

8. International Data Transfers

Personal data may be stored in the UAE or transferred abroad under safeguards consistent with the PDPL. Where necessary, we transfer data outside the UAE in compliance with PDPL Articles 22–24 and VARA Rule II.B.2 of the Technology & Information Rulebook, using safeguards such as adequacy decisions or data processing agreements, or any other safeguards that may be implemented under applicable rules, laws, or rulebooks from time to time.

Where personal data is transferred outside the UAE, our DPO is informed and appropriate controls are implemented to ensure that the level of protection afforded to your data is not diminished.

9. Data Retention

KYC, client due diligence and transaction records, and other AML/CFT records, are retained for a minimum of eight (8) years following the end of the business relationship or the date of the relevant transaction, in line with the Record Keeping requirements under the AML/CFT Part of VARA's Compliance and Risk Management Rulebook and the applicable UAE Federal AML/CFT laws. This period may be extended where we are required to retain the data for a longer period by applicable law or by direction of a competent UAE authority.

Other personal data is retained only for as long as necessary for the purposes for which it was collected and to meet applicable legal, regulatory or contractual obligations. The following retention periods and criteria apply:

Where no specific period is prescribed above, we determine the retention period by reference to: the purpose for which the data was collected and whether that purpose remains active; any legal, regulatory or contractual obligation requiring retention; the applicable limitation periods for legal claims; and any direction from a regulator or authority. At the end of the applicable period, personal data is securely deleted or irreversibly anonymised.

Our data retention practices are consistent with the principle that personal data should be retained only for as long as it is required to fulfil its intended purpose and to meet legal, regulatory or contractual obligations.

10. Data Security

Personal data must be safeguarded using technical and organizational measures to prevent unauthorized access, disclosure, alteration, or destruction. We apply technical and organizational security measures in accordance with the VARA Technology & Information Rulebook and Article 5 of the PDPL.

These measures include, but are not limited to: encryption of data in transit and at rest; role-based access controls; regular penetration testing and cybersecurity monitoring; business continuity and disaster recovery planning; and mandatory staff training on AML/CFT and data protection.

These controls are aligned with the VARA Technology and Information Rulebook.

Internally, data is protected by strong passwords that are changed regularly and never shared between employees; data is only stored on designated drives and servers and uploaded only to approved cloud computing services. Strong passwords and multi-factor authentication must be used and are never shared.

11. Your Rights Relating to Your Personal Data

Under the PDPL and applicable laws, you have the right to:

• access your personal data;
• rectify your personal data;
• request erasure of your personal data;
• restrict the processing of your personal data;
• request our assistance with the portability of your personal data;
• object to the processing of your personal data;
• withdraw consent relating to your personal data; and
• lodge a complaint with any data protection supervisory authority in the UAE, including the UAE Data Office.

We will respond to rights requests within 30 days, subject to legal and regulatory limitations (e.g., AML/CFT requirements).

Your rights may be limited or restricted in certain circumstances, including but not limited to, if we are instructed by a regulator or authority to do so.

To exercise your rights, please contact us using the details set out in Section 15 of this Policy.

12. Subject Access Requests

All individuals who are the subject of personal data held by us are entitled to: ask what information we hold about them and why; ask how to gain access to it; be informed how to keep it up to date; and be informed how we are meeting our data protection obligations.

Subject access requests from individuals should be made by email, addressed to the data controller at dataprivacy@rain.com. The DPO will always verify the identity of anyone making a subject access request before handing over any information.

13. Data Breach Notification

In the event of a personal data breach that may impact confidentiality or integrity, we will:

• notify the UAE Data Office and VARA without undue delay;
• notify affected individuals where required; and
• take immediate steps to mitigate risks.

In accordance with our obligations under the VARA Technology & Information Rulebook, VARA will be notified within 24 hours following notification to either any data regulator (including in the UAE) or a Data Subject of any incident affecting, or potentially affecting, Personal Data. A copy of the relevant report will be provided to the regulatory bodies, unless or to the extent prohibited by applicable law.

14. Cookies and Tracking Technologies

We use cookies, log files, and similar technologies to track usage of our Site. You may manage your cookie settings at any time.

15. Third-Party Links

Our Website may include links to third-party websites. We are not responsible for their privacy practices or content. We encourage you to review the privacy policies of any third-party websites you visit.

16. Changes to This Policy

We review this Privacy Policy regularly and may update it to reflect changes in law, the VARA Rulebooks, or our practices. Any material changes will be communicated via this Site or directly where appropriate. We will notify you of material changes when appropriate.

17. Contact Us

If you have any questions about this Policy, wish to exercise your rights, or wish to raise a concern, please contact our Data Protection Officer at:

Email Address - ahmed.tarradah@rain.com

Alternatively, for subject access requests, please email: dataprivacy@rain.com 

This Policy should be read alongside any other notices provided to you at the point of collecting your personal data.