Privacy Policy of Eona

1. Who is responsible for your data

Controller. Bullion Link Trading – FZCO, DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, United Arab Emirates. Trade Licence No. 53684, issued by the Dubai Integrated Economic Zones Authority (DIEZ). We decide how and why your personal data is processed.

Data Protection Officer. Our Data Protection Officer is Pieter Arie Borsje. You can contact the Data Protection Officer at privacy@eona.ae about any question or request relating to your personal data.

2. The personal data we collect

3. Why we use your data and our lawful basis

We use your personal data only for the purposes below. The PDPL allows processing with your consent, or without consent where one of the cases in the PDPL applies, such as performing our contract with you, meeting a legal obligation, or establishing or defending legal claims.

Service messages, such as order confirmations, invoices, security alerts and notices of changes to our Terms, are part of the service and are not marketing.

4. Biometric data

Biometric data is sensitive personal data. Before your identity check, we ask for your explicit consent through a separate checkbox that is not ticked in advance. Your face scan and liveness data are processed by our verification provider, Sumsub, on our behalf, outside the UAE (see section 7).

We use biometric data only to verify your identity and to prevent fraud. We do not use it for any other purpose.

You may withdraw your consent at any time by writing to privacy@eona.ae. Withdrawal does not affect processing already carried out. Because UAE anti-money-laundering law requires us to verify your identity, we cannot open or continue your account without a completed verification, and we must keep verification records for the period in section 8.

5. Automated decisions

Our onboarding and monitoring systems use automated screening for money-laundering, sanctions and fraud risk. The results may lead to a delay in onboarding for manual review, a request for more information, a hold on a transaction, or restriction of your account. A person on our compliance team reviews any decision to refuse or close an account.

Where an automated decision has a significant effect on you, you can ask for it to be reviewed by a person, give your point of view and contest it, within the limits set by anti-money-laundering law. We may be required by law to share information with competent authorities without telling you.

6. Who we share your data with

We do not sell your personal data. We share it only as described below.

6.1 Our service providers (processors)

6.2 Other recipients

• Loomis (Dubai, United Arab Emirates): our vault operator. It receives bar allocation records. Loomis receives only a pseudonymous client reference, not your identity data.
• Our bank in the UAE: receives and makes payments; receives your name, bank details, payment amounts and references.
• Authorities: the UAE Financial Intelligence Unit (including through goAML), the UAE Ministry of Economy and Tourism, the Executive Office for Control and Non-Proliferation, the Federal Tax Authority, courts and other competent authorities, where the law requires it.
• Professional advisers: auditors, lawyers and compliance consultants, under duties of confidentiality.

We have written agreements with our processors requiring them to process your data only on our instructions, keep it confidential and protect it. An up-to-date list of processors is available from privacy@eona.ae.

7. Transfers outside the UAE

Some of our processors store or access data outside the UAE, as shown in section 6.1. We transfer personal data outside the UAE only on a basis permitted by the PDPL:

• to a country with an adequate level of data protection, where that applies; or
• otherwise, under one of the other grounds the PDPL permits, namely:
  • a written agreement with the recipient requiring it to apply standards of protection equivalent to the PDPL (such as data processing agreements and standard contractual clauses);
  • where the transfer is necessary to perform our contract with you; or
  • your express consent, such as the consent you give for biometric verification.

You can ask privacy@eona.ae for more information about the safeguards for a particular transfer.

8. How long we keep your data

We keep personal data only as long as we need it for the purposes in section 3, or as the law requires.

The 5-year anti-money-laundering period runs from the latest of the end of the relationship, the closure of the account, the completion of the transaction, the completion of an inspection or investigation by a competent authority, or the date of a final court judgment (Cabinet Resolution No. 134 of 2025, Article 25). Identity documents, facial images and liveness data are held by Sumsub under its data processing agreement with us, for as long as required for verification and our legal record-keeping obligations (at least 5 years after our relationship ends).

At the end of the retention period we delete or anonymise the data.

9. Your rights

Under the PDPL you have the right to:

• be informed about how we process your data;
• access your data and receive a copy;
• have your data transferred to you or to another controller in a structured, machine-readable format;
• have inaccurate data corrected and incomplete data completed;
• have your data erased when it is no longer needed;
• restrict our processing in certain cases;
• stop or object to processing, including processing for marketing and analytics;
• withdraw any consent you have given, at any time, without affecting processing already carried out;
• object to decisions based solely on automated processing that have significant effects on you.

Limits. Some rights are limited where we must keep or process data under UAE law. In particular, we cannot erase data that anti-money-laundering law requires us to keep, and we cannot disclose information where the law prohibits it.

How to use your rights. Write to privacy@eona.ae or use the Support Centre. We may need to verify your identity before acting on your request. We respond within one month of receiving your request. If a request is complex, we may extend this period by up to one further month, and we will tell you why within the first month. We do not charge for requests unless they are clearly unfounded or excessive.

If you live outside the UAE. If the data protection law of your country also applies to our processing, such as the EU or UK General Data Protection Regulation or the Australian Privacy Act 1988, you have the rights that law gives you, and you may complain to your local data protection authority. Contact privacy@eona.ae to use those rights.

10. Complaints

If you are unhappy with how we handle your personal data, please contact our Data Protection Officer at privacy@eona.ae first. We will answer within one month.

You also have the right to complain to the UAE Data Office, the federal authority responsible for personal data protection.

11. Cookies and analytics

We use strictly necessary cookies to run eona.ae and the app, for example to keep you signed in. We use Google Analytics cookies and identifiers only if you accept them in our cookie banner. Until you accept, no analytics data is collected. When you are signed in and have accepted analytics, we send Google a pseudonymous account identifier (not your name or email address). You can change your choice at any time through "Cookie settings" at the bottom of every page. See our Cookie Notice for details.

12. Marketing

We send marketing messages only if you opt in. You can opt out at any time, free of charge, through the unsubscribe link in every marketing email or in your account settings. We then stop processing your data for marketing.

13. Security

We use technical and organisational measures appropriate to the risk, including:

• encryption of data in transit and at rest;
• role-based, least-privilege access control, and database access rules that restrict each user to their own data;
• two-factor authentication;
• separate production and development environments;
• logging of staff access and periodic access reviews;
• monitoring for unusual or suspicious activity;
• regular security testing.

14. Personal data breaches

If a breach of security affects your personal data, we will:

• contain it and investigate it immediately;
• notify the UAE Data Office as soon as we become aware of it, as the PDPL requires, stating the nature and cause of the breach, the approximate number of people and records affected, the likely consequences, the measures taken, and the contact details of our Data Protection Officer;
• tell you without undue delay where the breach may affect your privacy, confidentiality or security, with the steps you can take to protect yourself;
• notify any other authority where another law requires it;
• keep a record of every breach and the action taken.

15. Children

Our services are only for people aged 18 or older. We do not knowingly collect personal data from anyone under 18. If we learn that we have done so, we will delete the data without delay, unless the law requires us to keep it.

16. Changes to this Policy

We will tell you about material changes to this Policy by email and in the platform at least 30 days before they take effect, unless a change is required by law sooner. If a change requires your consent, we will ask for it and will not rely on the change until you give it.

17. Language

This Policy is provided in Arabic and English. For consumers, the Arabic text is available and prevails where required by law.

18. Contact us

Data Protection Officer: Pieter Arie Borsje
Email: privacy@eona.ae
Post: Data Protection Officer, Bullion Link Trading – FZCO, DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, United Arab Emirates
Telephone: +971 54 777 1050