We are Ras Al Khaimah National Insurance Company PSC (RAKINSURANCE), part of the RAKBANK Group, a group of entities that includes RAKBANK, Protego, RAKINSURANCE and any subsidiary or affiliate of RAKBANK, and we provide certain insurance services to you. To learn more about us, please visit our website. We are committed to protecting the privacy of the individuals we encounter in conducting our business. We aim to handle Personal Data responsibly, balancing the benefits of activities like research and data analytics with our other commitments, including transparency and non-discrimination.

In this Privacy Notice, the words “RAKINSURANCE”, "we", "us", "our" or any of their derivatives refer to the RAKINSURANCE and its successors and any novatee, assignee, transferee, or purchaser of the RAKINSURANCE’s rights and/or obligations hereunder and any reference to RAKINSURANCE includes a reference to such successor, novatee, assignee, transferee or purchaser. The words "you", "your", "yours" or any of their derivatives refer to the person using our services, accessing our website, or otherwise providing information to or communicating with us and shall include, as the context may require, successors and assigns (as the case may be). RAKINSURANCE is the Data Controller for interactions covered under this Notice and is responsible for determining how your Personal Data is collected, processed, and protected. Please read this Notice carefully. All enquiries or concerns regarding this Notice should be directed to RAKINSURANCE using [email protected].

This Privacy Notice (“Notice”) describes how we collect, process, and protect your Personal Data when you interact with us. The categories of Personal Data we collect about you and how we process such data depends on the nature of our relationship with you and the means through which we interact, including through our website or mobile applications. Please read this Notice carefully. All enquiries regarding this Notice should be directed to us using the Contact details provided.

This Notice sets out detailed information regarding how we hold and process Personal Data relating to visitors to our website, external job candidates, contractors, nominees, attendees of and/or participants in events and programs operated by RAKINSURANCE, and other third parties including but not limited to, actual and prospective clients, goods and service providers, partners, shareholder nominees, regulatory officials, and journalists.

Any third-party websites which you may access via our websites are not covered by this Notice. RAKINSURANCE accepts no responsibility or liability for the use and protection of any Personal Data which you provide to such third-party websites. You should exercise caution and read the privacy Notice of the relevant third party before providing any Personal Data.

This Notice aligns with our obligations under applicable laws and regulations including, but not limited to, the Central Bank Consumer Protection Regulation and Standards (Circular No. 8 of 2020), the Federal-Decree Law No. 45 of 2021 regarding the Protection of Personal Data (“UAE Federal Data Protection Law”), Federal Decree‑Law No. 6 of 2025 on Insurance Activities, Federal Law No. 2 of 2019 Concerning the Use of Information and Communication Technology in Health Fields and the Abu Dhabi Healthcare Information and Cyber Security (ADHICS) Standards. These, together with other applicable laws are collectively referred to in this Notice as “Applicable Laws”. 

Unless stated otherwise, terms used in this Notice will have the meaning given to them under the UAE Federal Data Protection Law. For ease of reference, the following definitions used throughout this Notice are highlighted:

Personal Data is any information relating to an identified natural person or to a natural person who can be identified, directly or indirectly, by reference to an identifier such as a name, voice, image, an identification number, an online identifier, location data or to one or more factors specific to the physical, physiological, economic, cultural, or social identity of that natural person. It includes sensitive personal data and biometric data.

Data Subject is a natural person to whom the personal data relates to.

Sensitive Data is any information that reveals, either directly or indirectly, a natural person's family, racial origin, political, philosophical, or religious beliefs, criminal records, biometric data, or any information concerning the health of such person, including the physical, psychological, mental, genetic, or sexual status of such person, including the provision of health care services, which reveals information about his or her health status.

Processing is any operation performed on Personal Data, whether manually or by automatic means, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, alignment, combination, restriction, erasure, or destruction.

We collect different categories of Personal Data about you (including individuals associated with you, all of whom are referred to as “you” in this Privacy Notice). This collection is carried out in accordance with this Notice and depends on the nature of our relationship with you and the purposes for which such data is necessary.

We may use your Personal Data for different business purposes and rely on varying legal bases, depending on our relationship with you. We do not process your Personal Data for purposes incompatible with those notified to you in this Notice. RAKINSURANCE processes Personal Data only for the purposes stated and in reliance upon the lawful bases detailed in the table below, subject to Applicable Laws.

Please note that in certain circumstances such as when you have entered or are proposing to enter into a contract with us (e.g. to provide us/you with products and/or services), the provision of Personal Data is a requirement of the contract you entered/are proposing to enter into with us. The provision of Personal Data in these circumstances is necessary to enable us to perform pre-contractual steps at your request, to enter into the contract with you, and/or to perform our legal obligations under our contract with you.

We may process your Personal Data to send you marketing communications about our products and services via email, SMS, telephone, or through our digital platforms.

We will only send direct marketing communications or share your Personal Data with authorised third parties for marketing purposes where we have obtained your consent, in accordance with Applicable Laws. You have the right to withdraw your consent at any time.

You may also, at any time, object to receive marketing information from us. If you wish to do so, please click on the “Unsubscribe” option available on all marketing/newsletter communications that you may receive from us or contact our Data Protection Officer (see the contact details provided below).

We may use automated processing, including profiling from time to time. If we make decisions based solely on automated processing that have legal consequences or significantly affect you, we will inform you in advance, and you will have the right to object to such decisions.

However, you may not object to automated decisions in the following cases:

• The automated processing is necessary for fulfilling a contract between you and RAKINSURANCE.
• The automated processing is required by applicable laws in the UAE.
• You have provided prior consent for the automated processing.

Additionally, you have the right to request human intervention in the review of any automated decisions that affect you.

The Personal Data has/or will be obtained from the following sources, as applicable.

• Direct Collection. We collect Personal Data that you provide to us directly when you initiate contact with us, including to use our Products and Services.
• Publicly Available Information. Where applicable, we may collect Personal Data that has previously been made publicly available by an act of the Data Subject.
• Third-Party Collection. We collect Personal Data about you from third parties such as credit bureaus, credit reporting agencies, recruitment agencies, background check providers, authentication service providers, vendor partners, insurance and reinsurance providers, healthcare providers, medical or health professionals, or law enforcement authorities. You should liaise directly with the third parties concerned should you wish that they refrain from disclosing data to us. You may also exercise your data protection rights in connection with data that has already been disclosed to us by contacting us.
• Automated Collection. We also collect and may permit third parties to collect Personal Data about you automatically through the use of cookies and similar tracking technologies on our website. For more information, please refer to our Cookies Notice.

We are subject to strict confidentiality obligations regarding any data or information relating to insured persons or beneficiaries. We will only disclose such data where permitted under the Applicable Laws.

We may disclose your Personal Data in accordance with the purposes and legal bases set out in this Notice, including to: 

• With Our Group and Affiliates. We may share your Personal Data within RAKBANK Group and affiliated companies, for the purposes, and using the legal bases, set out in this Notice.
• Third-Party Goods and Service Providers, Partners, and Other Companies. We may share your Personal Data with third parties either working on our behalf or on behalf of whom we work in order to facilitate our interactions with you or request or support our relationship with you such as external auditors, legal counsel, cloud storage providers, IT service providers, insurers, reinsurers, loss adjustors, healthcare providers.
• Government and Regulatory Authorities, Law enforcement and other government agencies. We may share your Personal Data to comply with legal or regulatory requirements, to enforce or apply our Terms and Conditions and other agreements, and to protect our rights, property, and the safety of our employees, customers, and third parties.
• Companies Involved in a Corporate Transaction With Us. If we sell some or all of our assets, merge, or are acquired by another entity or otherwise restructure our business, including through a sale or in connection with a bankruptcy, we will share your Personal Data with that entity.
• Other Third Parties with Your Consent: We may disclose your Personal Data to other parties not listed above when you have given your consent.

RAKINSURANCE has implemented technological and organizational security measures, policies and procedures designed to protect your Personal Data against accidental or unlawful loss, disclosure, misuse, alteration, or use. This includes the deployment of encryption and other technical measures to help preserve the confidentiality and integrity of the Personal Data you share with us.

Your data will be stored and maintained within the UAE, with a secure backup in a separate location, as required by applicable laws. Access to your Personal Data is restricted to RAKINSURANCE employees and third parties on a business need to know basis. They will only process your Personal Data upon our instructions, and they are subject to a duty of confidentiality.

We have implemented procedures to respond appropriately to any suspected Personal Data breach or security incident and will notify you and relevant regulatory authorities where we are legally required to do so.

We may access or transfer your Personal Data outside the UAE for one or more of the limited Purposes set out above. In doing so, we will comply with the Applicable Laws. If we transfer your Personal Data to a country outside the UAE, we will ensure that appropriate safeguards are in place.

You can contact us using the contact details provided below for further details of the safeguards we put in place. We implement appropriate technical and organizational measures to ensure that any processing of your Personal Data is undertaken securely and in compliance with the UAE Data Protection Laws. This includes encrypting all Personal Data stored outside the UAE, both whilst in transit and also whilst in storage.

Your Personal Data is retained as long as the purpose for which it was collected remains and any other secondary purposes that are compatible with the original purposes of processing Personal Data set out in this Notice and, in line with legal, regulatory, and legitimate business requirements, or to comply with any Applicable Laws. This means that we will normally retain your Personal Data for the duration of your relationship with us plus the length of any applicable statutory limitation or obligation, as required or permitted by applicable data protection laws. Upon reaching the end of the relevant retention period, RAKINSURANCE will take steps to dispose of your Personal Data in a secure and permanent manner, in accordance with applicable data protection laws.

Under the UAE Federal Data Protection Law you have a number of key rights as a data subject:

• Right to Request Access: you may request access to your Personal Data that we hold.
• Right to Rectification: the right to request the rectification of any inaccurate or incomplete Personal Data we hold.
• Right of Erasure: the right to request the erasure of Personal Data if it is no longer needed for the purposes collected and there is no compelling reason for its continued processing.
• Right to Restrict the Processing: the right to request the restriction or suppression of the processing of your Personal Data.
• Right to Object: you have the right to object to the processing of your Personal Data on reasonable grounds except where the processing of your Personal Data is being undertaken in relation to the performance of a task carried out in the public interest or in the exercise of any official authority vested in us or where the processing is necessary for the purposes of our or a third party’s legitimate interests.
• Right to Data Portability: you have the right to receive Personal Data you have provided to us in a structured, commonly used and machine-readable format in the circumstances where we have processed your Personal Data in relation to the Services we provided to you and that processing has been carried out by automated means.
• Right to Object To Automated Decision Making: in the circumstances where we are undertaking automated decision making in relation to you, you have the right to object to any decision based solely on such automated processing which produces legal consequences or otherwise seriously impacts you. You have the right, in such circumstances to have the decision reviewed manually.
• Right to Withdraw Consent: the right to withdraw consent previously provided for RAKBANK to process your Personal Data at any time.

You also have the right to lodge a complaint with the data protection authority should your matter remain unsettled or otherwise unsatisfied with our response.

If you would like to exercise any of your rights in relation to your Personal Data, please complete and submit our Data Subject Request Form. This form can be accessed [here]. Completed forms should be sent to our Data Protection Officer (contact details below).

Please note that these rights are not absolute and there may be circumstances where we may legitimately deny a request as permitted by law. You will not normally have to pay a fee to exercise any of your rights, although we may charge a reasonable fee if your request is repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of the other rights stated above). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response. We will only collect strictly necessary information to ensure that we only honour requests received from the true Data Subject or their authorised representative. We aim to respond to all legitimate requests within one (1) month of receipt, though more complex requests may require an extension of up to two (2) months. If this occurs, we will notify you of the delay and reasons.

RAKINSURANCE Services are not directed to individuals under the age of eighteen (18). We request that individuals under the age of eighteen (18) not to provide Personal Data through these services.

We may revise this Notice at any time. Any Notice revisions will be effective upon posting to the website. You should review this Notice, each time you visit the website or the services, to inform yourself of any revisions. Your continued use of the website will constitute your acceptance of the Notice as revised.

This Notice is effective as of [28/01/2026].

If you have any questions about how we handle user data and Personal Data, or you wish to exercise your data protection rights, please contact the Data Protection Officer via email at [email protected]