Review draft — prepared on the assumption that Romooz is based in DIFC. Entity details, operating practices, and legal review must be completed before public launch.
01Scope and responsibility
This notice covers the informational Romooz website and business enquiries sent to its contact address. It does not cover investor onboarding, identity checks, payment processing, or the operation of an investment platform. Those activities need their own notices. This draft uses Romooz as the business name and assumes DIFC establishment; the legal entity and registered contact details must be confirmed before public launch.
02Information involved
If you email us, your message can contain your name, email address, role, company, contact details, and any information you choose to provide. Website delivery and security can involve technical data such as IP address, browser details, request time, and requested pages, processed by hosting or access providers. Your chosen theme is saved locally in your browser when storage is available.
03Purposes and legal grounds
Business contact details and messages are used to respond to requests, arrange demonstrations, and discuss potential services. The legal ground will depend on the interaction: steps requested before a contract, legitimate interests in handling business enquiries where those interests are not overridden by your rights, or a legal obligation. Where consent is required, it must be obtained and can be withdrawn. An enquiry is not consent to unrelated marketing.
04Recipients and external services
Information may be handled by email, hosting, security, and technical service providers needed to deliver the website and respond to enquiries. Where the private preview uses ChatGPT sign-in, the access provider also handles account and authentication information under its own privacy notice. Information may be disclosed where legally required or necessary to establish or defend legal claims. The production provider list must be confirmed before launch.
05International transfers
Email or website providers may process information outside the DIFC. A production data-flow review must identify the countries and recipients involved, and establish the applicable adequacy decision, contractual safeguards, or other permitted transfer mechanism before transfers take place. This notice does not promise that data stays in the UAE. Contact us for details of safeguards applicable to your information.
06Retention and security
Enquiry information should be kept only as long as needed to handle the enquiry, manage a resulting business relationship, meet legal obligations, or address claims, then deleted or anonymised. Specific retention periods and provider log retention must be confirmed for launch. Appropriate access controls and security measures are required; no internet transmission is completely risk-free. Avoid sending sensitive documents in an initial enquiry.
07Your choices and rights
Subject to the applicable conditions in DIFC Data Protection Law No. 5 of 2020, as amended, rights can include access, correction, erasure, restriction, portability, objection, withdrawal of consent, and protections relating to automated decisions. This website does not implement automated decisions about investment eligibility. Send requests to info@amerny.com. We may need proportionate information to verify your identity and will handle requests within the applicable statutory period.
08Complaints
You can contact us about a concern without giving up your right to complain to the DIFC Commissioner of Data Protection ↗. The Commissioner’s official website explains how to raise a data protection complaint.
09Browser storage and children
See our Cookies & Storage notice for the locally saved theme setting and information about hosting cookies. This website is intended for business audiences, not children; do not submit children’s information through a demo enquiry.
10Updates and contact
Changes will be reflected in the date shown on this page. Privacy enquiries and rights requests can be sent to info@amerny.com. The contact is a general privacy contact, not a representation that a statutory Data Protection Officer has been appointed.