NABRELLegal
Privacy Policy
SUMMARY
We collect only the personal data we need to respond to you, manage business relationships, meet our legal and regulatory obligations and run this website. We do not sell personal data. Part A applies to everyone. Part B is the privacy notice for investors, prospective investors and counterparties. Part C gives information for specific regions. You can contact us about your data at privacy@nabrel.com.
Part A — General Privacy Policy
1. Who we are
Nabrel Limited (company no. 17164581), Office 308, Unit 5, 399–405 Oxford Street, Mayfair, London, W1C 2BU, United Kingdom, and Nabrel L.L.C-FZ (no. 2650462.01), Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E. (together, “Nabrel”, “we”, “us” or “our”) are joint controllers of the personal data described in this policy. We have agreed between us how we meet our data protection obligations, and you may exercise your rights against either of us.
Our Legal & Compliance function oversees data protection. All privacy questions and requests should be sent to privacy@nabrel.com.
2. Scope of this policy
This policy applies to personal data we collect:
through nabrel.com (the “Website”), including the contact form;
by email, telephone, video call, post and other correspondence;
when you meet us or attend our events; and
when we deal with advisers, service providers, counterparties, intermediaries and prospective investors in the ordinary course of business.
Part B applies in addition to people connected with investors and prospective investors. Part C gives further information for particular regions. If this policy and Part B or C differ, the more specific part applies.
3. Personal data we collect
| Category | What it includes |
|---|---|
| Contact and enquiry data | Name, job title, organisation, email address, phone number, country, and the content of your messages when you use the contact form, email us, attend a meeting or event, or request materials. |
| Investor eligibility data | Your investor category, country of residence and the capacity in which you act, where we ask you to confirm them before providing materials. |
| Business contact data | Details of people at advisers, service providers, counterparties, intermediaries and other organisations we deal with, including their roles and professional background. |
| Onboarding and compliance data | Identity, due diligence, source-of-funds and source-of-wealth information, and the results of sanctions, politically exposed person (“PEP”) and adverse-media screening. See Part B. This is collected through separate forms and documents, not through the Website. |
| Criminal offence data | Information about alleged or proven offences that arises in screening. We handle this only where the law allows and for compliance and crime-prevention purposes. |
| Technical data | IP address, browser type and version, device information, operating system, pages visited, time spent, referring site and approximate location, collected through cookies and similar technologies and in server logs. |
| Marketing and communications data | Your preferences about hearing from us, and records of what we have sent you and how you responded. |
| Social media data | Information you make available to us when you interact with our pages on platforms such as LinkedIn. |
Where we get it
We collect personal data from you directly; from your organisation or advisers; from public sources such as company registers, sanctions lists and news; from screening and verification providers; and from introducers and intermediaries who refer you to us. We do not ask for, and ask you not to send us through the Website, information about your health, beliefs, trade-union membership or other special categories of personal data.
4. How and why we use your data
We use personal data only where we have a lawful basis to do so. The table shows the main purposes and the legal bases we rely on under the UK GDPR, which are also those we rely on under the EU GDPR where it applies.
| Purpose | Legal basis |
|---|---|
| Responding to enquiries and requests, and deciding whether and how to engage | Legitimate interests (running our business and responding to you); steps taken at your request before entering a contract |
| Checking investor eligibility before we provide materials | Legitimate interests (making sure we communicate only with permitted recipients); legal obligation |
| Onboarding, due diligence, AML/KYC, sanctions and fraud checks | Legal obligation; legitimate interests (preventing financial crime and protecting our business) |
| Managing relationships with investors, advisers, service providers and partners | Contract; legitimate interests |
| Operating, securing and improving the Website, including analytics | Consent for analytics cookies; legitimate interests for security, operation and fault-finding |
| Sending updates or communications about Nabrel | Consent, or legitimate interests where the law permits it for business contacts (you can opt out at any time) |
| Maintaining records, internal reporting, audit and good governance | Legitimate interests; legal obligation |
| Establishing, exercising or defending legal claims, responding to regulators and courts | Legal obligation; legitimate interests |
| Corporate transactions such as a financing, reorganisation or sale | Legitimate interests |
Where we rely on legitimate interests, we have considered the impact on you and do not use your data in ways that override your rights and freedoms. You can ask us for details of that assessment. Where we rely on consent, you can withdraw it at any time. Where UAE law applies, we process personal data under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”) on the corresponding lawful grounds, including consent, performance of a contract, legal obligation and legitimate interests.
5. Marketing and communications
We send updates about Nabrel only to people who have asked for them or, for business contacts, where the law allows. Every marketing message includes a way to opt out, and you can also write to privacy@nabrel.com at any time. If you opt out, we keep a record of that request so that we do not contact you again. We do not buy marketing lists.
We may also publish content and interact with you on LinkedIn. When you interact with our pages, the platform provider handles your data under its own privacy policy and, in some cases, as a joint controller with us. Any advertising or measurement tools from LinkedIn that use cookies on our Website are used only with your consent (see our Cookie Policy).
6. Who we share your data with
We do not sell personal data, and we do not share it for third-party advertising. We may share it with:
| Recipient | Why |
|---|---|
| Our affiliates in the Nabrel group | To run the group, manage relationships and meet legal duties |
| Professional advisers, fund administrators, auditors, banks, insurers and other service providers | To provide services to us or to a Nabrel-sponsored vehicle, under confidentiality and data protection obligations |
| Placement agents and other intermediaries | Where you are introduced to or by them, and only as needed for that purpose |
| Screening, verification and compliance providers | To carry out checks required for onboarding and compliance |
| Technology providers acting as our processors | To host the Website, run our email and productivity systems, and analyse Website use (see “Our systems and providers”) |
| Regulators, courts, tax authorities and law enforcement | Where required or permitted by law, or to establish, exercise or defend legal claims |
| A prospective buyer, investor or partner | In connection with a corporate transaction, subject to confidentiality |
Where a recipient acts only on our instructions, it is our processor and is bound by a written contract. Where a recipient decides for itself how to use your data, it is a separate controller and will have its own privacy notice.
7. Our systems and providers
- Website hosting: the Website is hosted by Namecheap, Inc., a United States company, which operates data centres in the United States, the United Kingdom, the Netherlands and Singapore. Our Website is hosted in Website and admin: Vercel, functions in London
- Database: Neon, AWS Europe West 2 (London)
- Images and CVs: Cloudinary.
- Email and productivity: we use Microsoft 365 for email, calendars and file storage. Microsoft processes data on our behalf under its commercial terms and data protection addendum.
- Contact form: messages sent through the contact form are received in our internal systems and are accessible only to authorised people at Nabrel.
- Analytics: we use Google Analytics, set only with your consent (see our Cookie Policy).
- LinkedIn: we may maintain a LinkedIn page and, in future, use its measurement tools with your consent.
8. International transfers
We operate in the United Kingdom and the United Arab Emirates, so your data may be transferred between and processed in those countries. Some of our providers, including our hosting, email and analytics providers, may also process data in the United States, the European Economic Area, Singapore and elsewhere.
Where personal data is transferred out of the UK or the EEA to a country that has not been recognised as providing an adequate level of protection, we make sure it is protected by a permitted mechanism. These include adequacy regulations or decisions (including the UK–US data bridge and the EU–US Data Privacy Framework where the recipient participates), standard contractual clauses, the UK International Data Transfer Agreement or Addendum, and, in limited cases, a statutory exception such as your explicit consent or the need to perform a contract with you or at your request. For transfers out of the UAE, we rely on the mechanisms permitted by the PDPL. You can ask for more information about the safeguards we use at privacy@nabrel.com.
9. How long we keep your data
We keep personal data only for as long as needed for the purposes above and to meet legal, regulatory, tax and accounting requirements. In general:
| Type of data | Retention |
|---|---|
| Enquiries and general correspondence | 24 months from our last contact |
| Meeting notes, event attendee lists and call records | 24 months from the event or last contact, unless they form part of an investor record |
| Investor onboarding, AML, KYC, tax-reporting and related records | At least five years after the relationship ends, or longer where law or regulation requires |
| Records of complaints and requests under this policy | Six years from closure |
| Marketing preferences and opt-out records | Until you ask us to delete them (we keep opt-out records so that we can honour your request) |
| Website analytics data | Up to 14 months |
| Server and security logs | Up to 12 months |
| Records needed for legal claims or regulatory matters | For as long as the matter or limitation period requires |
When we no longer need personal data, we delete or anonymise it. Backups are overwritten in the ordinary course.
10. Your rights
Depending on where you are, you may have the right to:
access your personal data and receive a copy;
have inaccurate or incomplete data corrected;
request erasure of your data, or restriction of its use;
object to processing based on legitimate interests, or to direct marketing at any time;
receive your data in a structured, portable format, or ask us to send it to another controller where the law allows;
withdraw consent at any time, without affecting earlier processing; and
not be subject to solely automated decisions with legal or similarly significant effects. We do not make such decisions.
To exercise these rights, contact privacy@nabrel.com. We may need to verify your identity, and may ask for more detail about your request. We will respond within the time limits set by law, which in the UK and EU is normally one month and may be extended by up to two months for complex requests. We do not normally charge a fee. Some rights are subject to legal exceptions, for example where we must keep records to meet anti-money-laundering obligations or to defend legal claims, and we will explain if that applies.
11. Complaints
If you have a concern about how we handle your personal data, please tell us at privacy@nabrel.com with “Data protection complaint” in the subject line. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome and any action we are taking. Our Legal & Compliance function oversees every data protection complaint.
If you are not satisfied, you have the right to complain to the UK Information Commissioner’s Office (ico.org.uk), the UAE Data Office, or the data protection authority in the country where you live or work or where you believe an infringement occurred. We would welcome the chance to resolve your concern first. Complaints that are not about personal data are handled under the complaints policy in our Terms of Use.
12. Cookies and analytics
We use Google Analytics to understand how visitors use the Website. Analytics cookies are set only if you accept them through our cookie banner. Strictly necessary cookies do not need consent. You can change your choice at any time through or your browser settings. Details are in our Cookie Policy.
13. Security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or misuse. These include access controls limited to people who need the data, encrypted connections to the Website, secure email and storage services, confidentiality obligations on staff and advisers, and procedures for responding to incidents. We assess the security of the providers we use.
No transmission over the internet is completely secure, so please avoid sending sensitive information, such as identity documents, by unencrypted email. If a personal data breach affects you and the law requires us to tell you, we will do so without undue delay, and we will report it to the relevant authority where required.
14. Automated decision-making
We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects. Screening tools may flag matches for review, but a person makes the decision.
15. Children
The Website is not intended for anyone under 18, and we do not knowingly collect their personal data. If you believe we have done so, please contact privacy@nabrel.com and we will delete it.
16. Third-party links
The Website may link to other sites and platforms. We are not responsible for their privacy practices, so please read their notices.
17. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date updated above. If we make a material change, we will take reasonable steps to bring it to your attention, for example by a notice on the Website or by email where we have your details.
Part B — Investor and Counterparty Privacy Notice
18. Who this notice is for
This notice applies to prospective and existing investors in Nabrel-sponsored vehicles, and to the individuals connected with them, such as directors, partners, trustees, beneficial owners, controlling persons, authorised signatories and other representatives. It also applies to the individuals at counterparties and intermediaries with whom we carry out transactions. It supplements Part A.
Where an investor is an institution, we receive information about its connected individuals from the institution. If you give us data about another person, please make sure that you are entitled to do so and that you have shown them this notice.
19. Data we collect from investors and counterparties
Identity and contact: name, date and place of birth, nationality, residential and business address, email address, phone number, position and specimen signature.
Identification and verification: copies of passports, national identity cards, proof of address, incorporation and ownership documents, and the results of electronic verification.
Financial and tax: bank account details, tax residence and tax identification numbers, and information needed for the U.S. Foreign Account Tax Compliance Act (“FATCA”) and the OECD Common Reporting Standard (“CRS”).
Source of funds and wealth: information about where an investor’s money comes from and how its wealth was built.
Compliance and screening: results of sanctions, PEP, adverse-media and criminal-record checks where permitted by law, and information about political exposure.
Investment information: investor category, subscription and commitment details, transfers, distributions and correspondence.
Communications: emails, call and meeting notes and other correspondence.
20. Why we use it and our legal bases
| Purpose | Legal basis |
|---|---|
| Assessing and accepting subscriptions, and administering an investor’s interest | Contract; steps taken at the investor’s request; legitimate interests |
| Identity verification, AML/KYC, sanctions and fraud prevention | Legal obligation; legitimate interests; substantial public interest where criminal-offence data are involved and the law allows |
| FATCA, CRS and other tax reporting | Legal obligation |
| Investor reporting, communications and fund administration | Contract; legitimate interests |
| Regulatory, audit and legal compliance, and responding to authorities | Legal obligation; legitimate interests |
| Establishing, exercising or defending legal claims | Legitimate interests; legal obligation |
| Marketing to existing investors and contacts about related products | Legitimate interests where permitted, or consent |
21. Who receives investor data
We share investor and counterparty data with the persons described in Part A. In particular, these may include the fund administrator, the general partner and investment manager of the relevant vehicle, placement agents involved in an investor’s introduction, auditors, legal counsel, banks, custodians, screening providers, and tax and regulatory authorities. Some of these, for example tax authorities, may share information with authorities in other countries under international agreements.
22. Nabrel-sponsored vehicles as separate controllers
A Nabrel-sponsored vehicle, its general partner or its investment manager may itself be a controller of investor data, for example under the Cayman Islands Data Protection Act. If you invest, the Offering Documents will tell you who the controller is, and the vehicle may give you its own privacy notice. That notice applies in addition to this one.
23. Keeping investor data
We keep investor onboarding and related records for at least five years after the relationship ends, or longer where law or regulation requires or where records relate to a continuing claim or tax matter. Your rights, and how to exercise them, are described in Part A.
Part C — Regional Information
24. United Kingdom
Nabrel Limited is established in the UK and is subject to the UK GDPR, the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025) and the Privacy and Electronic Communications Regulations 2003. You may complain to the Information Commissioner’s Office (ico.org.uk).
25. European Union and European Economic Area
Where the EU GDPR applies to our processing, for example when we monitor or offer services to individuals in the EEA, we process personal data in line with it, and the rights in Part A apply. You may complain to the supervisory authority in the member state where you live or work, or where you believe an infringement took place.
26. United States
The Website is not directed at consumers, and we collect personal data only in a business-to-business context. We do not sell personal data or share it for cross-context behavioural advertising, and we have not done so in the preceding twelve months. If you live in a U.S. state with a comprehensive privacy law, such as California, you may have rights to know, access, correct and delete personal data, and not to be discriminated against for exercising them. You can make a request at privacy@nabrel.com. We will verify your identity and respond within the period required by law. You may appeal a refusal by writing to the same address.
27. United Arab Emirates
Nabrel L.L.C-FZ is established in the UAE. We process personal data under the PDPL and, where they apply to us or to a recipient, under the data protection laws of the Dubai International Financial Centre and the Abu Dhabi Global Market. Your rights under those laws include rights of access, portability, correction, erasure, restriction, objection and to stop processing, as applicable. You may complain to the UAE Data Office or the relevant free-zone authority.
28. Middle East and North Africa
If you are in another country in the region, for example Saudi Arabia, Qatar, Bahrain, Kuwait, Oman or Egypt, local personal data protection laws may give you rights similar to those in Part A, including rights to access, correct and delete your data and to object to its use, and may set conditions on transfers of data outside your country. We handle your data in line with the laws that apply to us. You can exercise your rights at privacy@nabrel.com, and may also contact your local regulator.
29. Asia-Pacific
If you are in Singapore, Hong Kong, Australia, Japan, India, China or another country in the region, the data protection laws of that country, such as Singapore’s Personal Data Protection Act, Hong Kong’s Personal Data (Privacy) Ordinance, the Australian Privacy Act 1988, or Japan’s Act on the Protection of Personal Information, may give you rights of access and correction and set conditions on how we use and transfer data. We handle your data in line with the laws that apply to us. You can exercise your rights at privacy@nabrel.com, and may also contact your local regulator.
30. Cayman Islands
Where a Nabrel-sponsored vehicle is established in the Cayman Islands, it may process investor data as a data controller under the Cayman Islands Data Protection Act. Investors have the rights set out in that Act, which the vehicle’s own notice will describe.
31. Contact us
Privacy and data protection: privacy@nabrel.com
Nabrel Limited, Office 308, Unit 5, 399–405 Oxford Street, Mayfair, London, W1C 2BU, United Kingdom
Nabrel L.L.C-FZ, Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.