Privacy Policy

How KOLL collects, uses, stores and protects personal data, and how you can exercise your rights.

Last updated 8 August 2026

1. Who we are

This website, koll.ae, is operated by KOLL Group, a wholly owned subsidiary of ITSEC L.L.C FZ. Our registered office is Onyx Tower, Floor 1105, The Greens, Dubai, United Arab Emirates. In this policy, KOLL, we, us and our refer to KOLL Group.

We are the controller of the personal data described in this policy. If you have any question about how we handle personal data, contact us at info@koll.ae.

2. Scope of this policy

This policy applies to personal data we collect through this website, through enquiry and contact forms, through our scheduling service at cal.koll.ae, and through correspondence with us by email, telephone or messaging applications. It does not apply to third-party websites we link to, which have their own privacy policies.

3. Personal data we collect

We collect the following categories of personal data:

• Contact details you give us: name, business email address, telephone number, company name and job title.
• Enquiry content: the information you choose to include when you describe your business, your intended regulated activities or your licensing objectives.
• Scheduling data: the date, time and details of any consultation you book with us.
• Technical data: IP address, browser type, device type, referring page and pages viewed, collected through standard web server logs and any analytics tools in use.
• Correspondence: records of your communications with us and our responses.

We do not seek sensitive personal data through this website. Please do not send us sensitive personal data, or confidential information belonging to a third party, through a web form.

4. How we collect personal data

We collect personal data directly from you when you complete a form, book a consultation, message us on WhatsApp, email us or call us. We also collect technical data automatically when you visit the site. Where you are introduced to us by a partner or adviser, we may receive your contact details from them.

5. Why we use personal data

We use personal data to:

• respond to your enquiry and provide the information you have requested;
• arrange, hold and follow up consultations;
• scope, propose, deliver and administer our advisory services;
• carry out client due diligence, including identity verification and screening, where we are required or entitled to do so;
• operate, secure, maintain and improve this website;
• send you information about our services where you have asked to receive it or where we are otherwise permitted to do so;
• comply with our legal, regulatory and professional obligations, and to establish, exercise or defend legal claims.

6. Our lawful basis

We process personal data where doing so is necessary to take steps at your request before entering into a contract, or to perform a contract with you; where it is necessary for our legitimate interests in operating and marketing a professional advisory business, provided those interests are not overridden by your rights; where it is necessary for compliance with a legal or regulatory obligation to which we are subject; and where you have given consent, which you may withdraw at any time.

7. Who we share personal data with

We do not sell personal data. We share it only as follows:

• Within our group: with our parent company ITSEC L.L.C FZ and affiliated entities, where relevant to delivering or supporting our services.
• Service providers: hosting, website, scheduling, email, customer relationship management, screening and IT security providers acting on our instructions.
• Professional advisers: lawyers, auditors and other advisers, where engaged in connection with a matter.
• Regulators and authorities: where we are required to disclose information by law, regulation, court order or a competent authority.
• Corporate transactions: with a counterparty and its advisers in connection with a reorganisation, merger or sale of our business.

8. International transfers

Some of our service providers are located outside the United Arab Emirates. Where personal data is transferred outside the UAE, we take steps intended to ensure it remains protected to a standard consistent with applicable UAE data protection law, including by entering into appropriate contractual protections with the recipient.

9. How long we keep personal data

We keep personal data only for as long as we need it for the purposes described in this policy. Enquiries that do not lead to an engagement are held for a limited period and then deleted or anonymised. Where we act for a client, we retain engagement records for the period required by applicable law, regulation and professional obligation, and for as long as necessary to establish, exercise or defend legal claims.

10. Security

We apply technical and organisational measures intended to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These include access controls, encryption in transit, and security testing. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your rights

Subject to the conditions and exceptions set out in applicable UAE data protection law, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, you may have the right to:

• be informed about how we process your personal data;
• request access to the personal data we hold about you;
• request correction of inaccurate or incomplete personal data;
• request deletion of your personal data in certain circumstances;
• request restriction of, or object to, certain processing;
• request transfer of your personal data to you or another controller in a structured, machine-readable format;
• withdraw consent where our processing is based on consent;
• object to decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise any of these rights, contact us at info@koll.ae. We may need to verify your identity before responding. You may also have the right to complain to the competent UAE data protection authority.

12. Cookies and similar technologies

This website uses cookies and similar technologies that are necessary for the site to function, and may use analytics cookies that help us understand how the site is used. You can control cookies through your browser settings. Disabling cookies may affect how parts of the site work.

13. Children

This website is directed at businesses and professionals. It is not intended for children, and we do not knowingly collect personal data from children.

14. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or in applicable law. The date at the top of this page shows when it was last updated. Where changes are material, we will take reasonable steps to bring them to your attention.