GFH Shareholder Privacy Notice

GFH Financial Group B.S.C. (hereafter referred to as “we” “our” “us” or “GFH””) respects your right to data privacy. This privacy notice explains how we collect, share and use your personal information as a shareholder of GFH. We are committed to protecting your privacy and complying with applicable data protection laws and principles, including Personal Data Protection Law No. (30) of 2018.

1. What Personal Information Do We Collect and How?

We collect personal information that identifies you or relates to you as a shareholder of GFH, such as your name, contact details, nationality, identification documents, shareholding details, communication records, bank account details, and any other information you provide to us either voluntarily or at our request.

We either collect this information directly from you when you subscribe as a shareholder, communicate with us, attend our general assembly meetings, or participate in any other activities related to your shareholding, or we collect your personal information from third-party sources, such as your brokers/custodians or agents trading GFH shares.

We do not collect or process any sensitive personal information of our shareholders.

2. Why Do We Use Your Personal Information and On What Legal Basis?

We only process your personal information if we have a lawful basis for doing so, such as your consent, our contractual or legal obligations, or our legitimate interests. In particular, we process your personal information for the following purposes:

To fulfil our legal and regulatory obligations as a company, such as paying you dividends, providing you with information about GFH such as annual reports, financial statements, and general meetings, reporting to the Ministry of Industry & Commerce and other authorities, cooperating with audits or investigations, or responding to requests from regulators or law enforcement agencies.
To maintain and manage our relationship with you as a shareholder, such as to communicate with you, answer your questions, and enable you to exercise your rights as a shareholder, such as the right to vote at shareholder meetings.
To pursue our legitimate interests in developing and growing our business, such as entering into or maintaining business partnerships or other strategic alliances, or exploring or executing potential or actual transactions, and managing our operations and investor relations.
To protect and enforce our rights and interests, such as defending or pursuing legal claims that may arise in relation to your shareholding in GFH.
To send you marketing communications, such as newsletters, updates, or invitations to events, that you have requested or consented to receive from us. You can opt out of receiving such communications at any time by using the unsubscribe link in our communications.

We may also use your personal information for other purposes that we notify you of at the time of collection or that are compatible with the purposes described above.

3. Who Do We Share Your Personal Information With?

We may share your personal information with the following categories of recipients for the purposes described above:

Our Group Company who may use your personal information for the same purposes as we do, in which case we will require those entities to honour this privacy notice. ‘Group Company’ includes any entity that directly or indirectly controls, or is controlled by, or is under common control with GFH.
Our business partners and joint venture partners, who are third parties with whom we have a contractual or strategic relationship to provide or receive products or services, or to pursue common business objectives.
Our trusted service providers who manage our share register, or provide us with IT, cloud hosting, payment processing, legal, consultancy, accounting or auditing services.
Our regulators, auditors, government bodies, law enforcement agencies, and other applicable authorities who may request or require your personal information for legal or administrative purposes, such as tax, anti-money laundering, due diligence or sanctions compliance, or for the prevention or detection of crime.
Other third parties who have a legitimate interest in your personal information in connection with any merger, acquisition, sale, or transfer of some or all of our assets, such as potential or actual buyers, sellers, investors, or regulators involved in the relevant transaction(s). We disclose your personal information to such third parties only when necessary to protect our business interest and subject to appropriate safeguards.

We require all third parties to respect the confidentiality and security of your personal information and to use it only for lawful purposes. Taking into account the sensitivity of the data and other factors, we always ensure that data recipients handle the data in an appropriate manner.

4. Do We Transfer Your Personal Information Outside The Kingdom of Bahrain?

Some of our external third parties and businesses within our Group Company are based outside the Kingdom of Bahrain and so their processing of your personal information will involve a transfer of personal information outside the Kingdom. Whenever we transfer your personal information out of the Kingdom, we ensure a similar degree of protection is afforded to it. We will only transfer your personal information outside the Kingdom where the recipient country has been deemed to provide an adequate level of protection for personal information by the applicable Personal Data Protection Authority, or if the transfer is otherwise permitted by law.

Please contact us if you want further information on how we transfer your personal information out of the Kingdom.

A list of third countries and international organisation to which personal information may be transferred can be made available by contacting our Data Protection Officer at dpo@gfh.com.

5. What Are Your Rights Regarding Your Personal Information?

You have the following rights, subject to certain conditions, regarding your personal information:

To request access to your personal information and obtain a copy of it.
To correct or update your personal information or restrict its processing if it is inaccurate or incomplete.
To request the deletion of your personal information unless we have a legal reason to keep it.
To object to the processing of your personal information, where we process it based on legitimate interests.
To withdraw your consent to the processing of your personal information, where we rely on your consent as a legal basis for the processing. This will not affect the lawfulness of any processing carried out before you withdraw your consent.
To lodge a complaint with the Personal Data Protection Authority, if you believe that we have violated your rights or the applicable laws and regulations regarding your personal information.

To exercise any of these rights, please contact us using the details under section 9 below.

6. How Do We Keep Your Personal Information Secure?

We have implemented appropriate technical and organisational measures to prevent accidental loss or unauthorised access to your personal information. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal information. We limit access to your personal information to those employees, agents, contractors, and other third parties who have a business need to know. They are subject to a duty of confidentiality and must only use your personal information in accordance with our instructions and applicable data protection laws.

7. How Long Do We Keep Your Personal Information?

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected and to comply with our legal and regulatory obligations. The retention period may vary depending on the type and nature of the personal information, the purpose and legal basis of the use, and the applicable legal, regulatory, accounting or other similar requirements. We review our retention policies regularly and securely delete or anonymise your information when it is no longer needed.

8. Changes To This Privacy Notice

We may update this data privacy notice from time to time in response to emerging legal, technical, contractual, regulatory or business developments. When we update our data privacy notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material privacy notice changes if and where this is required by applicable laws.

9. How Can You Contact Us?

If you have any questions or requests regarding this notice or your personal information, you can contact our Data Protection Officer at:

Email: dpo@gfh.com

Address: GFH House, Bahrain Financial Harbour, Manama, Kingdom of Bahrain

Phone: +973 17538538