General Privacy Notice – DZ Advisory Ltd

1. Introduction

This Privacy Notice is related to DZ Advisory Ltd. having its registered address at Quad Central, Q3 Level 10, Central Business District, CBD 1040, Malta, ( ‘Company’, ‘we’, ‘us’, ‘our’). We are committed to safeguarding the privacy of our clients using our services (‘user’, or ‘you’, ‘your’).

This Privacy Notice explains how we collect, use, disclose, and safeguard and treat your personal information when you are seeking to become a client, and/or you are a client of the Company, whether through an ongoing business relationship or an occasional transaction (each and collectively, the ”Services”).

By utilising, or receiving, the Services, you agree with the terms of this Privacy Notice. By providing us with your personal information, you acknowledge the Company processing your personal information in accordance with this Privacy Notice and applicable EU laws and regulations.

2. Personal Information

Each and all of the following strands of information and documentation as we may collate and process shall, for the purposes of this Privacy Notice, each and collectively are referred to as the “Information”.

We may collect, store, process and use the following kinds of Information:

i. Personal Details

Personal details as per our ‘Know Your Customer’ (KYC) forms and/or through our centralised KYC Portal system. Details will include your name, surname, address, identification details, date of birth, and nationality; the Services for which you have or will engage the Company to provide you with and similar or related information.

We will keep a copy of the Information and corresponding documentation, including your identification documents and proof of address to honour our statutory obligations under the 4th and 5th AML Directives.


ii. Searches and Checks

We will carry out name checks, google searches and passport checks on you, and we shall retain documentation generated pursuant to such checks and searches, which you understand we are required to perform to ensure that in our practices we prevent fraud, money laundering, funding of terrorism, financial crime or any other type of crime, in line with the 4th and 5th AML Directives and the internal risk-based policy of the Company. You acknowledge that the Company carries out the aforementioned screening practices when the relationship with the client (even when prospective) has initiated and additionally on an ongoing basis at such intervals as the Company at its discretion decides, so as to adhere to the said risk-based approach.

iii. Political Exposure

The Company additionally keeps records as to your political exposure including by the recording of declarations submitted by you, confirming or otherwise that you are a “Politically Exposed Person”, and documented searches via open sources and through our name screening platforms as the Company shall perform.

iv. Risk Classification

We shall use your Information to perform, in a manual or automated manner, a risk classification/profiling which would classify you as ‘low risk’, ‘medium risk’ or ‘high risk’ in order to honour our obligations under the 4th and 5th AML Directives. Such classification will affect the level of ongoing monitoring we perform on you and/or the level of documentation we request. You may request further information on how such risk classification is performed by contacting the Data Protection Officer on info@dzmalta.com or by calling us on +356 2144 0099.

v. Correspondence

We will retain a copy of your communication with us, such as emails and letters, in line with our legal obligations under the 4th and 5th AML Directives or pursuant to a legitimate interest.

vi. Video and Imagery

We may request a video conference call through our centralised KYC Portal. Should you accept to provide us with such a call, we shall record and hold a video and sound recording of the video conference in line with our AML/CFT obligations and internal retention policy found in the Data Protection Policy of the Company. We may also take screen shots of such video conference to fulfil our obligations under the 4th and 5th AML Directives. The video call will examine your facial features and perform a facial recognition test on you. Such facial recognition test will then compare your features through the video conference to those on your identification document.

vii. Wealth

We may also process and hold information about your wealth, such as the value of your assets, details of bank accounts, inheritance information, employment-related information and documentation and other information as relates to your global net worth. We shall collate and use such Information in line with our AML/CFT obligations, on a risk-sensitive basis, depending on the Service for which you seek to engage the Company to provide you with and proportionate to the value the Company seeks to achieve from a ML/FT risk-mitigation perspective.

viii. Other

We shall process and retain certain declarations that we may ask you to provide, including the ‘Client Onboarding Questionnaire’ or an equivalent document, in line with our legal obligations.
We may hold and process any other information or documentation we request from you whether in physical or digital format, in line with our legal obligations and our internal risk-based approach policy.


3. Consent-based processing

We shall require your consent in the following circumstances:

• When sending you direct marketing material or promotions regarding our services, unless there is a clear and tested legitimate interest for you to receive such material;
• When sharing your Information outside the Company, unless we are required to do so by law such as providing information to police, court of law or a competent authority. Provided that we share your Information outside the Company without your consent limitedly to when we are sharing it with our processors to help us provide you with the Services; and
• When processing your Information without having one of the other legal basis found in Section 4.

• Contractual obligation or necessity;
• Legal obligation;
• Member-state law;
• Vital interest of the data subject;
• When processing the Information is in the best interest of the public; and
• Legitimate interest.

• To the extent that we are required to do so by law;
• In connection with any ongoing or prospective legal proceedings;
• In order to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk);
• To any person who we reasonably believe may apply to a court or other competent authority for disclosure of that Information where, in our reasonable opinion, such court or authority would be reasonably likely to order disclosure of that Information;
• To any of our employees, officers, insurers, professional advisers, bankers, agents, suppliers, IT service providers or subcontractors insofar as reasonably necessary for the purposes set out in this notice (also known as Processors and sub-processors);
• To any member of our group of companies (this means our subsidiaries, our ultimate holding company and all its subsidiaries from time to time) insofar as reasonably necessary for the purposes set out in this notice. If the Company is merged, acquired, or sold, or in the event of a transfer of some, or all, of our assets or equity, we may disclose or transfer Information and usage data in connection with such transaction;
• In all other circumstances where you would have given your consent.

• The Police;
• Court of Law, Magistrates and Court experts;
• Malta Financial Services Authority (MFSA);
• The Financial Intelligence Analysis Unit (FIAU) and/or
• The Commissioner for Data Protection.

• Physical files which may be held under lock and key in our office;
• On servers and back-up servers hosted with PC Gen [www.pcgen.mt] – which are the Group’s outsourced IT support; and
• On cloud facilities located within the European Union.

• Ensuring that the Information is safeguarded by the use of firewalls, encryptions, access restrictions and/or passwords;
• Ensuring that the Information is accessible only to individuals within the Company who require to access to the Information in order to perform their duties related to the provision of the Services;
• Ensuring that appropriate backups are taken to prevent the Information from being lost; and

• Physical files shall be destroyed by means of shredding. Shredding services may be outsourced to third parties and in such cases the Company shall review their data privacy procedures and safeguard the interest of the data subjects through ways and means such as through a contractual agreement between DZ Advisory as data controller and the shredding company as data processors in line with Article 28 of the General Data Protection Regulation. For the removal of any doubt, this would only apply if DZ Advisory provides non-shredded Information to the shredding service provider. If shredding is done in-house, then the shredding service provider will not be considered as a data processor.
• In the case of Information stored in digital format, such Information shall be permanently deleted. This would include any backups held on servers and/or cloud.
• Communication between the client and the Company shall be deleted or destroyed.