Privacy Notice
This notice explains how CWB collects and uses personal data about people who visit our website, contact us, work with us as clients or suppliers, apply to join us, or raise a concern through our speak-up channel. It also explains your rights and how to exercise them.
Who we are
CWB is an international intellectual property services group. For the purposes of this notice, two companies registered in Abu Dhabi Global Market (ADGM) are joint controllers of your personal data:
- CWB Limited (registration number 000005290, registered office at Level 16, Al Khatem Tower, Abu Dhabi Global Market Square, Al Maryah Island, Abu Dhabi, United Arab Emirates), which provides our services and is your main point of contact for data about clients, matters, suppliers and IP service providers; and
- CWB Group Holdings Ltd (registration number 000009034, registered office at Suite 115, 5th Floor, Tamouh Tower, Tamouh, Abu Dhabi, Al Reem Island, United Arab Emirates), which leads on group governance and oversight of data protection
(together, "CWB", "we", "us" or "our").
They have agreed between them how they share responsibility for complying with data protection law, including responding to your requests and providing this notice. Whatever that arrangement says, you can exercise your rights against either of them. Other CWB group companies in the countries where we operate may also process your data, as explained below.
We comply with the ADGM Data Protection Regulations 2021 and, where they apply, the data protection laws of the other countries where we operate.
Our Data Protection Officer
We have an appointed Data Protection Officer (DPO), who acts independently and is your contact for any question about this notice or how we handle your data. You can reach the DPO through our Data Privacy and Protection Matters contact on our Contact us page.
What personal data we collect
| Who you are | What we may collect |
|---|---|
| Website visitors and enquirers | Name, email address, phone number, company, job title and anything you include in your message. |
| Clients and client contacts | Contact and business details of client representatives, applicants, inventors, signatories and others named in instructions; information in powers of attorney, filings and correspondence; billing and payment details. |
| Client due diligence (KYC) | Identity and ownership information, including names, dates of birth, nationality, addresses, passport or ID details, beneficial ownership records, and sanctions and adverse-media screening results. |
| Suppliers, agents and IP service providers | Contact details, ownership and control information, due diligence and screening records, contract and payment details. |
| Job applicants | Resumes, contact details, employment and education history, references and interview notes. |
| Speak-up reports | Information about the person reporting (unless anonymous), the people involved, the concern raised and how it was handled. |
We usually collect this data from you directly. We may also receive it from your employer or colleagues, from clients instructing us, from IP offices and public registers, from screening and due diligence providers, and from referees.
Some of this data may be sensitive, for example criminal-offence or sanctions data revealed by screening. We process it only where the law allows, with additional safeguards.
Why we use your data and our legal basis
| Purpose | Legal basis |
|---|---|
| Responding to enquiries and keeping in touch with business contacts | Our legitimate interests in running and developing our business |
| Taking instructions, providing our services and managing client relationships | Performance of a contract, or our legitimate interests where the contract is with your organisation |
| Client and supplier due diligence, anti-money laundering and sanctions checks | Legal obligation, and our legitimate interests in preventing financial crime |
| Engaging and paying suppliers, agents and IP service providers | Performance of a contract and our legitimate interests |
| Assessing job applications | Steps taken at your request before entering a contract, and our legitimate interests in recruiting |
| Handling speak-up reports and investigations | Legal obligation and our legitimate interests in preventing and addressing wrongdoing |
| Billing, accounting, tax and record-keeping | Legal obligation and performance of a contract |
| Establishing, exercising or defending legal claims and responding to regulators | Legal obligation and our legitimate interests |
| Sending updates or event invitations you have asked for | Consent, which you can withdraw at any time |
Where we rely on legitimate interests, we have weighed those interests against yours. You can ask us for more detail.
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
Who we share your data with
We share personal data only where needed for the purposes above, and only with:
- other CWB group companies that help deliver our services or support our operations;
- IP offices, courts and other authorities where filing, prosecution or enforcement requires it;
- foreign associates, agents and translators working on your matter;
- service providers who process data on our behalf, such as technology, hosting, screening and payment providers, under written contracts requiring them to protect it and use it only on our instructions;
- professional advisers, auditors and insurers; and
- regulators, law enforcement or other public authorities where the law requires it.
We don't sell personal data.
International transfers
We operate across the Middle East and North Africa, Sub-Saharan Africa, Emerging Europe and Eurasia, so your data may be transferred outside ADGM. Where a country isn't recognised as providing adequate protection, we use appropriate safeguards. Transfers within the CWB group are covered by our Binding Corporate Rules, which bind every group company and give you enforceable rights. Transfers to third parties are covered by standard data protection clauses or another approved safeguard. You can ask the DPO for details of the safeguards that apply.
How long we keep your data
We keep personal data only for as long as we need it for the purpose it was collected, then delete or anonymise it securely. How long that is depends on the type of data and our legal obligations. For example, client and matter records are kept for the life of the matter and the period required by law and professional rules, and due diligence records for the period required by anti-money laundering law. We may keep data longer where it's needed for a legal claim, investigation or regulatory requirement.
How we protect your data
We use technical and organisational measures appropriate to the risk, including access controls, encryption, approved systems and staff training. Access to personal data is limited to people who need it for their role and who are bound by confidentiality.
Your rights
Subject to some legal exceptions, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to how we use it, including use based on our legitimate interests;
- receive your data in a portable format;
- withdraw consent where we rely on it, without affecting anything done before; and
- not be subject to a decision based solely on automated processing that significantly affects you.
To exercise any of these rights, contact the DPO. We'll respond without undue delay and within two months, which we may extend by one further month for complex or numerous requests. If so, we'll tell you within the first two months. We don't charge a fee unless a request is manifestly unreasonable or excessive. We may need to verify your identity before responding.
Complaints
If you're unhappy with how we've handled your data, please contact the DPO first so we can try to put it right. You also have the right to complain to the Commissioner of Data Protection at the ADGM Office of Data Protection, or to the data protection authority in the country where you live or work.
Cookies
The Website doesn't use cookies or similar technologies such as tracking pixels or local storage. If this changes, we'll update this notice and, where required, ask for your consent before setting any non-essential cookies.
Changes to this notice
We may update this notice from time to time. The latest version will always be on this page, with the date it was last updated.
Last updated: 18 October 2026