Since the reports contain personal data, they are handled in accordance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).
In the whistleblowing process, Tabby FZ-LLC may process the following categories of personal data:
The source of this data may include the reporting person, the concerned person, or other legally obtained business information. Any information not meeting the legal requirements shall be discarded and excluded from the fact-finding process.
To manage and resolve whistleblowing reports and identify wrongdoing that may endanger the reputation and operations of Tabby FZ-LLC. Data may also be transferred to authorities upon request or as necessary to protect Tabby FZ-LLC’s interests.
Data processing will be based on the reporting person’s consent (if they disclose their identity). The concerned person’s and any involved person’s data are processed based on the legitimate interest of Tabby FZ-LLC or as necessary to fulfill legal obligations under UAE law. Data may be processed further if required for legal obligations or by order of the UAE Data Office.
The Company may transfer data to judicial, administrative, taxation, customs, or other UAE authorities, regulatory bodies, and legal counsel if necessary to comply with UAE law or defend legal claims.
In cases where personal data must be transferred internationally, the Company will ensure appropriate safeguards are in place in compliance with PDPL guidelines, unless exempted by the regulatory authorities.
Tabby FZ-LLC shall store personal data only as long as necessary to achieve the purposes described above. Following case resolution, all data shall be retained for a period of 5 years from closure, unless a longer period is required by applicable law, necessary for legal compliance, or to defend legal claims.
Tabby FZ-LLC implements appropriate technical and organizational measures, including controlled access, encryption, data minimization, and pseudonymization, to ensure data protection in line with PDPL requirements and to safeguard individuals' rights.
If you have consented to specific data processing, you may withdraw consent at any time by contacting [email protected]. Such withdrawal will not affect the lawfulness of processing before the withdrawal.
In line with PDPL, you have the following rights:
8.1 Right of Access
You may request confirmation of whether Tabby FZ-LLC processes your data, access to such data, and additional information on processing.
8.2 Right to Rectification
You may request updates, rectification, or completion of personal data.
8.3 Right to Erasure
You may request the erasure of personal data unless processing is required by other legal grounds.
8.4 Right to Restriction of Processing
You may request restricted processing under certain conditions, such as data accuracy verification or legal claim defense.
8.5 Right to Object to Processing
You may object to data processing based on legitimate interests unless *Tabby FZ-LLC demonstrates compelling legitimate grounds.
8.6 Right to Data Portability
You may receive your data in a structured, machine-readable format or request direct transmission to another controller if technically feasible.
8.7 Right to Object to Automated Decision-Making
You may request exclusion from automated processing or profiling.
8.8 Exceptions
The data controller may not inform data subjects or other third parties named in a report about processing or the data source. Similarly, the data controller may deny subject rights when they conflict with the purposes of the investigation.
8.9 Protection of the Whistleblower
The identity of the whistleblower remains confidential and is only disclosed to personnel directly involved in investigating and handling the report. However, the identity may be revealed in cases required by UAE authorities or for legal defense, with prior notification to the whistleblower unless this would hinder the investigation.
The Data Controller is Tabby FZ-LLC, located at In5 Tech, Dubai Internet City 1st Floor Dubai AE, United Arab Emirates.
For questions, comments, or to exercise any data protection rights, contact our Data Protection Officer by email at [email protected]