PRIVACY POLICY
1. Who we are
EML Advisory (“EML Advisory”, “we”, “us”, “our”) is an independent international AML/CFT advisory practice operated by Erin Lubowicz trading as EML Advisory, holding [LICENCE TYPE AND NUMBER] issued in [FREE ZONE / EMIRATE], Abu Dhabi, United Arab Emirates.
We are the data controller for personal data collected through www.emladvisory.com (the “Site”).
2. Scope
This policy explains what personal data we collect through the Site, why we collect it, how we handle it, and what rights you have.
It does not cover personal data processed in the course of a client engagement. Where we act as an adviser to a government, regulator or organisation, personal data handling is governed by the engagement contract and any applicable confidentiality obligations.
3. What we collect
We keep data collection to a minimum. We do not sell personal data, and we do not use it for advertising or profiling.
Visitors to the Site. Standard technical data collected automatically by our hosting provider: IP address, browser type and version, device type, operating system, referring page, pages viewed, and date and time of visit.
Newsletter subscribers. The email address you submit, plus the date of subscription.
People who contact us. Your name, email address, and anything you choose to include in your message. Our contact links open your own email client, so the message reaches us as ordinary email.
Client Portal users. Login credentials issued to invited users, and basic access records. The Portal exists solely to make training materials available to participants in an engagement. We do not require you to submit personal information to use it beyond what is needed to log in.
We do not operate e-commerce, take payments through the Site, or request special-category data.
4. Why we process it, and on what legal basis
Where the EU or UK GDPR applies, our legal bases are:
Purpose
Legal basis
Operating, securing and maintaining the Site
Legitimate interests in running a functioning, secure website
Understanding how the Site is used, in aggregate
Consent, where analytics cookies are used
Sending the newsletter
Consent
Responding to your enquiry
Legitimate interests, or steps prior to entering a contract
Providing Client Portal access
Performance of a contract, or legitimate interests in delivering an engagement
Meeting legal and regulatory obligations
Legal obligation
Where UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data applies, we process personal data on the basis of your consent or one of the permitted grounds set out in that law.
5. Cookies
The Site uses cookies, which are small files placed on your device.
• Strictly necessary cookies keep the Site working, including secure areas such as the Client Portal. These cannot be switched off.
• Analytics cookies help us understand, in aggregate, how the Site is used.
We ask for your consent before setting non-essential cookies. You can change or withdraw that consent at any time using the cookie preferences control on the Site, and you can block or delete cookies through your browser settings. Blocking some cookies may affect how the Site works.
6. Who we share data with
We share personal data only with service providers who process it on our behalf, under contract, and only as needed to run the Site:
• Squarespace, Inc. for website hosting, form handling, email campaigns and built-in analytics
We may also disclose personal data where we are legally required to, or to establish, exercise or defend legal claims.
We do not sell or rent personal data.
7. International transfers
We are based in the United Arab Emirates and our hosting provider is based in the United States. Personal data collected through the Site will therefore be transferred outside the EEA, the UK and your own country.
Where we transfer personal data from the EEA or UK, we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses (and the UK Addendum where relevant) as incorporated into our provider agreements. You may request further detail using the contact details below.
8. How long we keep it
• Newsletter subscribers. Until you unsubscribe, plus a short period to honour the request
• Enquiries. For as long as needed to respond and maintain a record of the exchange, then reviewed periodically
• Client Portal access records. For the duration of the engagement and a reasonable period afterwards
• Technical and analytics data. Retained by our provider in line with their standard periods
We do not keep personal data longer than we need it.
9. Your rights
Depending on where you are, you may have the right to:
• Access the personal data we hold about you
• Have inaccurate data corrected
• Have your data erased
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw consent at any time, without affecting processing already carried out
• Lodge a complaint with a supervisory authority
To exercise any of these, contact [erin@emladvisory.com]. We will respond within the period required by applicable law.
Complaints. In the UK, the Information Commissioner’s Office (ico.org.uk). In the EEA, your national data protection authority. In the UAE, the UAE Data Office.
10. Security
We take reasonable technical and organisational measures to protect personal data, including encrypted connections (HTTPS) and access controls on the Client Portal. No online service can be guaranteed completely secure, and we cannot warrant absolute security.
11. Children
The Site is intended for professional and institutional audiences. It is not directed at children, and we do not knowingly collect personal data from anyone under 18.
12. Changes to this policy
We may update this policy from time to time. The current version will always be posted here with the date it was last updated.
13. Contact
Erin Lubowicz, info@emladvisory.com
Last updated: August 2026