Privacy Notice

1. Who we are

Derby Group is a UAE services group founded in 1995. We operate in outsourced sales, manpower and recruitment, business process outsourcing and debt collection, and consumer services including domestic worker mediation, home healthcare, concierge and mortgage advisory.

Derby Group Holding Ltd is registered in the Abu Dhabi Global Market and is subject to the ADGM Data Protection Regulations 2021.

Its operating companies — including Derby Marketing, Derby Sales Management, PACT Employment Services, Derby Debt Collections, Derby Home Health Care, Derby Concierge and Derby Domestic Workers Services — are established in the UAE and are subject to Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

If you want to know which entity holds your data, ask us and we will tell you.

2. Controller or processor — and why it matters to you

It changes who you should approach with a request, so we set it out plainly.

Where we are the controller

For our own operations — recruiting and employing people, managing our suppliers, and running this website — we decide why and how personal data is used, and we are responsible for it. Ask us directly.

Where we are the processor

Most of what we do is delivered for clients: banks, card schemes, telecom operators and corporate customers.

In that work the client decides what the data is used for and we act on their instructions. We do not use it for our own purposes and we do not sell it.

If your data reached us that way, the client is the controller. Tell us and we will identify the client and pass your request to them.

3. Our client-facing services

Banking sales

We generate leads and submit product applications to banks. In most cases the application is completed through digital onboarding directly on the bank's own portal, so the applicant's information is entered into the bank's system and is held by the bank.

The bank is the controller of that information.

Derby retains the application reference number and the status of the case. We use that to track performance and to raise our invoice. We do not operate a customer database of our own for this work.

Debt collection

We recover amounts on behalf of the client who owns the account. The client provides the account information we need and remains the controller of it.

Access is restricted to the collections staff assigned to that client's portfolio, under the privacy and access controls set out in section 6.

We use the information only to recover the account and we return or delete it when the client instructs.

Other outsourced services

For contact centre, verification, manpower and consumer services, the same principle applies: where the work is delivered for a client, the client is the controller and we act on their instructions.

4. What we handle

If you visit this website

• Technical information such as IP address, browser type, device type and the pages you viewed.
• Anything you send us through an enquiry — typically your name, email address, telephone number and your message.

If you apply to work with us

• Name, contact details, CV, employment history, education and qualifications.
• Passport, visa status and Emirates ID details where UAE employment and immigration processing requires them.
• Interview notes and assessment outcomes.

If you work for us

• Employment and payroll records, bank account and IBAN details for salary transfer under the Wages Protection System, attendance and leave records, labour card and visa records, and medical insurance enrolment references.

If you are a client or supplier contact

• Name, role, business contact details and our correspondence with you.

If you come to us through client work

• For banking sales: the application reference and case status, as described in section 3.
• For collections and other client services: the information the client has provided or instructed us to collect for that engagement.

We do not handle special categories of data — such as health, religious belief or political opinion — except where an employment or insurance requirement makes it necessary, and then only with the protections the law requires.

5. Why we use it, and on what basis

We use personal data to respond to enquiries, to assess candidates and administer employment, to meet our obligations to MOHRE, GDRFA and other UAE authorities, to manage our client and supplier contracts, to deliver the services our clients engage us for, and to keep our systems and premises secure.

We rely on your consent, on the performance of a contract, on compliance with a legal obligation, or on our legitimate business interests where those interests are not overridden by your rights.

Where we rely on consent you can withdraw it at any time.

6. How we protect it

Derby Group operates a certified information security management system.

Within that system, access to personal data is role-based and granted through a documented request, with individual named accounts.

Client data is segregated by client and by engagement, so staff working on one client's portfolio cannot reach another's.

Data is exchanged over encrypted channels. Offices are access-controlled and physical files are held in locked storage.

Confidentiality obligations sit in every employment contract. Security incidents are reported to our information security team and notified onward as our client contracts and the law require.

7. Who we share it with

• The client who engaged us, where we act on their behalf, and the bank whose product an application relates to.
• Banks, insurers and government authorities — including MOHRE and GDRFA — where employment, immigration or payroll processing requires it.
• Service providers supporting our operations, such as our HRMS, CRM, telephony and hosting providers, under contracts requiring them to protect the data and use it only for that service.
• Professional advisers, auditors, and courts or authorities where we are required to disclose.

We do not sell personal data and we do not share it for anyone else's marketing.

8. Where it is held, and for how long

Personal data we hold is kept on systems located in the United Arab Emirates. Where a candidate applies from outside the UAE, their information comes into the UAE as part of recruitment.

Where a client instructs a transfer outside the UAE, we act only under our agreement with that client and with the safeguards the law requires.

We keep personal data only as long as we need it for the purpose we collected it, and then for any period UAE law requires us to retain it.

Data we hold for a client is returned or deleted at the end of the engagement on that client's instruction.

9. Your rights

Subject to the conditions in the applicable law, you can ask us to:

• Tell you what personal data we hold about you and give you a copy.
• Correct it if it is wrong or incomplete.
• Delete it, where we no longer have a reason to keep it.
• Restrict or object to how it is being used.
• Provide it in a portable format, or transfer it to another party.
• Stop processing that is based on consent, by withdrawing that consent.

There is no charge for making a request and we will respond within the period the law sets.

Where the data reached us through client work, we will tell you who the controller is and pass your request to them.

10. Cookies

This website uses cookies and similar technologies to make the site work and to understand how it is used.

You can control cookies through your browser settings. Blocking some may affect how parts of the site behave.

11. Children

This website and our services are not directed at children. We do not knowingly collect personal data from anyone under 18 other than where an employment or service context requires it and a guardian has consented.

12. Changes to this notice

We review this notice at least once a year and whenever our processing changes materially.

The version number and effective date at the top tell you which version you are reading.

13. How to reach us

For any question about this notice, or to make a request about your data:

If you are not satisfied with how we have handled your request, you can raise the matter with the UAE Data Office, or with the ADGM Office of Data Protection where it concerns Derby Group Holding Ltd.