I. Introduction and scope
Capstone Insurance Brokers LLC (“Capstone”, “we”, “us” or “our”) is an insurance brokerage. We assist you in identifying suitable insurance cover, comparing offers from insurers, arranging a policy and supporting you throughout the policy period, including when you submit a claim. In doing so, we may collect and use personal data about you. This policy sets out, in clear terms, what personal data we may collect, why we may use it, who may receive it and how you can keep control of it.
This policy applies to every individual whose personal data we may handle. This may include prospective clients, existing clients, individuals insured under a corporate or group policy, claimants, website visitors, and representatives of the businesses and suppliers we work with.
It may apply whenever you deal with us through our website, by telephone, by email or message, through a form, or in person. References to “you” are to any such individual. Our website may contain links to third-party websites, including those of insurers. We do not control those websites, and they may operate under their own privacy terms. We strongly recommend you review those terms before sharing your personal data with them.
II. How we Handle Your Personal Data
We may process your personal data only in a lawful, fair and transparent manner, for specified purposes, and only to the extent necessary for those purposes. We take reasonable steps to keep it accurate and up to date, to protect it with appropriate security measures, and to retain it for no longer than needed.
III. Personal data we collect
The personal data we may collect depends on the services you request. We may collect identification details, such as your name, date of birth, gender, nationality, Emirates ID, passport and visa information and other identity documents, together with contact details, such as your telephone number, email address and residential or postal address. When you request a quotation or a policy, we may collect information about the person, property, vehicle, business or travel arrangements you wish to insure, including details of family members or employees where relevant. We may also collect your insurance history, claims history, beneficiary details, employment and income information and payment records if applicable.
For certain products, in particular health insurance, and in some claims, we may need medical or other sensitive personal data. We collect such data only where it is necessary for a specific purpose, and we apply additional safeguards to it.
We may also hold records of our communications with you, including emails, messages, complaints, feedback and call recordings, as well as the results of identity, fraud and sanctions checks that we are required to perform. When you use our website, we may collect technical data, such as your IP address, device and browser type, cookie identifiers and browsing activity.
If you visit our offices, we may record your visit, and security cameras may capture your image. We may record and monitor telephone calls and other communications for quality assurance, staff training, fraud prevention and regulatory compliance.
IV. Sources of personal data
Most personal data will come directly from you, whether through an enquiry, a quotation request, a proposal form, and uploaded document. Where the law permits, we may also obtain personal data from other sources. These may include insurers, underwriters, reinsurers and claims handlers, our employer or the company that holds a group policy covering you, family members or representatives authorised to act on your behalf, government bodies, regulators and public records, identity-verification and screening providers, and the technology and service providers that support our operations. We may also obtain technical data from our website and telephone systems through cookies and similar technologies.
V. Purposes of processing
We may process your personal data to provide the services you request. This may include preparing quotations, comparing insurance options, arranging and issuing policies, handling renewals, amendments and cancellations, providing advice, responding to enquiries and complaints, and assisting with claims. We may also process it to verify your identity, assess eligibility for cover, and detect and prevent fraud.
We may process personal data to meet our legal and regulatory obligations, including those relating to anti-money laundering, counter-terrorism financing, sanctions, record keeping, audit, and reporting to authorities such as the Central Bank of the UAE. We may also process it for operational purposes, such as monitoring service quality, training our staff, analysing how our website is used, and safeguarding our systems and premises, and to protect the rights, property and safety of Capstone, our clients, insurers and others. Where permitted, we may use your contact details to send you service updates and, with your consent, information about our services.
We will process your personal data only for these purposes, or for a closely related purpose that the law permits. If you choose not to provide the information we request, we may be unable to give you a quotation, arrange cover or otherwise provide our services.
VI. Disclosure of personal data
We may disclose personal data to parties who need it to provide our services or to meet legal obligations. These may include insurers, reinsurers and underwriters; claims administrators, medical networks, surveyors, repairers and other parties involved in a policy or claim; service providers that support payments, information technology, cloud hosting, communications and customer support; auditors, legal counsel and other professional advisers; and regulators, courts, law enforcement and other government authorities where the law requires or permits disclosure.
We disclose personal data only to recipients with a genuine need to receive it, and we expect them to keep it confidential and to protect it appropriately. We do not sell personal data, and we do not provide it to third parties in exchange for payment.
VII. Transfers outside the UAE
Capstone will store and maintain personal data within the United Arab Emirates in accordance with applicable Central Bank of the UAE requirements. We will also maintain appropriate secure backup arrangements as required by applicable regulations.
Where international access to or processing of personal data is necessary for legitimate business purposes, any such activity will be subject to applicable UAE laws and regulatory requirements, including restrictions on international data transfers and any applicable Central Bank requirements. We will take appropriate measures to ensure that personal data remains protected and is accessed only by authorised parties for legitimate purposes.
VIII. Retention of personal data
We may retain personal data only for as long as necessary to fulfil the purposes for which it was collected. This may include providing our services, administering policies and claims, resolving disputes, and complying with legal, tax, regulatory and audit requirements. The applicable period may depend on the type of data, the product concerned, the duration of our relationship and the time limits for bringing legal claims. When personal data is no longer required considering the applicable laws and regulation, we may securely delete it, or anonymise it so that it no longer identifies you, or archive it where the law requires.
IX. Security and breach management
We may apply technical and organisational measures proportionate to the risk, in order to protect personal data against loss, misuse, unauthorised access, disclosure and alteration. These measures may include secure systems, access controls, authentication, encryption, firewalls, activity logging and monitoring, staff training and confidentiality obligations, and due diligence on our suppliers. We may restrict access to those who need it for their role.
If a data breach occurs that may prejudice your privacy, confidentiality or security, we will act promptly and notify the UAE Data Office and affected parties. No system can be guaranteed to be entirely secure, but we keep our safeguards.
X. Your rights under UAE law
The law gives you rights in relation to your personal data, and you may exercise them by
contacting us. You may ask us to confirm what personal data we hold about you, the purposes for which we use it, the parties with whom we share it, the period for which we expect to keep it, and whether it is transferred abroad or subject to automated processing, and you may request a copy of it. You may request correction of inaccurate or incomplete data. You may request that we erase your data, restrict our use of it, or stop processing it, in the circumstances the law allows. You may object to certain processing, including direct marketing and decisions based solely on automated processing that significantly affect you. You may request that your data be provided to you, or transferred to another organisation, in a structured and commonly used format, where the law allows. You may also withdraw any consent you have given at any time.
We may need to verify your identity before acting on a request, to ensure that your data is not disclosed to the wrong person. We will respond within the time limits set by law. These rights are not absolute. We may need to retain data or decline a request where a legal obligation, a regulatory requirement, a contract, or the prevention of fraud or protection of security so requires, and where this is the case we will explain why.
XI. Personal data of other individuals and minors
You may provide us with personal data about other people, such as family members named on a policy, employees covered under a group scheme or additional drivers. By doing so, you confirm that you are authorised to share it and that the individuals concerned have been informed and, where the law requires, have consented. Personal data relating to anyone under 18 may be provided only by a parent or legal guardian. Our services are not directed at children, and we do not knowingly collect personal data directly from them.
XII. Use of automated tools
We may use automated tools to support routine tasks, such as preparing and comparing quotations, screening for fraud, directing enquiries to the appropriate team member, and analysing website usage. These tools may improve the speed and consistency of our service, but they do not replace human judgement in matters of importance. Whether an insurer accepts a risk, and on what terms, is determined by the insurer.
XIII. Marketing preferences
Where the law requires it, and with your consent, we may send you news, offers and information about our services and insurance products by email, telephone, text message or other channels. You may opt out at any time through the unsubscribe link in our messages or by contacting us. Opting out of marketing will not prevent us from sending you communications you need, such as notices about your policy, renewal, claim, payment or account, or messages required by law.
XIV. Website and cookies
Our website may use cookies and similar technologies to enable it to function, remember your preferences, understand how it is used, improve its performance and maintain its security. These technologies may collect your IP address, device and browser type and the pages you visit etc. Where the law requires, we may ask for your consent before using non-essential cookies. You may adjust your browser settings to block or delete cookies, although some features of the website may not function properly as a result.
XV. Changes to this policy
We may update this policy from time to time to reflect changes in the law, our services, our technology or our practices. The latest version will be published on our website.
XVI. Governing law
This policy is governed by the applicable laws of the United Arab Emirates, including the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and the regulations issued under it. If any provision of this policy conflicts with a mandatory law, the mandatory law prevails to the extent of the conflict.
XVII. Contact us
If you have a question about this policy, wish to exercise any of your rights, or would like to raise a concern, please contact:
Capstone Insurance Brokers LLC by Email at [email protected], by telephone on +971 044018100, or by post at Office
No 501, Al Gurg Tower 3, Riggat Al Buteen, Deira, Dubai, UAE