Global Privacy & Data Protection Policy
Effective Date: January 1, 2026 | Document Ref: PRIV-XIDU-DXB-PAR-2026.V2
1 Data Controller & Dual-Jurisdiction Identity
XIDU Consulting FZE operates as Data Controllers for all personal data collected in connection with cross-border relocation, legal advisory, real estate sourcing, and banking onboarding services.
2 Categories of Personal & High-Risk Data Collected
Due to the executive nature of visa application engineering, private banking onboarding, and luxury French tenancy dossier curation, XIDU Consulting processes the following categories of confidential information:
- Identity & Biographic Records: Full legal name, passport copies, UAE Emirates ID numbers, birth/marriage certificates, family dependent data, and official photographs.
- Financial & Wealth Dossiers: Certified UAE & international bank statements, proof of liquid funds, salary certificates, tax clearance records, investment portfolio statements, and audited company accounts.
- Employment & Corporate Data: Executive contracts, trade license records, articles of incorporation, board resolutions, and professional references.
- Residential & Real Estate Data: Title deeds, existing lease contracts, utility statements, and target Parisian residential specifications.
- Special Category Data: Official police clearance certificates (Casier Judiciaire) and health insurance/medical attestations required strictly for French long-stay visa compliance.
3 Legal Bases & Purpose of Processing
We process data strictly under lawful bases specified under Article 6 & Article 9 of the EU GDPR and Article 4 of UAE Federal Decree-Law No. 45 of 2021:
Contractual Necessity
Fulfilling client advisory retainers, engineering French visa dossiers, conducting off-market property sourcing, and submitting guarantor applications.
Legal & Regulatory Compliance
Meeting Anti-Money Laundering (AML), Counter-Terrorism Financing (CTF), DIFC regulatory audits, and French immigration protocol verifications.
4 Cross-Border Data Transfers (UAE • EU • France)
As relocation advisory mandates require data transmission between the United Arab Emirates and France, all international transfers are secured via Standard Contractual Clauses (SCCs) approved by the European Commission and compliant with DIFC Data Protection Law 2020. Data is shared exclusively with verified third parties:
- Official diplomatic appointment processors (TLSContact Dubai & Abu Dhabi, France-Visas portal).
- French sworn translators (*Traducteurs Assermentés auprès de la Cour d'Appel*) and notarization bodies.
- Partner French private wealth institutions, institutional guarantors (Garantie Bancaire), and Parisian real estate leasing agents.
5 Vaulting Security Protocols & Retention
XIDU Consulting enforces banking-grade security protocols. Client dossiers are encrypted at rest using AES-256 standards and in transit via TLS 1.3 encryption. Access is restricted via multi-factor authentication (MFA) to assigned senior advisors only. Physical documents provided in Dubai or Paris are vaulted in fireproof safe deposit units.
Financial and immigration dossiers are retained for seven (7) years following completion of the advisory mandate to comply with French commercial law and DIFC audit obligations, after which data is securely purged.
6 Client Data Rights & Exercise Procedures
Under GDPR and UAE PDPL regulations, clients retain the right to: (i) Access their personal data vault; (ii) Request immediate rectification of inaccurate dossiers; (iii) Request data erasure (*Right to be Forgotten*), subject to statutory retention mandates; (iv) Restrict or object to processing; and (v) Obtain machine-readable data portability export.