Privacy Policy — KYC / AML onboarding

Last updated: 25.10.2026

1. Who we are

PANKOV CORPORATE SERVICES PROVIDER ("Pankov CSP", "we"), a corporate service provider registered in Dubai, United Arab Emirates, is the data controller for the personal data collected through this onboarding form at https://crm.pankov.ae/kyc/. Contact: compliance@pankov.ae.

2. Why we collect your data

As a Designated Non-Financial Business or Profession (DNFBP) we are legally required to identify and verify our clients and their beneficial owners, understand the purpose of the business relationship and the source of funds, and screen clients against sanctions and politically exposed persons (PEP) lists. Legal basis: UAE Federal Decree-Law No. 10 of 2025 on Anti-Money Laundering and Combating the Financing of Terrorism, Cabinet Resolution No. 134 of 2025 and the guidance of the UAE Ministry of Economy; UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

3. What we collect

• Identity data: name, date and place of birth, nationality, passport / Emirates ID details, photo of the identity document, a selfie / liveness video;
• Contact and residence data: address, e-mail, phone, proof of address;
• Professional and financial data: occupation, employer, services requested, source of funds and wealth, expected volumes;
• Company data (for legal entities): registration documents, ownership structure, beneficial owners, directors and authorised signatories;
• Declarations (PEP, sanctions, tax residence), technical data (IP address, browser, time of submission).

4. Identity verification by Sumsub

Document and liveness checks and sanctions / PEP screening are performed by our processor Sum and Substance Ltd (Sumsub), London, United Kingdom, acting on our instructions under a data processing agreement. Sumsub processes the images of your identity document and your face to verify authenticity and liveness; biometric templates are used only for this verification. Sumsub's own privacy notice: sumsub.com/privacy-notice-service.

5. Who else may receive your data

Google LLC (Google Drive — secure storage of client files), Telegram (internal notifications to our compliance officer without document contents), and, where required by law, the UAE Financial Intelligence Unit (goAML), supervisory authorities, courts and law-enforcement bodies. We do not sell personal data and do not use it for marketing.

6. Retention

We keep KYC records, documents and verification results for at least 5 years after the end of the business relationship or the completion of the transaction, as required by UAE AML law, and longer if requested by a competent authority. Afterwards data is deleted or anonymised.

7. Security

Data is transmitted over HTTPS, stored on servers with restricted access, and available only to authorised staff of Pankov CSP (compliance officer and management). Access is logged.

8. Your rights

Subject to legal retention obligations you may request access to your data, correction of inaccurate data, information about processing, and withdrawal of consent for future processing (which may prevent us from providing services). Requests: compliance@pankov.ae. You may also lodge a complaint with the UAE Data Office.

9. Changes

We may update this policy; the current version is always available at this address.