GDPR Policy
How Pistos Group handles personal data belonging to individuals in the European Union and the United Kingdom.
When this applies
Pistos Group is established in the United Arab Emirates. The EU General Data Protection Regulation and the UK GDPR apply to us where we offer services to individuals in the EU or UK, which we do — a significant number of the people who approach us about UAE company formation and residency are based there.
Where that is the case, the rights set out below apply in addition to anything in our privacy policy.
Controller and contact
Pistos Group L.L.C-FZ, Office 506, Ground Floor, Hamza A Building, Al Karama, Dubai, United Arab Emirates, is the controller. Data protection enquiries go to hello@pistos.ae.
Our lawful bases
We rely on the following under Article 6.
- Consent (Art. 6(1)(a)) — when you submit an enquiry or ask a question through this site
- Contract (Art. 6(1)(b)) — to carry out an engagement you have entered into with us
- Legal obligation (Art. 6(1)(c)) — UAE anti-money-laundering, know-your-customer and tax record-keeping duties
- Legitimate interests (Art. 6(1)(f)) — securing the site and keeping business records, balanced against your rights
Your rights
We respond to requests within one month. There is no charge unless a request is manifestly unfounded or excessive, and we will say so and explain why rather than quietly ignoring it.
- Access to the personal data we hold about you
- Rectification of anything inaccurate
- Erasure, where no overriding legal duty requires retention
- Restriction of processing while a dispute is resolved
- Portability — a copy in a structured, commonly used, machine-readable format
- Objection to processing based on legitimate interests
- Withdrawal of consent at any time
- The right to lodge a complaint with your national supervisory authority, or with the Information Commissioner's Office in the UK
Transfers to the UAE
Working with us means your personal data is transferred to and processed in the United Arab Emirates.
The UAE does not have an EU adequacy decision
At the time of writing, the European Commission has not issued an adequacy decision for the United Arab Emirates. Transfers therefore rely on the safeguards and derogations in Chapter V of the GDPR — principally Article 49(1)(b), where the transfer is necessary to perform the contract you have asked us to carry out, and Article 49(1)(a), your explicit consent to the transfer having been informed of the risks. We tell you this rather than leaving it buried, because it is the point a careful person would want to know.
Automated decision-making
The setup assessment on this site produces a recommendation from the answers you give. It is advisory. It produces no legal effect and no similarly significant effect — nothing is decided about you, no application is submitted and no service is refused on the strength of it. A person reviews every case before anything is filed.
We do not profile you for advertising and we do not sell data to anyone.
Retention
Enquiries that do not become engagements are deleted after 24 months. Client records are held for at least five years after the engagement ends because UAE law requires it, which may be longer than you would prefer. We would rather tell you that upfront than promise a deletion we cannot deliver.
Last updated
9 October 2026