Trade with us

    Legal

    Privacy Policy

    How Crest Metals collects, uses, shares and protects personal data, and the rights you have over it. Last updated 8 October 2026.

    Who we are

    Crest Metals FZCO ("Crest Metals", "we", "us") is a Free Zone Company licensed by the Dubai Multi Commodities Centre, licence no. 990348, registration no. DMCC203067, with its registered office at Unit UT-11-CO-198, DMCC Business Centre, Level 11, Uptown Tower, Dubai, United Arab Emirates.

    Crest Metals is the controller of the personal data described in this policy. We process personal data in accordance with Federal Decree-Law No. (45) of 2021 on the Protection of Personal Data and the other laws of the United Arab Emirates that apply to us.

    Scope

    This policy applies to personal data we collect through this website, including the enquiry form on the Trade with Us page, and through email, telephone and meetings. It also covers personal data we receive during onboarding and in the course of a trading relationship.

    Crest Metals works only with businesses and institutions. The personal data we hold therefore relates mainly to individuals who act for those organisations: directors, shareholders and beneficial owners, authorised signatories, employees and other representatives.

    Personal data we collect

    Through the enquiry form

    • Full name, company, work email address and country of incorporation.
    • Counterparty type, products of interest, indicative volume and frequency, and the content of your message.
    • A record of your consent, including the date, time and wording you agreed to.

    Through correspondence

    • The content of emails, letters and messages you send us, and notes of calls and meetings.
    • Reports of concerns or suspected fraud, including any attachments.

    During onboarding and due diligence

    • Identity details: full name, nationality, date of birth, passport or identity document copies, and proof of address.
    • Role details: positions held, signing authority, board resolutions and powers of attorney.
    • Ownership and control: shareholdings, beneficial ownership and the structure of the organisation.
    • Source of funds and source of goods declarations, and the supporting documents.
    • Screening results: sanctions, politically exposed person and adverse media checks.

    During transactions

    • Names and signatures on contracts, quotations, invoices, export, customs, shipping and assay documents.
    • Business bank account details used for settlement.

    When you visit this website

    • Technical data recorded in the server logs of our hosting provider: IP address, browser type, device information, the pages requested, and the date and time of each request.
    • This website does not use advertising, analytics or tracking cookies. Our Cookie Policy explains what it does use.

    Where you give us personal data about another person, such as a colleague or a beneficial owner, please make sure they know you are doing so and have seen this policy.

    How we use personal data

    We use personal data only for the purposes below, and on the legal grounds stated for each.

    Responding to your enquiry
    To reply to you, understand your requirements and send the onboarding pack that applies to you. Legal ground: your consent, given on the enquiry form, and steps you ask us to take before entering into a contract.
    Onboarding and due diligence
    To identify and verify each counterparty, its beneficial owners and signatories, establish source of funds and source of goods, and screen against sanctions and politically exposed person lists. Legal ground: compliance with our obligations under Federal Decree-Law No. (10) of 2025, Ministerial Decree No. (68) of 2024 and Cabinet Decision No. (74) of 2020.
    Trading and settlement
    To prepare quotations and agreements, arrange assaying, refining, logistics and custody, and complete settlement. Legal ground: performance of a contract with you or the organisation you represent.
    Reporting and record keeping
    To monitor transactions, file reports with the UAE Financial Intelligence Unit through goAML, keep the records the law requires, and respond to lawful requests from authorities. Legal ground: compliance with legal obligations.
    Security and fraud prevention
    To protect this website, our systems and our counterparties, and to investigate attempts to impersonate Crest Metals. Legal ground: compliance with legal obligations and, where required, your consent.

    Screening tools may flag a possible match against a sanctions or politically exposed person list. A member of our compliance team reviews every match before any decision is taken; we do not make decisions about you by automated means alone.

    We do not send marketing communications. If we introduce them, we will ask for your consent first.

    Who we share personal data with

    We share personal data only where it is necessary for the purposes above, and only with:

    • Service providers that host this website, process form submissions and provide email and document systems, acting on our instructions under written contracts.
    • Identity verification and screening providers used in onboarding.
    • Specialist partners where a transaction requires it: refiners, assay laboratories, logistics and vault operators, banks, trade finance providers and insurers.
    • Professional advisers, including lawyers and auditors, under duties of confidentiality.
    • Authorities where the law requires it, including the UAE Financial Intelligence Unit, the UAE Ministry of Economy and Tourism, the Dubai Multi Commodities Centre, customs authorities, the UAE Kimberley Process Office, courts and law enforcement agencies.

    We do not sell personal data, and we do not share it for advertising.

    International transfers

    Some of our partners and service providers are located outside the United Arab Emirates. We transfer personal data outside the UAE only as UAE law permits: to countries that provide an adequate level of protection, where the transfer is necessary to perform a contract with you or in your interest, where it is needed to establish or defend legal claims, or with your express consent. We require recipients to protect the data under contractual safeguards.

    How long we keep personal data

    • Enquiries that do not lead to a relationship: kept only as long as we need to respond and follow up, then deleted.
    • Onboarding, due diligence and transaction records: kept for at least five years after the business relationship ends or the transaction is completed, as UAE anti-money laundering law requires, and longer where another law requires it or where the records are needed for a legal claim.
    • Website server logs: kept for a limited period for security and operation, then deleted by our hosting provider.

    Security

    We protect personal data with technical and organisational measures suited to the risk. These include restricted, need-to-know access to onboarding and compliance files, encrypted connections to this website, confidentiality obligations for staff and service providers, and compliance training for everyone who handles counterparty data. If a breach affects your personal data, we will notify you and the competent authority as the law requires.

    Your rights

    Subject to the conditions and exceptions set by law, you have the right to:

    • be informed about, and obtain access to, the personal data we hold about you;
    • have inaccurate or incomplete personal data corrected;
    • have personal data erased where it is no longer needed or was processed unlawfully;
    • restrict or stop the processing of your personal data in certain circumstances;
    • object to processing, including processing for marketing and decisions based solely on automated processing;
    • receive your personal data in a structured, machine-readable form, or have it transferred to another controller;
    • withdraw your consent at any time, without affecting processing that took place before you withdrew it.

    Some rights are limited by our legal obligations. We cannot erase onboarding or transaction records during the retention period that anti-money laundering law sets, and the law prohibits us from disclosing certain information, such as whether a report has been made to the Financial Intelligence Unit.

    To exercise a right, email info@crestmetalsae.com with the subject line "Privacy request". We will verify your identity before acting on the request and reply within the period the law requires. If you are not satisfied with our response, you may complain to the UAE Data Office.

    Other points

    Children

    This website and our services are intended for businesses. They are not directed at anyone under 18, and we do not knowingly collect personal data from children.

    Links to other websites

    This website links to services operated by others, such as Google Maps. Their privacy policies, not this one, apply when you use them.

    Changes to this policy

    We review this policy regularly. When we change it, we publish the new version on this page and update the date at the top.

    Contact

    For any question about this policy or about your personal data, contact Crest Metals FZCO, Unit UT-11-CO-198, DMCC Business Centre, Level 11, Uptown Tower, Dubai, United Arab Emirates, by email at info@crestmetalsae.com with the subject line "Privacy", or by telephone on +971 58 595 4325.