Platform Rulebook — Document 04 · Version 1.0 · Issued November 10, 2026 · Effective upon publication on assayametals.com
1.1 The data controller is Assaya Precious Metals DMCC, registered in the DMCC Free Zone, Dubai, United Arab Emirates. Data protection enquiries are made through the Contact page of assayametals.com, which routes to the Company's data protection function. The Site publishes no email address or named contact, by design.
| Category | Examples | Purpose and basis |
|---|---|---|
| Identity and KYC data | Legal name, identification documents, corporate authority, beneficial ownership | Verification under Document 05; contract; legal obligation (AML/KYC) |
| Verification evidence | Title/authority documents, bank-verified funds capacity, licences | Verification and Badge administration; contract; legal obligation |
| Transaction records | Deal Room record, documents, approvals, audit log, settlement statuses | Performance of the participation contract; legal obligation; the sealed file |
| Financial data | Invoice and settlement data (the Company holds no funds and no card data) | Invoicing under Document 09; accounting and tax obligations |
| Technical data | Device, session and security logs; two-factor records | Security of rooms holding transaction value; legitimate interests |
| Enquiry data | Contact-form submissions | Answering the enquiry; legitimate interests |
2.1 Coded participation is a privacy control, not an anonymity promise against the Company: the Company holds the identity behind each Code in its private verification file, and counterparties never see it.
3.1 Personal data is shared only as the Platform's procedure requires and under instruction: Paymasters, Refineries and other service parties receive the minimum data their step requires, inside the Deal Room; notaries receive identity data for notarisation; banks receive data through banking channels for guarantee and funds verification; competent authorities receive data where the law requires, including AML reporting. Verification documents are never shown to counterparties — they see status, never documents.
3.2 We do not sell personal data, and we do not permit any service provider to use Platform data to train models or for its own purposes.
4.1 Transactions are international; data may be transferred outside the UAE only as the PDPL permits — to jurisdictions with adequate protection, or under appropriate safeguards, or where necessary for the performance of the Participant's contract — and always within the Deal Room's access rules.
5.1 Verification and transaction records are retained for not less than five (5) years after the end of the relationship or the Transaction's closing, as UAE anti-money-laundering law requires, and Deal files are sealed at closing under the Platform's retention rule. Data held beyond its purpose and the legal retention period is deleted or irreversibly anonymised.
6.1 Encryption in transit and at rest; two-factor access; device-bound sessions; viewer-watermarked documents; complete audit logging; and hash-anchoring of sealed records on the Integrity Ledger, so alteration is detectable.
7.1 Under the PDPL a data subject may request: access to, and a copy of, their personal data; correction; erasure where the legal retention basis has expired; restriction or objection to processing; and portability, in each case as the Law provides. Requests are made through the Contact page and answered within the statutory period. A complaint may also be made to the UAE Data Office.
7.2 Where a legal obligation (including AML record-keeping) requires retention, erasure is deferred to the expiry of that obligation and the requester is told so.
8.1 A personal-data breach that risks the privacy, confidentiality or security of data subjects is notified to the UAE Data Office and, where the Law requires, to affected data subjects, within the statutory periods.
9.1 The Site uses strictly necessary cookies for security and session integrity. Analytics, if used, run only with consent, and no advertising or cross-site tracking cookies are set.
10.1 Amendments are published on the Site with a new version number and take effect on publication for new processing; material changes are notified to Participants in the app.
1 Governing law. This document is governed by, and construed in accordance with, the laws of the United Arab Emirates as in force in the Emirate of Dubai, including the regulations of the Dubai Multi Commodities Centre (DMCC).
2 Arbitration. Any dispute arising out of or in connection with this document shall first be addressed by negotiation between the parties' senior representatives for fifteen (15) Business Days. Failing resolution, the dispute shall be finally resolved by arbitration administered by the Dubai International Arbitration Centre (DIAC) under the DIAC Arbitration Rules, by a sole arbitrator, seated in Dubai, United Arab Emirates, in the English language. The award is final and binding and may be enforced in any competent court.
3 Interim relief. Nothing in this Article prevents a party from seeking urgent interim relief from a competent court, or Assaya from giving effect to a compliance hold under the Responsible Sourcing & AML Standard.