Privacy Policy - Paul Newstone FZCO
Last Updated: March 2026
Begin a confidential conversation.
Privacy Policy
1. Introduction
Paul Newstone FZCO ("Paul Newstone", "we", "us", or "our") is committed to protecting the personal data of all individuals who interact with our services and website. This Privacy Policy sets out how we collect, use, process, store, and disclose personal data in connection with our executive search, recruitment, and advisory services. Paul Newstone FZCO is a licensed company registered with the Dubai Multi Commodities Centre (DMCC), Dubai, United Arab Emirates.
We operate in accordance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL") and, where applicable, other internationally recognised data protection standards. By accessing our website or engaging with our services, you acknowledge that you have read and understood this Privacy Policy.
2. Data Controller
The entity responsible for the processing of your personal data is:
Paul Newstone FZCO DMCC Business Centre, Level 1 Jewellery & Gemplex 3, Unit 3O-01-5991, Jumeirah Lakes Towers (JLT) Dubai, United Arab Emirates
For all data protection enquiries, please contact: privacy@paulnewstone.ae
3. Scope of Data Collection
We collect and process personal data only to the extent strictly necessary to provide our services. This may include:
Personal Information Full name, email address, phone number, postal address, date of birth, nationality.
Professional Information CV and employment history, educational background and professional qualifications, current and expected compensation, skills, experience, and career preferences.
Recruitment & Evaluation Data Interview notes and internal assessments, references and feedback provided by third parties, correspondence related to recruitment processes.
Technical Data IP address, browser type, device information, website usage data collected via cookies and analytics tools.
Sensitive Personal Data In limited circumstances, we may process sensitive personal data (such as health-related information or background check results) where this is required by a client mandate and explicitly permitted under applicable UAE law. In all such cases, we will seek your explicit prior consent.
We do not collect personal data beyond what is necessary for the stated purposes. You are under no legal obligation to provide personal data to us; however, failure to do so may limit our ability to provide services to you.
4. Purpose of Processing
We process personal data solely to support our core business activities as an executive search and recruitment firm. Purposes include:
-
Identifying and matching candidates with suitable executive opportunities
-
Supporting and facilitating hiring processes on behalf of our clients
-
Communicating with candidates, clients, and referees
-
Providing advisory, market intelligence, and salary benchmarking services
-
Delivering our annual Salary Report and related industry publications
-
Improving our internal processes through analytics
-
Complying with legal and regulatory obligations
Where you have provided explicit consent, we may additionally contact you regarding:
-
Relevant career opportunities
-
Salary insights and industry reports
-
Service updates and announcements
You may withdraw such consent at any time without affecting the lawfulness of prior processing.
5. Legal Basis for Processing
We rely on the following legal bases under the PDPL and applicable UAE law:
Consent: Where you have explicitly agreed to the processing of your personal data, for example upon registering as a candidate or subscribing to our publications.
Contractual Necessity: Where processing is required to perform services that you or your organisation have requested.
Legal Obligation: Where processing is necessary for compliance with applicable UAE laws and regulations.
Employment & Recruitment Necessity: As expressly permitted under the PDPL, where processing is necessary to fulfil obligations and establish rights in the field of employment and recruitment.
Operational Necessity: Where processing is reasonably necessary to operate, maintain, and develop our business, provided such interests are not overridden by your fundamental rights.
6. Data Sharing
In the course of providing our services, personal data may be shared with:
Client Companies: In the context of specific recruitment mandates and only to the extent necessary for that mandate.
Service Providers: Third-party providers supporting our operations, including CRM systems, hosting providers, IT infrastructure, and communication platforms. All such providers are subject to binding data processing agreements and confidentiality obligations.
Affiliated Entities: Other entities within the Paul Newstone group, where required for operational purposes.
Competent Authorities: Where we are required to disclose data by applicable law, regulation, court order, or governmental authority.
We do not sell, rent, lease, or otherwise commercially exploit personal data. Any sharing is strictly limited to what is necessary for the stated purpose.
7. International Data Transfers
Due to the international nature of our business, personal data may be transferred to and processed in jurisdictions outside the UAE, including Switzerland, the United Kingdom, the United States, and other countries where our clients or service providers operate.
Where such transfers occur, we implement appropriate safeguards to ensure your personal data remains protected to a standard equivalent to that required under the PDPL. These safeguards include contractual protections binding the recipient to comply with the requirements of UAE data protection law, or, where applicable, your explicit consent to the transfer.
By engaging with our services, you acknowledge that your personal data may be transferred internationally in accordance with this section.
8. Data Retention
We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, or as required by applicable law:
-
Active candidate profiles: For the duration of the recruitment relationship and up to 2 years following the last meaningful interaction.
-
Successfully placed candidates: Up to 7 years following placement, for record-keeping and compliance purposes.
-
Client contact data: For the duration of the client relationship and up to 3 years thereafter.
-
Website technical data: As determined by our cookie settings, typically no longer than 12 months.
Upon expiry of the applicable retention period, personal data is securely deleted or anonymised unless a longer retention period is required by law.
9. Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration, or unlawful disclosure. These measures are aligned with internationally recognised security standards and include:
-
Access controls limiting data to authorised personnel only
-
Encryption of data in transit and at rest where appropriate
-
Regular review of security procedures and practices
-
Confidentiality obligations for all staff and contractors
Notwithstanding the above, no method of electronic transmission or storage is entirely secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security. In the event of a personal data breach affecting your rights, we will notify the UAE Data Office and, where required, affected individuals, in accordance with applicable law. We maintain internal records of processing activities in accordance with applicable UAE data protection requirements and make such records available to competent authorities upon request.
10. Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to the rights of affected individuals, we will:
-
Notify the UAE Data Office as required under applicable law and in accordance with the procedures specified by the UAE Data Office upon the issuance of Executive Regulations to the PDPL.
-
Inform affected individuals without undue delay where the breach is likely to result in a high risk to their rights.
-
Take immediate steps to contain the breach, assess its impact, and implement remedial measures.
11. Your Rights
Under the PDPL and applicable UAE data protection law, you have the right to:
-
Access: Request confirmation of whether we hold personal data about you and obtain a copy of that data.
-
Rectification: Request correction of any inaccurate or incomplete personal data.
-
Erasure: Request deletion of your personal data, subject to our legal and contractual obligations.
-
Restriction: Request that we restrict the processing of your personal data in certain circumstances.
-
Objection: Object to the processing of your personal data where we rely on operational necessity as a legal basis.
-
Data Portability: Request that we provide your personal data in a structured, commonly used format where technically feasible.
-
Withdrawal of Consent: Withdraw any consent previously provided at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.
-
Complaint: Lodge a complaint with the UAE Data Office if you consider that our processing of your personal data violates applicable law.
To exercise any of these rights, please submit a written request to privacy@paulnewstone.ae. We will respond within a reasonable timeframe and in accordance with applicable legal requirements. We reserve the right to verify your identity before processing any such request.
Please note that certain rights are subject to limitations under applicable law. We will inform you if we are unable to comply with a request and explain the reasons.
12. Cookies & Tracking Technologies
We use cookies and similar tracking technologies to ensure website functionality, analyse usage patterns, enhance user experience, and support marketing activities.
Cookies that are not strictly necessary for the operation of our website (including analytics and marketing cookies) are only placed with your prior consent, which you may provide or decline via our cookie consent banner. You may withdraw or modify your cookie preferences at any time through the settings available on our website.
For further information on our use of cookies, please refer to our Cookie Policy.
13. Data Protection Officer
As an executive search firm processing professional and, in limited cases, sensitive personal data, we actively monitor our obligations regarding the appointment of a Data Protection Officer (DPO) under the PDPL. Where required under applicable law or Executive Regulations issued by the UAE Data Office, we will appoint a qualified DPO and publish their contact details on this page.
For all current data protection enquiries, please contact: privacy@paulnewstone.ae
14. Recruitment Disclaimer
Paul Newstone acts solely as an intermediary facilitating connections between candidates and client companies. We expressly disclaim any liability for:
-
Employment outcomes, job offers, or hiring decisions, which are made exclusively and independently by our clients
-
The accuracy or completeness of information provided by candidates or clients
-
Any direct, indirect, or consequential loss arising from the recruitment process or decisions made by third parties
-
Any failure by a client to fulfil commitments made during a recruitment process
Candidates and clients are solely responsible for evaluating the suitability of opportunities, roles, and individuals, and for conducting their own due diligence. Paul Newstone does not guarantee any outcome in connection with its recruitment services.
15. Website Disclaimer
Paul Newstone FZCO makes no representations or warranties of any kind, whether express or implied, regarding the accuracy, completeness, reliability, suitability, or availability of any information, services, or content published on this website. All information is provided on an "as is" basis and is subject to change without notice.
Any reliance you place on information published on this website is strictly at your own risk. To the fullest extent permitted by applicable law, Paul Newstone FZCO shall not be liable for any direct, indirect, incidental, consequential, or special loss or damage - including but not limited to loss of data, revenue, or business - arising from your use of, or inability to use, this website.
16. External Links
Our website may contain links to third-party websites. Paul Newstone has no control over, and accepts no responsibility for, the content, privacy practices, or data protection standards of any external site. The inclusion of any link does not constitute an endorsement by Paul Newstone. We encourage you to review the privacy policies of any third-party websites before providing personal data to them.
17. No Employment or Agency Relationship
Use of this website or engagement with our services does not create, and shall not be construed as creating, any employment relationship, partnership, joint venture, or agency between you and Paul Newstone FZCO. Nothing in this Privacy Policy or on our website constitutes an offer of employment or advisory services.
18. Limitation of Liability
To the fullest extent permitted by applicable UAE law, Paul Newstone FZCO, its directors, officers, employees, and agents shall not be liable for any loss or damage arising from:
-
Reliance on information provided on this website or in the course of our services
-
Any failure, delay, error, or interruption in the provision of services beyond our reasonable control
-
Actions or omissions of third parties, including clients and service providers
-
Any data breach or security incident despite reasonable precautions having been taken
Nothing in this Policy limits liability for fraud, gross negligence, or any liability that cannot be excluded under UAE law.
19. Governing Law & Dispute Resolution
This Privacy Policy is governed by and construed in accordance with the laws of the United Arab Emirates. Any dispute arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Dubai, UAE.
20. Updates to This Policy
We may update this Privacy Policy from time to time to reflect changes in applicable law, our services, or our data processing practices. The most current version will always be published on our website with the date of the most recent revision at the top of this page. We encourage you to review this Policy periodically. Continued use of our website or services following any update constitutes your acknowledgement of the revised Policy.
For any questions regarding this Privacy Policy or the handling of your personal data, please contact us at privacy@paulnewstone.ae.