Last updated: October 31, 2025

1. Who We Are

Old Crane Gateway is a brand of Old Crane Global FZCO, a company registered in Dubai, United Arab Emirates. Old Crane Global FZCO is the data controller for personal data collected through this website and related activities.
Registered address: Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates.

2. Scope of This Policy

This Policy applies to:

• Our website (oldcranegateway.com) and linked pages.

• Online booking and payment via Acuity Scheduling.

• Intake surveys completed before advisory sessions.

• Email correspondence and direct document exchange.

• Invoices and payments processed via Stripe, Payoneer, Wio Business (and similar platforms we may add).

• Secure document storage and client records maintained through Airtable, Google Drive, and related encrypted cloud services used for operational purposes.

• Newsletter sign-ups and related communications.

3. Personal Data We Collect

• Identification & contact: name, email, phone, nationality, company details, role.

• KYC/AML documents (Know Your Customer / Anti-Money Laundering) where relevant: government ID, proof of address, corporate documents, UBO info, source-of-funds/source-of-wealth statements.

• Booking/intake data: session details, answers to intake survey, logistics.

• Payment metadata: transaction references, billing details (processed by payment providers).

• Communications: emails, notes of sessions and follow-ups.

• Website/ads analytics: pages viewed, referral source, campaign and ad interaction data, cookie identifiers.

Client documents and information submitted for company setup, compliance, or advisory purposes are securely stored and managed through Airtable, Google Drive, and other encrypted cloud-based systems used by Old Crane Global FZCO. Access to these platforms is restricted to authorized personnel only. Data retention follows UAE AML/CFT regulations and internal compliance policies, ensuring records are kept for the legally required period and then securely deleted.

4. How We Collect Data

• Forms on Squarespace and Acuity bookings (including the post-booking intake survey).

• Direct email to our domain.

• Airtable for internal record-keeping.

• Analytics/ads tools: Google Analytics/Ads, Meta Pixel (Facebook/Instagram), LinkedIn Insight Tag, and similar platforms used for performance measurement.

5. Purposes and Legal Bases

We process personal data to:

• Provide and manage advisory services (contract performance).

• Comply with law (UAE AML/CFT; accounting/tax record-keeping).

• Improve services and security (legitimate interests: analytics, troubleshooting, fraud prevention).

• Insurance and risk management (legitimate interests).

• Marketing communications (only with consent; e.g., newsletter). You may withdraw consent at any time without affecting prior lawful processing.

6. Cookies and Analytics

Our website uses essential cookies required for security and booking functions and, with your consent, analytics and advertising cookies (Google Analytics/Ads, Meta Pixel, TikTok Pixel, and LinkedIn Insight Tag). These technologies help us understand site usage and improve our marketing performance.

You can accept, decline, or change cookie preferences through the banner or your browser settings. Refusing non-essential cookies will not affect the site’s core functionality.

7. Who We Share Data With (Categories)

We share personal data only with trusted providers that help us operate:

• Hosting & site: Squarespace.

• Scheduling: Acuity Scheduling.

• Productivity/records: Google Workspace, Airtable.

• Payments: Stripe, Wio Business, Payoneer (each an independent controller for transactions).

• Analytics/ads: Google, Meta, LinkedIn (with consent where required).

• Professional advisors/insurers: legal, accounting, insurance providers (under NDA/engagement).

• Authorities: where required by law (e.g., AML reporting to UAE FIU via goAML).

We do not sell personal information.

8. International Transfers

Data may be processed and stored in the United States and other jurisdictions where our providers operate, and accessed from the United Arab Emirates. We apply contractual and technical safeguards (e.g., data-processing agreements, encryption, least-privilege access) to protect data in line with UAE PDPL, GDPR/UK law, and other applicable rules.

9. Retention

We retain personal data for seven (7) years to meet AML, accounting, and legal-defense requirements, then securely delete or anonymize it unless a longer period is legally required.

10. Security

We use administrative, technical, and physical safeguards (encrypted connections, restricted access, logging, staff confidentiality). Old Crane Global FZCO maintains professional indemnity insurance that includes data-breach coverage; insurer details are not disclosed publicly. Where required by law, we will notify authorities and affected individuals of security incidents.

11. Automated Decisions

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

12. Your Rights (Global)

Subject to local law, you may:

• Access your data and receive a copy.

• Request correction of inaccurate data.

• Request deletion where no legal basis for retention exists.

• Object to or restrict certain processing.

• Withdraw consent (e.g., unsubscribe from marketing). We may need to verify identity before acting on a request.

13. Regional Information and Additional Rights

United Arab Emirates (PDPL 45/2021)
You have rights to access, rectify, erase, and restrict processing. You may lodge complaints with the UAE Data Office.

European Union / United Kingdom (GDPR / UK DPA 2018)
Lawful bases include contract, legal obligation, legitimate interests, and consent. You may complain to your local supervisory authority.

United States (California – CCPA/CPRA)
We do not sell or share personal information as defined by the CCPA/CPRA. California residents may request access or deletion by emailing info@oldcranegateway.com. We do not discriminate against individuals for exercising their rights. We honor browser-based opt-out signals where required by law and supported by our tools.

Canada (PIPEDA)
You may request access to or correction of your information and may withdraw consent subject to legal requirements. You may complain to the Office of the Privacy Commissioner of Canada.

Australia (Privacy Act 1988 / APPs)
We disclose that data may be transferred to our service providers in the United States and other jurisdictions with appropriate safeguards. You may contact us to access or correct your data or lodge a complaint.

14. Children’s Privacy

Our services are not intended for individuals under 18, and we do not knowingly collect their data.

15. Changes to This Policy

We may update this Policy periodically. The latest version will always be posted with an updated “Last updated” date. Continued use of our site or services after changes indicates acceptance.

16. Contact

For privacy inquiries or rights requests: info@oldcranegateway.com

Postal address: Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates