3.1 Overview
In addition to Personal Data, under certain Data Protection Laws there are also specified categories of personal data that require further protection, these categories are known as "Special Category Data" and include: data relating to your health, genetic or biometric data, criminal convictions, sex life or sexual orientation, racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership. We may, in some circumstances, as outlined in this Notice need to collect and Process your Special Category data where we have your consent to do so (if applicable) or in the circumstances detailed below, depending on your relationship with us (to the extent permitted under applicable law).
If you are required to provide any personal data to us which relates to other individuals, you agree that you will inform them about the contents of this Notice and obtain any required consent in accordance with this Notice.
More information on the types of personal data that we will collect and Process about you is detailed below. Please note that depending on your relationship with us (i.e., whether you are a customer of ADNOC, candidate applying to work at ADNOC, a supplier / third party provider we use to run our business, a visitor to an ADNOC office or a website user), the personal data that we collect about you will vary so please view the relevant section below which best describes your relationship with us.
3.2 Business Customer Contacts
This section will apply to you if you are an ADNOC business customer or key contact or representative with whom we liaise as a prospective or existing business customer.
(a) What personal data do we collect and Process about you?
- name;
- contact details such as phone number and email address;
- company you work for, job title and the department you work in;
- username and password information used to log into our customer portal; and
- any information captured and recorded during any correspondence with you such as telephone calls, and/or other written or email correspondence and may include notes and records of correspondence and recordings of telephone calls
We do not collect or Process any special category data about you.
(b) How will we collect your personal data?
All personal data is collected directly from you or from one of your colleagues.
(c) What will we use your personal data for?
We only Process personal data for the purposes described in this Notice. Certain Data Protection Laws require companies to have a "lawful basis" to collect and use personal data. Our 'lawful bases' will be:
- it is necessary for legitimate business interests pursued by us or a third party and your interests and fundamental rights do not override those interests; or
- it is necessary to comply with our legal obligations.
| Purpose for Processing | Legal grounds for using personal data |
|---|---|
| To manage our customer relationships, generally communicate with you and assist with any complaints you may have | We have your consent or we have a legitimate business interest (to handle and assist with any complaints you may have and correspond with you as our key customer contact and maintain our relationships with customers). |
| For general internal business management purposes such as audit; security and accounting purposes; record-keeping and obtaining legal or professional advice from external advisers | We have your consent or we have a legitimate business interest (to operate and run our business and to comply with audit requirements). We have a legal obligation to protect your personal data. |
| To record calls for training and monitoring purpose | We have your consent or we have a legitimate business interest (to ensure performance quality). |
| To comply with our legal obligations which may include disclosing information, if legally required, to data protection regulators, law enforcement such as the police and tax authorities, governmental and public authorities | We have a legal obligation. |
| For business development purposes and to market our services to you and to undertake analytics to improve our services | We have your consent or we have a legitimate business interest (to market our services which we think you might be interested in and to improve our services). |
| For purposes related to a merger, acquisition, sale or restructure | We have your consent or we have a legitimate business interest (to buy and sell companies as appropriate). |
(d) Who will we share your personal data with?
We may share your personal data:
- amongst the ADNOC Group;
- with our third-party service providers who we engage to provide ADNOC with fundamental business support required to run our operations efficiently; these include but are not limited to IT suppliers, document management providers, software platform providers and information security providers;
-
in the event of restructuring or re-organization, merger, sale of the business or acquisition:
- any person to whom we may assign or transfer our rights and/or obligations under our agreement with you or any third party;
- any companies that are in the process of joining the ADNOC Group or acquiring any ADNOC Group company; and
- legal and technical advisers to facilitate the transaction; and
- with data protection regulators, law enforcement such as the police and tax authorities, governmental and public authorities.
All members of the ADNOC Group and third-party providers are required to take appropriate security measures to protect your Personal Data in line with our policies.
3.3 Consumers
This section will apply if you are a prospective or current ADNOC consumer customer (e.g., a customer of ADNOC Distribution petrol stations in Abu Dhabi).
Any consumer personal data collected by ADNOC Distribution is covered by the ADNOC Distribution privacy notice which can be found here.
3.4 Candidates applying to work at ADNOC
This section applies to individuals applying to work at ADNOC. If, in your application, you provide personal data relating to others (e.g., referees or next of kin), you agree to inform them about this Notice and obtain any required consent.
(a) What personal data do we collect and Process about you?
This section will apply to individuals applying to work at ADNOC. If, in your application, you provide us with personal data to us which relates to other individuals (e.g., referees or next of kin), you agree that you will inform them about the contents of this Notice and obtain any required consent in accordance with this Notice.
(a) What personal data do we collect and Process about you?
- name, date of birth and gender;
- contact details, including address and address history, telephone numbers and email address;
- your marital/dependent status including next of kin and emergency contact details;
- identity documents including copies of passports, driving license details, identification details (such as your country or state identification number) and visa or citizenship details;
- recruitment information details of your previous employment, such as the company you worked for, your job title, and the department you worked in;
- financial information, including bank details for payment purposes;
- information relating to your employment status, job title, and industry of work;
- information obtained as part of our onboarding, or due diligence checks;
- where relevant to the role you are applying for, information obtained as a result of background screening checks such as background checks, e.g., criminal checks, credit checks, sanctions or other screening checks, carried out as part of the recruitment and onboarding stage; and
- security and monitoring information such as CCTV footage when you visit our office for an interview.
We also typically Process the following types of Special Category data about you:
- information about your health including disability information, medical conditions, and health and sickness records; and/or
- information about any criminal convictions that you declare to us.
(b) How will we collect your personal data?
- directly from you when you apply to work at ADNOC or during any form of communications such as face to face, written and phone correspondence or from interviews and assessment panels involved in the recruitment process;
- from correspondence with you on LinkedIn;
- from publicly available professional sources, where permitted by law;
- from recruitment talent management and employment agencies; and
- background check providers, once an offer of employment is made.
(c) What will we use your personal data for?
- it is necessary in order to take steps to enter into a contract with you;
- it is necessary to comply with our legal obligations; and/or
- it is necessary for legitimate business interests pursued by us or a third party and your interests and fundamental rights do not override those interests. In each case we will always consider your interests and undertake a balancing exercise to ensure that our business interest does not cause you harm or override your own interests.
We need to have an additional Processing condition in the event that we Process your special category data. In those limited circumstances, only in compliance with the law where we have your consent to do so (if applicable), we will rely on the following (to the extent permitted under applicable law):
- we have your explicit written consent;
- it is necessary in connection with any existing/prospective legal claims, to obtain legal advice or for the establishment, exercise or defense of legal claims; or
- we need to use your special category data to prevent or detect unlawful acts and this use is in the substantial public interest.
| Purpose for Processing | Legal grounds for using personal data |
|---|---|
|
For the purposes of the recruitment cycle including: • considering your suitability for the role; • conducting and arranging interviews; • carrying out background and criminal checks; • determining the terms on which you would work for us and negotiating your employment contract; • record‑keeping purposes; and • general correspondence with you. |
• It is necessary in order to take steps to enter into a contract with you. • We have your consent or it is necessary for legitimate business interests (to undertake recruitment). Special category data. • You have given us explicit consent. • It is in the substantial public interest to prevent/detect unlawful acts. |
| For internal business management purposes such as audit; security and accounting purposes; obtaining legal or professional advice from external advisers |
• We have your consent or we have a legitimate business interest (to operate and run our business and to comply with audit requirements). • We have a relevant legal obligation to protect your personal data. Special category data. • We have your explicit consent. • We need to use your information in order to establish, exercise or defend our legal rights. |
| To comply with our legal obligations which may include disclosing information, if legally required, to data protection regulators, law enforcement such as the police and tax authorities, governmental and public authorities | • We have a legal obligation. |
| For purposes related to a merger, acquisition, sale or restructure | • We have your consent or we have a legitimate business interest (to buy and sell companies as appropriate). |
(d) Who will we share your personal data with?
We may share your personal data:
- amongst the ADNOC Group;
- recruiters and your referees;
- background check providers;
- with our third-party service providers who we engage to provide ADNOC with fundamental business support required to run our operations efficiently; these include but are not limited to IT suppliers, document management providers, software platform providers and information security providers;
-
in the event of restructuring or re-organization, merger, sale of the business or acquisition:
- any person to whom we may assign or transfer our rights and/or obligations under our agreement with you or any third party;
- any companies that are in the process of joining the ADNOC Group or acquiring any ADNOC Group company; and
- legal and technical advisers to facilitate the transaction; and
- with data protection regulators, law enforcement such as the police, governmental and public authorities for security clearance, medical, and visa requirements.
All members of the ADNOC Group and third-party providers are required to take appropriate security measures to protect your Personal Data in line with our policies.
3.5 Suppliers or Third Parties
This section will apply to you if you are a sole trader supplier or third party or contact at a corporate supplier or third party with whom we engage with as part of our day-to-day business operations.
(a) What personal data do we collect and Process about you?
- name, date of birth and gender;
- contact details, including address and address history, telephone numbers and email address;
- company you work for, job title and the department you work in; and
- financial information, including bank details for payment;
- information we collect about your employment status, job title and work industry;
- information we collect about you as a result of our onboarding, procurement or due diligence checks; and
- any information captured and recorded during any correspondence with you such as telephone calls, and/or other written or email correspondence and may include notes and records of correspondence and recordings of telephone calls.
We typically Process the following types of special category data: information about any criminal convictions you may have including offences and alleged offences and any court sentence or unspent criminal conviction.
(b) How will we collect personal data?
- Directly from you.
From third parties including:
- introducers; and
- publicly available sources.
(c) What will we use your personal data for?
- it is necessary to perform our contract with you;
- it is necessary to comply with our legal obligations; and/or
- it is necessary for legitimate business interests pursued by us or a third party and your interests and fundamental rights do not override those interests. In each case we will always consider your interests and undertake a balancing exercise to ensure that our business interest does not cause you harm or override your own interests.
| Purpose for Processing | Legal grounds for using personal data |
|---|---|
| To manage our supplier/third party relationships, generally communicate with you and assist with any complaints you may have |
• We have a legitimate business interest (to handle and assist with any complaints you may have
and correspond with you as our supplier or key supplier contact and maintain our relationship). • It is necessary to perform our contract with you. |
| To engage and onboard suppliers, business partners and third parties and fulfil our contractual obligations |
• It is necessary to perform our contract with you. • We have a legitimate business interest (to engage third parties for business purposes). • We have a relevant legal obligation to protect your personal data. |
| For general internal business management purposes such as: audit; security and accounting purposes; record‑keeping and obtaining legal or professional advice from external advisers |
• We have a legitimate business interest (to operate and run our business and to comply with audit requirements). • We have a legal obligation to protect your personal data. |
| To comply with our legal obligations which may include disclosing information, if legally required, to data protection regulators, law enforcement such as the police and tax authorities, governmental and public authorities | • We have a legal obligation. |
| For purposes related to a merger, acquisition, sale or restructure | • We have a legitimate business interest (to buy and sell companies as appropriate). |
(d) Who will we share your personal data with?
We may share your personal data:
- amongst the ADNOC Group;
- with our third-party service providers who we engage to provide ADNOC with fundamental business support required to run our operations efficiently; these include but are not limited to IT suppliers, document management providers, software platform providers and information security providers; or
-
in the event of restructuring or re-organization, merger, sale of the business or acquisition:
- any person to whom we may assign or transfer our rights and/or obligations under our agreement with you or any third party;
- any companies that are in the process of joining the ADNOC Group or acquiring any ADNOC Group company; and
- legal and technical advisers to facilitate the transaction; and
- with data protection regulators, law enforcement such as the police and tax authorities, governmental and public authorities.
All members of the ADNOC Group and third-party providers are required to take appropriate security measures to protect your Personal Data in line with our policies.
3.6 Office Visitors
This section will apply to you if you are visiting an ADNOC office.
(a) What personal data do we collect and Process about you?
- name;
- contact details such as phone number and email address and emergency contact information;
- company you work for, job title and the department you work in;
- ID numbers/passport numbers;
- any information captured and recorded during any correspondence with you such as telephone calls, and/or other written or email correspondence and may include notes and records of correspondence and recordings of telephone calls; and
- security and monitoring information such as CCTV footage.
We also typically Process the following types of special category data about you:
- biometric data including facial recognition and face geometry.
(b) How will we collect your personal data?
All personal data is collected directly from you.
(c) What will we use your personal data for?
We only Process personal data for the purposes described in this Notice. Certain Data Protection Laws require companies to have a "lawful basis" to collect and use personal data. Our 'lawful bases' will be:
- it is necessary for legitimate business interests pursued by us or a third party and your interests and fundamental rights do not override those interests. In each case we will always consider your interests and undertake a balancing exercise to ensure that our business interest does not cause you harm or override your own interests; or
- it is necessary to comply with our legal obligations.
We need to have an additional Processing condition in the event that we Process your special category data. In those limited circumstances, we will rely on the following:
- We have your explicit consent.
| Purpose for Processing | Legal grounds for using personal data |
|---|---|
| To communicate with you and assist you when you visit our offices | • We have a legitimate business interest (to correspond with you when you are visiting our offices). |
| For general internal business management purposes such as security (through use of CCTV footage) and record‑keeping |
• We have a legitimate business interest (to operate and run our business and to keep records of office visitors). • We have a legal obligation to protect your personal data. Special category data. • We have your explicit consent. • We ensure your health and safety in our workplace. |
| To comply with our legal obligations which may include health and safety compliance and disclosing information, if legally required, to data protection regulators, law enforcement such as the police, governmental and public authorities | • We have a legal obligation. |
(d) Who will we share your personal data with?
We may share your personal data:
- amongst the ADNOC Group;
- with our third-party service providers who we engage to provide ADNOC with fundamental business support required to run our operations efficiently; these include but are not limited to IT suppliers, CCTV providers, software platform providers and information security providers; and
- with data protection regulators, law enforcement such as the police and tax authorities, governmental and public authorities.
All members of the ADNOC Group and third-party providers are required to take appropriate security measures to protect your Personal Data in line with our policies.
3.7 Website Users
This section will apply to you if you are visiting an ADNOC website.
(a) What personal data do we collect and Process about you?
- name and contact details such as phone number and email address and emergency contact information;
- company you work for, job title and the department you work in;
- any questions, queries or feedback you leave via our webforms, when you complete an enquiry form or when you chat with us on a website;
- information about your preferences when you sign up for email;
- any information captured and recorded during any correspondence with you such as telephone calls, and/or other written or email correspondence and may include notes and records of correspondence and recordings of telephone calls; and
- information obtained through our use of cookies and similar technologies such as IP address and device identification. Please see our cookies policy [insert hyperlink once drafted] for more information.
We do not collect or Process any special category data about you.
(b) How will we collect your personal data?
All personal data is collected directly from you or your device.
(c) What will we use your personal data for?
We only Process personal data for the purposes described in this Notice. Certain Data Protection Laws require companies to have a "lawful basis" to collect and use personal data. Our 'lawful bases' will be:
- it is necessary for legitimate business interests pursued by us or a third party and your interests and fundamental rights do not override those interests. In each case we will always consider your interests and undertake a balancing exercise to ensure that our business interest does not cause you harm or override your own interests;
- where we have your consent; or
- it is necessary to comply with our legal obligations.
| Purpose for Processing | Legal grounds for using personal data |
|---|---|
| To communicate with you and respond to your enquiry/chats | • We have a legitimate business interest (to respond to any enquiries you submit via an ADNOC website). |
| For general internal business management purposes such as: audit; security and accounting purposes; record‑keeping and obtaining legal or professional advice from external advisers |
• We have a legitimate business interest (to operate and run our business and to comply with audit requirements). • We have a legal obligation to protect your personal data. |
| To comply with our legal obligations | • We have a legal obligation. |
| To send you email marketing based on how you interact with our website | • We have your consent. |
| To deploy cookies and other similar tracking technologies |
• We have a legitimate business interest (to deploy cookies that are strictly necessary to ensure our websites can operate and function). • We have your consent. |
(d) Who will we share your personal data with?
We may share your personal data:
- amongst the ADNOC Group;
- with our third-party service providers who we engage to provide ADNOC with fundamental business support required to run our operations efficiently; these include but are not limited to IT suppliers, website providers and information security providers; and
- with data protection regulators, law enforcement such as the police and tax authorities, governmental and public authorities.
All members of the ADNOC Group and third-party providers are required to take appropriate security measures to protect your Personal Data in line with our policies.