Data processing
How AES uses and shares personal data
This notice explains how personal data may be processed across the AES group when we provide services to clients. It is designed to give clients a clear group-wide explanation of how data may move (including between AES entities), while making clear that the specific terms applying to each client are set out in that client’s Terms of Business and related data protection appendix.
AES follows a group-wide approach to protecting personal data, based on principles of transparency, fairness, security, accountability and respect for individual rights.
This notice is separate from the website privacy policy. The website is owned and operated by AES Financial Services Ltd in the UK. However, AES clients may contract with different AES entities depending on the services they receive and the jurisdiction in which those services are provided.
Which AES entity applies to you?
The AES entity responsible for your personal data depends on the service you receive and the Terms of Business you have accepted. In broad terms:
- AES Financial Services Ltd is responsible for UK client relationships and applies the UK General Data Protection Regulation and Data Protection Act 2018, referred to in this notice as the UK rules.
- AES Financial Services Ltd, DIFC Branch is responsible for relevant DIFC client relationships and applies DIFC Data Protection Law No. 5 of 2020 and associated regulations, including where relevant Regulation 10 on autonomous and semi-autonomous systems, referred to in this notice as the DIFC rules.
- AES Middle East Insurance Broker LLC is responsible for relevant UAE onshore client relationships and applies Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, referred to in this notice as the UAE rules.
Your own Terms of Business and data protection appendix explain which AES entity applies to you, what personal data is processed, the purposes for processing, the applicable legal basis and your rights. If anything in this notice appears to differ from your Terms of Business, the Terms of Business for your client relationship should be treated as the client-specific document.
Why AES processes personal data
AES processes personal data so that it can provide and administer services to clients, meet legal and regulatory obligations, manage risk, prevent financial crime, keep accurate records, respond to client requests, improve services and communicate with clients where appropriate.
Depending on the service, this may include processing information needed for client onboarding, suitability or insurance assessments, anti-money laundering and sanctions checks, servicing and administration, complaints handling, audits, compliance reviews and communications with regulators or professional advisers.
AES processes personal data only where there is an appropriate legal basis to do so under the applicable UK rules, DIFC rules or UAE rules. Depending on the circumstances, this may include processing that is necessary to provide services, perform a contract, comply with legal or regulatory obligations, protect legitimate interests, protect vital interests or, where required, obtain and rely on consent.
How data may be shared within AES
AES operates across the UK, DIFC and UAE. To provide services effectively, AES entities may share personal data with each other under intra-group service, support and data sharing arrangements. This may include shared technology, operations, compliance, risk, finance, client servicing, record keeping and management support.
Where data is shared between AES entities, AES applies appropriate safeguards designed to protect personal data and ensure it is used only for legitimate business, client service, legal or regulatory purposes. These safeguards include access controls, confidentiality obligations, data minimisation, secure systems, contractual protections and oversight by Compliance and IT.
Personal data may also be shared with professional advisers, auditors, technology providers, cloud service providers and other carefully selected service providers where this is necessary to provide services, operate the business, comply with legal or regulatory obligations or protect legitimate business interests.
Use of technology-assisted processing
AES may use approved technology tools, including artificial intelligence, automation, transcription, workflow, document preparation, monitoring and analysis tools, to help authorised AES personnel provide services and operate the business. These tools may support tasks such as gathering information, preparing records, reviewing documents, monitoring compliance, improving workflows and responding to client needs.
Technology-assisted processing is used to support people, not to replace them. AES does not use such systems to make solely automated investment, suitability, insurance, transactional or other decisions that produce legal or similarly significant effects for clients. Where technology is used, AES applies human oversight, access controls, data minimisation and appropriate review before information is used or shared.
AES remains responsible for decisions made in connection with its services and does not rely on technology alone when making decisions that affect clients.
Where the DIFC rules apply, AES will also consider any additional requirements for autonomous or semi-autonomous systems, including transparency, accountability, risk assessment and appropriate oversight.
International transfers and safeguards
Because AES operates internationally and uses common group systems, personal data may be accessed or processed outside the jurisdiction in which it was first collected. Where this happens, AES applies the transfer rules and safeguards required by the UK rules, DIFC rules or UAE rules, as applicable. Where possible, AES applies a consistent group standard designed to protect client data across all AES entities.
AES maintains technical and organisational security measures designed to protect personal data against unauthorised access, misuse, alteration, loss or disclosure. These measures are reviewed periodically and are intended to be proportionate to the nature, sensitivity and risk associated with the information being processed.
Your rights and how to contact us
Clients and other individuals may have rights under the UK rules, DIFC rules or UAE rules, depending on the AES entity and service involved. These may include rights to access personal data, correct inaccurate data, request deletion or restriction, object to certain processing, withdraw consent where consent is relied on, and complain to the relevant data protection authority.
If you have questions about how your personal data is processed, wish to exercise a data protection right, make a complaint, or are unsure which AES entity applies to you, please contact us at compliance@aesinternational.com. We will direct your query to the appropriate AES entity or responsible team.
Relationship with other documents
This notice is intended to help clients understand the group-wide approach to data processing. It should be read alongside the relevant AES Terms of Business, data protection appendix and any privacy notice or client communication provided in connection with the specific service. The website privacy policy remains separate and explains how AES Financial Services Ltd processes data in connection with the UK-owned website and associated digital services.
This notice may be updated from time to time to reflect legal, regulatory, operational or technology changes.