In accordance with The UAE Personal Data Protection Law (PDPL - Federal Decree-Law No. 45 of 2021)
Effective date: 1 August 2025
1. Introduction
Redwood Debt Collection Services LLC (“we,” “our,” or “us”) provides debt recovery services to businesses (“clients”). In doing so, we act as a data processor, handling personal data on behalf of and under the instruction of our clients, who are the data controllers.
This Privacy Policy explains how we process personal data, in compliance with the UAE Personal Data Protection Law (PDPL).
2. Role and Responsibility
Our Role as Data Processor
We process personal data provided by our clients to fulfil their instructions. This includes assisting with the recovery of outstanding balances owed by individuals or entities we refer to as debt account holders.
Clients as Data Controllers
Our clients determine the purpose and legal basis for processing personal data. They remain responsible for ensuring compliance with data protection laws in relation to their data collection and sharing practices.
3. Legal Basis for Processing
Under the PDPL, we process personal data where it is:
- Necessary for the performance of a contract to which the data subject (debt account holder) is a party.
- Necessary to fulfil our clients’ lawful interests in recovering outstanding balances, provided such interests do not override the rights of data subjects.
4. Data We Process
The types of personal data processed may include, but are not limited to:
- Contact information (e.g., name, address, email, phone number)
- Financial details (e.g., outstanding balances, payment history)
- Other information relevant to the contractual relationship (as provided by the client)
5. How We Use Data
As a processor, we use personal data strictly to:
- Facilitate communication between our clients and debt account holders.
- Support the resolution of outstanding balances.
- Provide updates and reports to our clients.
Additionally, we may share client and debt account holder data with Google to improve the experience for individuals searching online. This ensures they are directed away from sales-related advertisements and toward accurate, relevant information, such as payment options or support resources.
We do not use personal data for marketing or any purpose outside the scope defined by our clients.
6. Data Sharing and Transfers
We do not share personal data with third parties unless instructed by our clients or required by law.
Where data is transferred outside the UAE (for example, to the UK or EU), we ensure appropriate safeguards are in place, including standard contractual clauses or equivalent mechanisms recognised under the PDPL.
7. Data Retention
Personal data is retained only for as long as instructed by the client or as required by law. Upon completion of our services, data is securely returned or deleted, as per our agreements.
8. Rights of Data Subjects
Under the PDPL, individuals (data subjects) have the following rights:
- Right of Access - to request a copy of the personal data held.
- Right to Rectification - to correct inaccurate or incomplete data.
- Right to Erasure - to request deletion where data is no longer required.
- Right to Restrict Processing - to limit how data is processed.
- Right to Object - to object to certain types of processing.
- Right to Data Portability - to obtain and reuse personal data across services.
Exercising Your Rights: If you wish to exercise these rights, please contact the relevant data controller (our client) directly. As a processor, we will assist the controller in fulfilling such requests.
9. Data Security
We implement technical and organizational measures to protect personal data from unauthorized access, disclosure, alteration, and destruction. Regular audits and staff training ensure ongoing compliance with data protection requirements.
10. Contact Information
If you have any questions regarding this policy or how your data is handled, please contact our Data Protection Officer (DPO) at contactus@redwoodcollections.ae
