Privacy policy

Last updated: 3 November 2026

This policy explains how Milaya Capital collects and uses personal data when you visit milayacapital.com or contact us through it, and the rights you have over that data.

Who we are

Milaya Capital is a global investment group headquartered in Dubai, with hubs in London and Athens. This website, milayacapital.com, is operated by Milaya Capital from its head office at Marina Plaza, Office 1001, Al Marsa Street, Indigo Central 8, Dubai Marina, Dubai, United Arab Emirates. In this policy, ‘Milaya Capital’, ‘we’, ‘us’ and ‘our’ refer to that operator.

We are the controller of the personal data described in this policy, which means we decide why and how it is processed. We handle personal data in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, the ‘PDPL’). Because many of our visitors are in the United Kingdom and the European Economic Area (EEA), we also meet the standards of the UK General Data Protection Regulation (‘UK GDPR’) and the EU General Data Protection Regulation (‘EU GDPR’) where those laws apply to our processing.

If you have any questions about this policy or your personal data, please contact us at infomilayacapital.com.

Scope of this policy

This policy covers milayacapital.com only. The websites of our group companies and country sites, such as milayacapital.co.uk, and any third-party websites we link to have their own privacy notices, which apply when you use them.

This website is informational. It has no visitor accounts, takes no payments, sends no newsletters, and does not use your personal data for profiling or automated decision-making.

The personal data we collect

We collect only the personal data we need to run the website and to respond to you:

• Contact form enquiries. When you use our contact form, we collect your name, email address, company (if you choose to give it) and your message. The form cannot be sent unless you tick the consent box. Messages sent through the contact form are delivered by email to the Milaya Capital group’s central enquiries inbox (contactmilayacapital.com) and passed to the Milaya company best placed to reply.
• Correspondence. If you email us or reply to us, we receive your email address, the content of your message and any other details you choose to share.
• Technical data. When you visit the website, your browser automatically sends technical information to our hosting provider and to Cloudflare, which delivers and protects the website. This includes your IP address, browser type and version, the pages you request, the referring page and the date and time of your visit.
• Cookie choices. We store your cookie preferences in a small cookie so that we can respect them. See our Cookie policy.

To protect the contact form from spam, it contains hidden fields (a ‘honeypot’ field and a signed time check) that are checked on our server when you submit the form. These checks do not profile you and nothing from them is stored.

The contact form also shows Cloudflare Turnstile, a check that the message is sent by a person and not a bot, provided by Cloudflare, Inc. (United States), the security provider named below. When the form page loads, Turnstile runs in your browser and Cloudflare processes technical data (your IP address, browser and device characteristics, and interaction signals) only to tell people from bots; our server checks the result when you send the form. Turnstile shows no advertising, does not track you across websites and sets no cookies on our website’s domain. It is strictly necessary for the security of the form, so it runs without consent, and our lawful basis is our legitimate interests in keeping the website available and secure (see also Cloudflare’s privacy policy).

With your consent, we use Google Analytics to understand how visitors use this website (see ‘Google Analytics’ below). We do not use any advertising or social media tracking tools.

How we use your personal data and our lawful bases

We use your personal data only for the purposes below. Where the UK GDPR or EU GDPR applies, we rely on the lawful basis shown for each purpose.

• Responding to your enquiry: reading your message, passing it to the Milaya company best placed to reply, and replying to you. Lawful basis: our legitimate interests in answering enquiries and running our business, or taking steps at your request before entering into a contract.
• Running and securing the website: delivering pages, preventing spam, fraud and attacks, and fixing faults, using technical data and strictly necessary cookies. Lawful basis: our legitimate interests in keeping the website available and secure.
• Remembering your cookie choices: Lawful basis: compliance with our legal obligations on cookies, and our legitimate interests in respecting your preferences.
• Understanding how the website is used (only with your consent): statistics from Google Analytics, as described under ‘Google Analytics’ below. Lawful basis: your consent.
• Legal matters: keeping necessary records, responding to lawful requests from authorities, and establishing, exercising or defending legal claims. Lawful basis: compliance with legal obligations and our legitimate interests.

Where the PDPL applies, we rely on your consent, for example the consent you give by ticking the box on the contact form or by writing to us, or on another ground permitted by the PDPL, such as processing that is necessary to take steps at your request before entering into a contract or to comply with our legal obligations.

The tick box on the contact form confirms that you have read this policy and agree to us using your details to deal with your enquiry. We never use contact form details for marketing, and we do not sell your personal data. Where we rely on legitimate interests, we have balanced them against your rights and interests; you can ask us for more information about that assessment.

Who we share your personal data with

We share personal data only where necessary, and only with:

• our hosting provider, which hosts the website and processes server logs on our behalf;
• Cloudflare, Inc. (United States), which provides our content delivery network and security services;
• our email provider, which delivers contact form messages to the central enquiries inbox and stores our email;
• Milaya group companies, because contact form messages go to the group’s central enquiries inbox and are passed to the Milaya company best placed to reply;
• professional advisers, such as lawyers, auditors and insurers, where needed;
• authorities, courts and regulators, where we are required to do so by law or need to protect our legal rights.

Our service providers process personal data on our instructions and are bound by contractual obligations to keep it secure and confidential.

International transfers

Milaya Capital is based in the United Arab Emirates, the group has hubs in the United Kingdom and Greece, and Cloudflare is headquartered in the United States and operates a global network. Your personal data may therefore be processed outside your own country, including in countries whose laws offer a different level of protection.

When we transfer personal data, we protect it as the applicable law requires:

• for transfers out of the UAE, we follow the cross-border transfer rules of the PDPL, for example by transferring to countries with an adequate level of protection or under contractual safeguards;
• where the UK GDPR or EU GDPR applies, we rely on an adequacy decision or on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU–US Data Privacy Framework, as applicable;
• contact form messages are passed within the Milaya group to the company best placed to reply, which may be in another country; these transfers are protected by appropriate safeguards between the group companies concerned.

You can ask us for more information about the safeguards we use.

How long we keep your personal data

• Enquiries and correspondence: up to 24 months after our last contact with you. If a business relationship follows, we keep the relevant records for as long as the law requires, for example for accounting, tax or regulatory purposes.
• Server logs: typically up to 30 days, unless we need them for longer to investigate a security incident or abuse of the website.
• Cookies: for the periods set out in our Cookie policy. Your cookie choice is kept for 180 days.

We may keep data for longer where this is needed to establish, exercise or defend legal claims. When we no longer need personal data, we delete or anonymise it securely.

How we protect your personal data

We use appropriate technical and organisational measures to protect personal data, including encrypted (HTTPS) connections, Cloudflare’s security services, access controls that limit who can see enquiries, and keeping the website software up to date. No transmission over the internet is completely secure, so please do not send us confidential or sensitive information through the contact form.

Your rights

Depending on the law that applies to you, you have some or all of the following rights:

• access: to be told whether we process your personal data, to receive information about how we do so and to receive a copy of it;
• correction: to have inaccurate or incomplete personal data corrected;
• erasure: to have your personal data deleted where there is no good reason for us to keep it;
• restriction: to ask us to limit how we use your personal data;
• objection: to object to processing based on our legitimate interests, and to ask us to stop processing;
• portability: to receive personal data you have given us in a structured, commonly used format, or to have it sent to another organisation;
• withdrawing consent: where we rely on consent, to withdraw it at any time, without affecting processing that took place before;
• automated decisions: not to be subject to decisions based solely on automated processing that significantly affect you. We do not make any such decisions.

To exercise any of these rights, email us using the contact details above. We may need to confirm your identity before we act. There is normally no charge. We aim to respond within one month and, in any event, within the period required by the law that applies to you; we will tell you if we need longer.

Complaints

If you are unhappy with how we have handled your personal data, please contact us first so that we can try to put things right. You also have the right to complain to a data protection authority:

• in the United Arab Emirates, the UAE Data Office;
• in the United Kingdom, the Information Commissioner’s Office (ico.org.uk);
• in the EEA, the data protection supervisory authority in the country where you live or work, or where the issue arose.

Google Analytics

If you allow analytics cookies in our cookie banner, we use Google Analytics, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC (United States). It shows us how visitors use the website, for example which pages are viewed, how visitors find us and roughly where they are, so that we can improve it. Without your consent, the Google Analytics code is not loaded and nothing is sent to Google.

Google Analytics processes data about your visit: the pages you view, the time and length of your visit, the website you came from, your browser, device, operating system, screen size and language, and your approximate location (city or region, derived from your IP address). It uses the cookies listed in our Cookie policy. Google Analytics 4 does not log or store full IP addresses. We use this data only in aggregated form to improve the website; we do not use it to identify you and we do not use it for advertising.

Lawful basis: your consent. You can withdraw it at any time through Cookie settings; this does not affect processing that took place before you withdrew it.

Google processes this data on our behalf under its data processing terms. It may be transferred to Google LLC in the United States, which is certified under the EU-U.S. Data Privacy Framework and its UK extension, and Google also relies on Standard Contractual Clauses. Google Analytics data is kept for no longer than 14 months.

More information: Google’s privacy policy and how Google uses information from websites that use its services. You can also use the Google Analytics opt-out browser add-on.

Cookies

We use strictly necessary cookies, including Cloudflare security cookies and a cookie that remembers your consent choices, and, only if you allow them through our cookie banner, Google Analytics cookies (see ‘Google Analytics’ above). We do not use marketing cookies. For full details, see our Cookie policy. You can change your choices at any time through Cookie settings.

Children

This website is intended for adults and is not aimed at anyone under 18. We do not knowingly collect personal data from children. If you believe that a child has sent us personal data, please contact us and we will delete it.

Changes to this policy

We may update this policy from time to time, for example if we change how the website works or if the law changes. The date shown on this page tells you when it was last updated. If we make significant changes, we will make them clear on the website.

Contact us

You can contact us by email or by post using the contact details above.