At Baker And Co. Associates, we prioritize your privacy and are committed to protecting your personal information. This policy outlines how we collect, use, and safeguard your data.
Last updated: 18 October 2026
This Privacy Policy explains how Baker and Co Associates LLC-FZ (“Baker & Co”, “we”, “us”, “our”) collects, uses, shares and protects personal data when you visit our websites bakerandco.ae and ar.bakerandco.ae, contact us, use our eligibility checker, register for an event, apply for a job, or become our client.
Controller. Baker and Co Associates LLC-FZ, Office 102, Dubai Supreme Court Complex, Umm Hurair 2, Dubai, United Arab Emirates, is the controller (“data controller”) responsible for your personal data under this policy.
Our affiliate in Portugal. Our affiliate Baker and Co Associates LDA, Lisbon, Portugal (WhatsApp +351 938 552 466, website bakerandco.pt), works with us on cases involving Portugal and the European Union, and the two companies may share personal data and systems, such as our in-house client relationship management (CRM) system, where needed for an enquiry or case. Where the Lisbon office handles your enquiry or case, or where you use bakerandco.pt, Baker and Co Associates LDA acts as controller or joint controller together with us, as described in the bakerandco.pt privacy policy. Baker and Co Associates LLC-FZ has designated Baker and Co Associates LDA as its representative in the European Union for the purposes of Article 27 of the EU General Data Protection Regulation (GDPR).
This policy applies to personal data we process about website visitors, people who contact us or submit enquiries (including through Facebook and Instagram lead forms), newsletter subscribers, event attendees, job applicants, clients, and family members or dependants included in a client’s application. It does not apply to the data practices of third-party websites, platforms or authorities, which have their own policies.
This policy is an information notice. The services we provide to clients are governed by our client engagement agreement and Terms and Conditions. If there is any conflict between those terms and this policy about how we handle personal data, this policy prevails.
| Context | Personal data |
|---|---|
| Enquiry and assessment forms, eligibility checker | Name, email address, phone/WhatsApp number, nationality, country of residence, the programme you are interested in, financial details (for example budget, income, assets or source of funds), professional details (for example occupation, employer, qualifications, experience), and any other information you choose to provide. |
| Facebook and Instagram lead forms | The details you submit in the Meta lead form (typically name, email, phone number and answers to our questions), together with information about the advertisement and form you responded to. |
| Newsletter sign-ups | Name (if given), email address, language preference and your subscription choices. |
| Event registrations | Name, contact details, the event you registered for, attendance, and any questions or requirements you share. |
| Job applications | CV, cover letter, contact details, employment and education history, skills, right-to-work information, references and any other information in your application. |
| Client case files | Identity data (for example passport, ID card, photographs, date and place of birth, nationality, civil status); family data (spouse, children, parents and other dependants, marriage and birth certificates); financial data (bank statements, proof of income, assets, investments, source of funds and source of wealth, tax documents); employment data (contracts, employer letters, CV, qualifications); travel and immigration history (visas, residence permits, entry and exit records); addresses; and any other document an authority requires, which may include health certificates, medical insurance and police or criminal-record certificates. |
| Communications | The content and details of your communications with us by phone, email and WhatsApp, including messages, documents and voice notes you send. |
Where you give us data about another person (for example a spouse, child or other dependant), see section 16.
Providing personal data is voluntary, but if you do not provide the data we need for an enquiry, an application or a legal requirement, we may be unable to answer you or provide our services.
When you use our websites we, and our service providers, collect technical data such as IP address, approximate location derived from it, device and browser type, pages viewed, time spent, referring website, and interactions with forms and buttons. With your consent where required, we use cookies and similar technologies for analytics and advertising (see section 7).
Our first-party cookie bc_src records how you reached our website: the referring website, marketing campaign parameters (UTM tags), advertising click identifiers (such as Google or Meta click IDs) and your landing page. If you submit an enquiry form, this source information is attached to the internal notification we receive about your enquiry so that we know which channel brought you to us. Where consent is required, this cookie is set only after you accept analytics cookies.
Immigration and residency applications can require data that the law treats as sensitive or special category data, such as passport and government identification numbers, citizenship and immigration status, health information (for example medical certificates or insurance required by an authority), biometric data (for example photographs used for identification) and criminal-record data (for example police clearance certificates). Some documents may also reveal racial or ethnic origin or religious beliefs.
We collect and use this data only where it is needed for the service you have asked for or required by the authority concerned, and only:
We do not use sensitive data for marketing, advertising or profiling, and we do not sell or share it for cross-context behavioural advertising. Access is restricted to staff and partners working on your case. You can withdraw your consent at any time, but this will not affect processing already carried out and may mean we can no longer progress your application.
Please do not send sensitive documents through our website forms, social media messages or lead forms. We will tell you how to send case documents securely once your case begins.
The table below lists our purposes and, for persons covered by the EU GDPR or UK GDPR, the legal basis we rely on. Under the UAE Personal Data Protection Law, we rely on your consent or on the exceptions the law provides (such as performance of a contract you have requested, compliance with a legal obligation, or the establishment or defence of legal claims).
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Responding to enquiries, assessment requests, eligibility-checker submissions and lead-form submissions; contacting you by phone, email or WhatsApp about your request | Steps taken at your request before entering into a contract (Art. 6(1)(b)); our legitimate interest in responding to people who contact us (Art. 6(1)(f)) |
| Providing our services: assessing eligibility, preparing, translating and submitting applications, liaising with authorities, embassies, consulates and partners, and managing your case | Performance of our contract with you (Art. 6(1)(b)); for sensitive data, your explicit consent (Art. 9(2)(a)) and the establishment, exercise or defence of legal claims (Art. 9(2)(f)); for criminal-record data, Art. 10 GDPR together with your consent where national law allows it (in the UK, the conditions in Schedule 1 to the Data Protection Act 2018) |
| Processing data about family members and dependants included in an application | Performance of the contract with the main applicant and our legitimate interest in processing the family application requested (Art. 6(1)(b) and (f)); explicit consent for sensitive data (Art. 9(2)(a)), given by the person concerned or by a parent or guardian |
| Managing our client relationships and CRM, keeping records, billing, quality control and training | Performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)); legitimate interests in running our business efficiently (Art. 6(1)(f)) |
| Sending newsletters, event invitations and information about our services | Your consent (Art. 6(1)(a)); or, for existing clients where the law permits, our legitimate interest in telling you about similar services (Art. 6(1)(f)), with the right to opt out at any time |
| Organising events and webinars | Performance of a contract or steps at your request (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
Website analytics, attribution of enquiries to marketing channels (bc_src cookie), advertising measurement and remarketing through Google and Meta | Your consent (Art. 6(1)(a)) and, for cookies, Article 5(3) of the ePrivacy Directive as implemented by Portuguese Law No. 41/2004 and the UK Privacy and Electronic Communications Regulations (PECR) |
| Recruitment: assessing job applications | Steps at your request before entering into a contract (Art. 6(1)(b)); legitimate interests in recruiting suitable staff (Art. 6(1)(f)) |
| Keeping our websites and systems secure, preventing fraud and misuse | Legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) |
| Complying with laws, regulations, court orders and lawful requests from authorities; establishing, exercising or defending legal claims | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)); Art. 9(2)(f) for sensitive data |
Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You can ask us for more information about this balancing test. Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.
We use cookies and similar technologies (such as pixels, tags and local storage). Strictly necessary cookies are always active. Analytics, attribution and advertising cookies are used only if you accept them in our cookie banner. You can change your choices at any time through the “Cookie settings” link in the footer of every page. Full details, including a list of cookies, are in our Cookie Policy.
We send newsletters and marketing messages by email, phone or WhatsApp only where you have consented or where the law otherwise permits it (for example to existing clients about similar services, where allowed). You can opt out at any time by using the unsubscribe link in any email, replying “STOP” to a WhatsApp message, or contacting us at info@bakerandco.ae. We keep a record of your opt-out so that we can respect it. Opting out of marketing does not affect service messages about an enquiry or case.
We never sell your personal data for money. We share personal data only as follows:
We operate from the United Arab Emirates and Portugal, and our work necessarily involves sending data to other countries, including Portugal, Spain and other EU member states, the United Kingdom, Caribbean citizenship-by-investment countries and any other country whose programme you apply for. Our service providers may also process data in other countries, including the United States and the EU.
Some of these countries do not provide the same level of data protection as your home country. Where the law requires, we protect transfers by:
Immigration authorities in the destination country will process your data under their own laws, over which we have no control. You can ask us for more information about transfers and the safeguards used.
| Data | Retention period |
|---|---|
| Enquiries, assessment requests, eligibility-checker submissions, lead-form leads and event registrations that do not become a client case | 24 months after our last contact with you |
| Client case files | For the duration of the case plus 5 years, or longer where a law requires it (for example tax, accounting or anti-money-laundering rules) or where needed to establish, exercise or defend legal claims |
| Job applications and CVs | 12 months after we receive your application, unless you join us or ask us to delete it sooner |
| Newsletter subscriptions | Until you unsubscribe; we then keep your email address on a suppression list so that we do not contact you again |
| Cookies | As set out in our Cookie Policy |
When a retention period ends, we delete or anonymise the data. Backups are overwritten on a rolling basis. Partners, authorities and independent controllers retain data under their own policies and laws.
We use appropriate technical and organisational measures to protect personal data, such as encrypted connections (HTTPS), access controls limited to staff who need the data, strong authentication, confidentiality obligations for staff and partners, and contracts with our service providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach occurs that is likely to put your rights at risk, we will notify you and the competent authorities as required by law.
Depending on where you live and the law that applies, you may have the right to:
How to exercise your rights. Email info@bakerandco.ae with “Privacy request” in the subject line, or contact us using the details in section 21. To protect you, we may need to verify your identity before acting on a request, and we will ask only for the information we need to do so. You can use an authorised agent where the law permits; we may ask for proof of their authority. We respond within the time required by applicable law (for example, one month under the GDPR and UK GDPR, which may be extended by two further months for complex requests, and 45 days under the CCPA, extendable once by 45 days). Requests are free of charge unless they are manifestly unfounded or excessive.
These rights are not absolute. We may refuse or limit a request where the law allows, for example where we must keep data to comply with a legal obligation, to establish or defend legal claims, or where a request would disclose another person’s data. We will explain our reasons. We will not discriminate against you for exercising your rights.
We process personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and any executive regulations and decisions issued under it. Under the PDPL you have the right to obtain information about your data, to data portability, to correction or erasure, to restriction of processing, to stop processing, and to object to decisions based on automated processing. Where we rely on consent, it is specific, clear and unambiguous, and you may withdraw it at any time. If you are not satisfied with our response, you may complain to the UAE Data Office or its successor federal authority. Where you deal with us in a UAE free zone that has its own data protection law, that law may also apply.
For persons in the EEA, we process personal data in accordance with Regulation (EU) 2016/679 (GDPR), Portuguese Law No. 58/2019 of 8 August, and Portuguese Law No. 41/2004 of 18 August (as amended) on privacy in electronic communications. Baker and Co Associates LDA in Lisbon is the controller or joint controller for EEA visitors to bakerandco.pt and for cases handled by our Lisbon office, and is the EU representative of Baker and Co Associates LLC-FZ. You have the rights described in section 13, including the right to object at any time to processing for direct marketing, and the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD) or another EEA supervisory authority.
For persons in the United Kingdom, we process personal data in accordance with the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended. You have the rights described in section 13 and may complain to the Information Commissioner’s Office (ICO). Our UK representative is identified in section 1.
This section applies to residents of US states with consumer privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA), to the extent those laws apply to us. It supplements the rest of this policy.
Categories of personal information collected in the last 12 months (sources, purposes and recipients are described in sections 4, 6 and 9):
| Category (CCPA) | Examples | Disclosed for a business purpose to | “Sold” or “shared”? |
|---|---|---|---|
| Identifiers | Name, email, phone/WhatsApp number, IP address, cookie and advertising identifiers, passport number | Service providers; partners and authorities at your direction | Online identifiers only, to Google and Meta through advertising cookies, if you have not opted out |
| Customer records (Cal. Civ. Code § 1798.80(e)) | Contact details, financial information, employment and education details | Service providers; partners and authorities at your direction | No |
| Protected classification characteristics | Age, nationality, citizenship, marital status, sex, and (where an authority requires it) medical condition | Partners and authorities at your direction; service providers | No |
| Commercial information | Services requested or purchased, programme interest | Service providers | No |
| Internet or other electronic network activity | Pages viewed, referrer, campaign and click data, interactions with our website and ads | Service providers | Yes, to Google and Meta through advertising cookies, if you have not opted out |
| Geolocation data | Approximate location derived from IP address (not precise geolocation) | Service providers | Approximate location only, through advertising cookies, if you have not opted out |
| Audio and electronic information | WhatsApp voice notes and messages, emails | Service providers | No |
| Professional or employment-related information | Occupation, employer, CV, work history | Partners and authorities at your direction; service providers | No |
| Education information | Qualifications and certificates | Partners and authorities at your direction; service providers | No |
| Inferences | Likely interest in a programme, derived from enquiries and website use | Service providers | Through advertising cookies, if you have not opted out |
| Sensitive personal information | Passport and government ID numbers, citizenship or immigration status, health information, biometric information (photographs), and data that may reveal racial or ethnic origin or religious beliefs | Partners and authorities at your direction; service providers | No |
Sale and sharing. We do not sell personal information for money. However, allowing Google and Meta to collect online identifiers and browsing data through advertising cookies on our websites may be considered a “sale” or “sharing” for cross-context behavioural advertising, or “targeted advertising”, under some US state laws. You can opt out at any time by clicking “Your Privacy Choices / Do Not Sell or Share My Personal Information” in the footer of our websites (which opens our cookie settings) and turning off advertising cookies, by enabling Global Privacy Control in your browser, or by emailing info@bakerandco.ae. We do not sell or share sensitive personal information, and we do not knowingly sell or share the personal information of consumers under 16.
Sensitive personal information. We use sensitive personal information only to provide the services you request and for other purposes permitted by the CCPA regulations, and not to infer characteristics about you. Where a state law requires your consent to process sensitive data, we obtain it.
Retention. We keep each category for the periods in section 11.
Your rights. Subject to applicable law, you may request to know what personal information we have collected, used, disclosed, sold or shared; to access, correct or delete it; to receive a portable copy; and to opt out of sale, sharing, targeted advertising and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not use personal information for such profiling. We will not discriminate against you for exercising these rights. We do not offer financial incentives in exchange for personal information.
Appeals. If we decline your request, you may appeal by emailing info@bakerandco.ae with “Privacy appeal” in the subject line. We will respond within the period required by your state’s law. If you are not satisfied, you may contact your state Attorney General.
If you live in another country with data protection laws, we will handle your personal data in line with this policy and the mandatory requirements of those laws, and you may have additional rights under them. Contact us to exercise them.
Our websites and services are not directed at children, and we do not knowingly collect personal data directly from anyone under 18. We process the personal data of children only when a parent or legal guardian provides it as part of a family application, and only for that application. The parent or guardian is responsible for providing the data, giving any required consent on the child’s behalf, and informing the child where appropriate. If you believe a child has given us personal data without a parent or guardian, please contact us and we will delete it.
No guarantee of outcomes. Decisions on visas, residence permits, citizenship and related applications are made solely by the competent governmental authorities, at their discretion and under laws and policies that may change at any time. We do not and cannot guarantee that any application will be approved, the time it will take, or that any programme will remain available on the same terms. Information on our websites, in our eligibility checker and in our communications is general information, not legal advice and not a promise of any outcome.
Limitation of liability. To the fullest extent permitted by applicable law, we are not liable for decisions, delays or acts of governmental authorities, embassies, consulates or independent third parties, for losses caused by inaccurate, incomplete or false information supplied to us, or for indirect or consequential losses arising from your use of our websites. Our liability for services we provide to clients is governed by the client engagement agreement.
What we do not exclude. Nothing in this policy excludes or limits: (a) liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for wilful misconduct or gross negligence; (b) your rights under data protection law, including any right to compensation for damage caused by an infringement (for example under Article 82 of the GDPR or UK GDPR); or (c) any other liability or right that cannot be excluded or limited by law, including your statutory rights as a consumer (for example under UAE Federal Law No. 15 of 2020 on Consumer Protection, Portuguese Decree-Law No. 446/85 on general contractual clauses and consumer law, or the UK Consumer Rights Act 2015).
Our eligibility checker uses the answers you give to produce an indicative, general result about which programmes may suit you. It is a guide only: it does not make any decision about you, it is not a determination of eligibility by any authority, and a member of our team reviews your situation before we give advice. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. Advertising platforms such as Google and Meta may use automated means to decide which ads to show; you can control this through our cookie settings and your account settings with those platforms.
Our websites link to, and we communicate through, third-party websites and platforms, such as government portals, Facebook, Instagram, WhatsApp and Google. Their privacy practices are governed by their own policies, and we are not responsible for them. Please review their policies before giving them personal data.
We may update this policy from time to time to reflect changes in our services, technology or the law. We will post the updated version on this page with a new “Last updated” date and, where changes are significant, we will take reasonable steps to inform you (for example by email or a notice on our website). Where the law requires your consent to a change, we will ask for it.
For any question about this policy or your personal data, or to exercise your rights, contact:
If you are unhappy with how we have handled your personal data, please contact us first so that we can try to resolve your concern. You also have the right to complain to a data protection authority, including:
This policy is available in English, Arabic and Portuguese. If there is any inconsistency between language versions, the English version prevails to the extent permitted by law.
Speak to our Dubai and Lisbon advisers about D7, D8, D2, the Golden Visa or the UK Innovator Founder visa.
100% confidential. An advisor will call you within 24 hours.