Privacy Policy
Last updated: 22 October 2026
Who we are
This website is operated by Semiliquid Tech Labs Ltd, trading as Lombard Systems, a company registered in the Dubai International Financial Centre (DIFC Licence No. 10323). We are the controller of the personal data described in this notice and are registered with the DIFC Commissioner of Data Protection.
This notice explains what personal data we collect when you visit this website or deal with us as a business contact, why we collect it, who we share it with, and the rights you have under the DIFC Data Protection Law, DIFC Law No. 5 of 2020.
Our product, Delivery-versus-Lock, is deployed inside the environments of the financial institutions that licence it. Those institutions control any personal data processed within their deployments; none of it flows to us. This notice covers only the personal data we process ourselves in running our business.
What we collect
We collect personal data in three situations.
When you visit this website. Technical data your browser sends, such as your IP address, browser type and the pages you view, together with any site analytics data where you have consented to it (see the cookies section below).
When you contact us. Your name, email address, employer, role and the content of your enquiry, if you use a contact form or email us.
When you deal with us as a business contact. If you work for a client, prospect, partner, supplier, adviser or counterparty, we hold your name, role, employer, business contact details and our correspondence with you. Where you sign a contract on behalf of your organisation, we may also hold identification details needed to execute the contract or to carry out know-your-counterparty checks.
We do not knowingly collect personal data from children, and we do not collect special categories of personal data through this website.
Why we use it
We use personal data only for the purposes below, and only where the law gives us a basis to do so.
Purpose
Lawful basis
Running this website, keeping it secure and understanding how it is used
Our legitimate interests; your consent for any non-essential cookies
Responding to your enquiry
Our legitimate interests
Managing our relationship with clients, prospects, partners, suppliers and advisers
Performance of a contract; our legitimate interests
Executing contracts and carrying out counterparty checks
Performance of a contract; compliance with a legal obligation
Meeting our legal and regulatory obligations, including to DIFC authorities
Compliance with a legal obligation
Where we rely on legitimate interests, those interests are operating and promoting our business and maintaining professional relationships. We have assessed that they do not override your rights. We do not use your personal data for profiling or for automated decisions that have a legal or similarly significant effect on you.
Who we share it with
We do not sell personal data. We share it only with:
Service providers who process data on our behalf under written data processing agreements: our cloud email, calendar and productivity provider; our customer relationship management provider; our website hosting and analytics provider; our e-signature provider; and our cloud hosting provider for internal systems.
Professional advisers such as our external counsel, accountants and auditors, where needed to provide their services.
Regulators and authorities, including the DIFC Commissioner of Data Protection and the Dubai Financial Services Authority, where we are required to by law or in response to a lawful request.
A buyer or successor of our business, in the event of a merger, acquisition or reorganisation, under confidentiality obligations.
Our own staff and contractors in Dubai, New York and Islamabad have access to personal data only where their role requires it.
International transfers
We are a single legal entity with staff and contractors outside the DIFC, and we use cloud providers hosted outside the DIFC. Your personal data may therefore be transferred to, or accessed from, the following places:
Where
Why
Safeguard
United States (New York)
Our staff and contractors access company systems from our New York office
Data Protection Schedule in each individual’s employment or contractor agreement (Article 27)
Pakistan (Islamabad)
Our staff and contractors access company systems from Islamabad
Data Protection Schedule in each individual’s employment or contractor agreement, incorporating the Commissioner’s standard contractual clauses for contractors (Article 27)
United States
Cloud providers hosting our email, CRM, website, e-signature and internal systems
Data processing agreements incorporating the Commissioner’s standard contractual clauses (Article 27)
United Kingdom and European Union
Cloud providers and professional advisers
Adequacy decision under Article 26
Neither the United States nor Pakistan has been recognised by the DIFC Commissioner as providing an adequate level of protection, which is why we rely on the contractual safeguards above. You can ask us for a copy of the safeguards in place by contacting us using the details at the end of this notice.
Cookies and tracking
This website uses cookies and similar technologies. Strictly necessary cookies keep the site working and secure and do not require your consent. Analytics cookies, set by Google Analytics, help us understand how the site is used; they are set only if you accept them. When you first visit, a banner lets you accept all cookies, reject all non-essential cookies, or choose which categories to allow. You can change your choice at any time using the cookie settings link in the website footer, or by clearing cookies in your browser.
Cookie
Set by
Purpose
Type
Duration
Cookie consent preference
This website
Remembers the choice you made in the cookie banner
Strictly necessary
12 months
_ga
Google Analytics
Distinguishes one visitor from another so visits can be counted
Analytics (consent)
2 years
ga<container ID>
Google Analytics
Keeps the state of your current browsing session for analytics
Analytics (consent)
2 years
Google Analytics is provided by Google LLC in the United States. We have configured it to anonymise IP addresses and have not enabled advertising features or data sharing with Google. Google’s own privacy notice is at policies.google.com/privacy.
How long we keep it, and how we protect it
We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires.
Data
Retention
Website enquiries
12 months from the enquiry
Website analytics data (where consented)
Provider default, not exceeding 14 months
Business contact data
Reviewed each year; deleted or anonymised when the relationship ends or on request
Contract and counterparty-check data
Life of the contract plus the applicable limitation period
We protect personal data with single sign-on and multi-factor authentication on all company systems, role-based access limited to what each role needs, encryption in transit and at rest, and managed, encrypted company devices. All staff and contractors complete data protection training. If a personal data breach is likely to put your rights at risk, we will notify the DIFC Commissioner of Data Protection and, where the risk is high, you.
Your rights
Under the DIFC Data Protection Law you have the right to:
Access the personal data we hold about you and receive a copy of it.
Correct data that is inaccurate or incomplete.
Erase your data where we no longer need it or have no lawful basis to keep it.
Restrict how we use your data in certain circumstances.
Object to processing based on our legitimate interests, and to any direct marketing.
Receive your data in a portable, machine-readable format where we process it by automated means on the basis of consent or contract.
Withdraw consent at any time where consent is the basis for processing, without affecting processing that took place before you withdrew it.
Not be subject to decisions based solely on automated processing that have a legal or similarly significant effect on you.
To exercise any of these rights, contact us using the details below. We will acknowledge your request promptly, may ask you to verify your identity, and will respond within one month. Where the law allows us to extend that period, we will tell you why. There is no charge unless a request is clearly unfounded or excessive.
Complaints, changes and contact
If you are unhappy with how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the DIFC Commissioner of Data Protection, Level 14, The Gate, DIFC, Dubai, UAE (www.difc.ae, Data Protection section).
We may update this notice from time to time. The date at the top shows when it was last changed, and material changes will be highlighted on this page. This notice was last updated on 22 October 2026.
Contact
Semiliquid Tech Labs Ltd, trading as Lombard Systems
DIFC Licence No. 10323
Level 02, Innovation One, Dubai International Financial Centre.
Attention: Chief Information Security Officer
Email: security@lombardsystems.com
This website is intended for the user's own use in reviewing information available here about PCP, SemiLiquid and any of its affiliates . By accessing this website, you agree to be bound by the terms and conditions that appear herein. These terms and conditions are subject to change. PCP reserves the right to modify these terms and conditions, which it may do by posting changes to the website. If you do not agree with these terms and conditions, please do not access the website.