Legal
What we hold about the people at your firm, why, where it sits, and what you can ask us to do about it.
Draft for review. This is a working draft prepared to save your lawyer the blank page, not legal advice. Have UAE-qualified counsel read it before it goes live, and fill in every square-bracketed detail first.
There are two kinds of personal data here, and conflating them is how privacy notices become useless.
| Whose data | Who decides what happens to it | Covered by |
|---|---|---|
| Your firm's own people — the colleagues who sign in, your billing contact | Us. We are the controller. | This notice |
| Your clients' data — the companies you look after, their contacts, TRNs, statements | You. Your firm is the controller; we only process it on your instructions. | The Data Processing Agreement |
This page is about the first. If you want to know how we handle the second — which is the question a careful firm actually asks before uploading anything — read the DPA.
We do not run advertising, we do not sell data to anyone, and we do not profile your firm for anything other than running and improving the service you pay for.
| Purpose | Why we are allowed to |
|---|---|
| Providing the service and supporting it | Necessary to perform our contract with your firm |
| Taking payment and issuing tax invoices | Contract, and our legal obligation under UAE tax law |
| Security, audit logging and fraud prevention | Our legitimate interest in a service that is not abused |
| Service emails — invitations, resets, receipts, notice of changes | Contract |
| Product news, if you asked for it | Your consent, withdrawable in one click |
Accountive runs on Supabase (which itself runs on Amazon Web Services) in Mumbai, India (AWS ap-south-1). Your data is therefore stored outside the United Arab Emirates. We say so plainly because it is the first thing a careful buyer asks.
The UAE Personal Data Protection Law does not require personal data to stay in the country; it sets conditions on transferring it out. No federal list of “adequate” countries has been published, so like every other UAE software company we rely on contractual safeguards — our processors are bound by written terms requiring protection equivalent to the PDPL. Those terms and the full list of who is involved are in the sub-processor list.
We share personal data only with the sub-processors on that list, and with authorities where the law requires it. We will tell you if we are compelled to hand over your data unless we are legally forbidden from doing so.
Under the UAE Personal Data Protection Law you may ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, object to processing, ask us to restrict it, or ask for it in a portable form. Where we rely on consent, you can withdraw it at any time.
Write to privacy@accountive.ae. We reply within 30 days. If we cannot do what you ask — usually because a tax retention period bites — we will tell you why.
If your request is about one of your clients' data rather than your own, it has to come through your firm. We are only the processor for that data; your firm decides. Send it to whoever administers your workspace and we will help them action it.
If personal data we hold is breached in a way that risks your rights, we will notify the UAE Data Office as the law requires, and we will tell affected customers without undue delay and in any event within 72 hours of becoming aware — what happened, what data, what we have done, and what you should do.
Accountive is business software. It is not for anyone under 18 and we do not knowingly collect children's data.
[SCORP LEGAL NAME — e.g. S Corp Accounting & Tax Consultancy L.L.C]
[OFFICE, BUILDING], Business Bay, Dubai, United Arab Emirates
privacy@accountive.ae