Who is responsible for your data
Sahla Group is the controller of the personal data processed through this site and through the platform. Each subsidiary is the controller for the service it delivers, under the same policy and the same security rules.
This policy is written against Federal Decree Law 45 of 2021 on the protection of personal data, the UAE Personal Data Protection Law, and against the sector rules that apply to accounting, insurance and real estate.
What we collect
We collect what a filing needs, and the technical data any website generates. Nothing else.
| Category | Examples | Where it comes from |
|---|---|---|
| Identity | Passport, Emirates ID, visa page, photograph, proof of address | You, when a filing requires it |
| Company | Licence, shareholding, activities, registered address, tax registration number | You, and the authority that issues the document |
| Financial | Invoices, bank statements, accounting entries, payment status | You, your bank connection, your point of sale |
| Contact | Name, email, phone, WhatsApp exchanges with an adviser | You |
| Technical | IP address, browser, pages viewed, approximate location by IP | Your visit to the site |
We do not ask for data about your health, your religion or your political opinions, and we do not want it. Where an insurance product needs a health declaration, it goes to the insurer directly and not through us.
Why we process it, and on what basis
| Purpose | Legal basis |
|---|---|
| Delivering the service you ordered | Performance of the contract |
| Filing with an authority, and keeping the proof | Legal obligation |
| Keeping accounting records for seven years | Legal obligation |
| Verifying identity before a filing or a payment | Legal obligation, and our own anti money laundering duties |
| Answering your questions and following your file | Performance of the contract |
| Measuring how the site is used | Consent, which you can refuse without losing access |
| Sending you commercial emails | Consent, withdrawable in one click in every email |
| Defending our rights in a dispute | Legitimate interest |
We do not sell personal data. We do not rent mailing lists, and we do not build advertising profiles from your accounting records.
Where your data is stored
The platform runs on managed cloud infrastructure and the site is served through a content delivery network. Some of that infrastructure sits outside the United Arab Emirates.
Where data leaves the country, it is covered by the contractual guarantees the UAE Personal Data Protection Law requires of a transfer, and it stays encrypted in transit and at rest.
Where a service is subject to a residency rule imposed by its regulator, the data covered by that rule is stored accordingly, and we can tell you where on request.
Who we share it with
Only with those who need it to do the job:
- The competent authority for your filing, which is the whole point of the filing.
- The bank, when you ask us to open an account for you.
- The insurer, when you ask us to place a policy.
- Our tax agent, for submissions made in your name.
- Our infrastructure, payment and email providers, bound by contract and processing on our instructions only.
- A court or a regulator, where the law requires us to answer.
Every access to a client record inside Sahla is logged, and access is limited to the people working on your file.
How long we keep it
| Data | Retention |
|---|---|
| Accounting records and invoices | Seven years, as the tax authority requires |
| Identity documents used for a filing | The life of the company, plus the retention period imposed on us |
| Company documents | The life of the company, then archived |
| Contact details and exchanges | Three years after our last contact |
| Site measurement data | Fourteen months at most |
| Prospect data from a form, with no order | Twelve months |
After a cancellation your records stay exportable for thirty days. After that they move to archive, where they are still protected but no longer available in the interface.
Your rights
Under the UAE Personal Data Protection Law you can:
- Ask what we hold about you, and get a copy.
- Have inaccurate data corrected.
- Have data deleted, within the limits set by our retention obligations.
- Receive your data in a portable format, or have it sent to another provider.
- Object to a processing based on our legitimate interest.
- Withdraw a consent you gave, at any time, without justifying it.
Deletion has a real limit and we would rather state it than pretend otherwise: we cannot delete an accounting record the tax authority requires us to keep, nor a document filed with an authority. Everything else goes.
How to exercise a right
Write to us from the address we have on file, or ask through your account. We answer within thirty days.
We may ask you to confirm your identity first, because handing your file to someone else would be the worse failure.
If our answer does not satisfy you, you can bring the matter to the UAE Data Office.
Cookies and measurement
The site uses strictly necessary cookies for the session, and measurement cookies you can refuse without losing access to anything.
The detail of each cookie, what it does and how long it lives, is in the cookie policy.
Security
Data is encrypted in transit and at rest. Access is restricted to the people working on your file, and every access to a client record is logged.
Access to the platform is protected by password and, for our own staff, by a second factor. Backups are taken daily and tested.
If a breach ever affects your data, we tell you and we tell the UAE Data Office, within the deadline the law sets, with what happened and what we did about it.
Automated decisions
No decision that affects you is taken automatically. A filing, a quote and a refusal are decided by a person, and you can always ask which one.
Children
The services are for adults acting for a business. We do not knowingly collect data from anyone under eighteen, except a dependant named in a family visa application, where the data is provided by the parent and used only for that filing.
Changes to this policy
The date at the top of this page is the date of the version in force. A change that affects how we use data you already gave us is announced by email before it applies.
Contact and complaints
For any question on this policy, or to exercise a right, reach us through your account or on the WhatsApp number published across this site. An adviser answers in English, French or Arabic.
A question on a clause?
An adviser answers on WhatsApp, in English, French or Arabic. We would rather explain a term now than argue about it later.
Ask us