01Introduction & Who We Are
Flowscale Business Advisory (“Flowscale”, “we”, “us”, or “our”) is a business advisory and financial technology firm headquartered in the United Arab Emirates. We operate the website flowscale.ae and provide outsourced CFO, accounting, bookkeeping, corporate tax, VAT advisory, and financial operations services for startups and SMEs across the UAE and the broader MENA region.
This Privacy Policy outlines our procedures regarding the collection, processing, protection, and disclosure of personal and business data when you engage our advisory services, access our web portal, or interact with our digital channels.
Scope of This Policy
This policy applies to all clients, prospective customers, portal users, and website visitors. By accessing our services or submitting information through our portal or forms, you acknowledge the processing practices detailed herein.
02Information We Collect
To deliver accurate financial reporting, tax compliance, and strategic advisory services, we collect information across three primary categories:
A. Personal & Identification Data
- Contact Details: Full name, professional title, corporate email address, telephone numbers, and billing address.
- Identity Verification: Passports, Emirates IDs, Trade License copies, and Ultimate Beneficial Owner (UBO) records as required under UAE Anti-Money Laundering (AML) and Know Your Customer (KYC) regulations.
B. Financial & Operational Data
- Accounting Records: Bank statements, chart of accounts, general ledgers, trial balances, invoices, payroll registers, receipts, and expense reports.
- Tax & Regulatory Filings: Tax Registration Numbers (TRN), Corporate Tax reference numbers, past VAT returns, and official correspondence with the UAE Federal Tax Authority (FTA).
- Third-Party Financial Feeds: Read-only or authorized API credentials for integrated accounting software (such as Xero, QuickBooks Online, or banking partner portals).
C. Technical & Device Information
- Device & Connection Data: IP address, browser type, operating system, device identifiers, and network information.
- Usage Logs: Session logs, pages visited, time stamps, features interacted with, and referring URLs.
03How We Collect Your Data
We gather information through transparent and lawful methods, including:
- Direct Interactions: When you schedule a consultation, submit inquiry forms, communicate via email or phone, or sign an engagement letter.
- Secure Client Portals: When your designated company administrators upload financial spreadsheets, invoices, or bank records to our encrypted client portal.
- Cloud Integrations & APIs: When you authorize Flowscale to connect with your cloud accounting platforms (e.g., Xero, QuickBooks, Zoho Books) or enterprise ERP systems.
- Automated Website Technologies: Cookies, server log files, and analytics trackers that monitor website responsiveness and performance.
04Legal Grounds for Processing (UAE PDPL)
In accordance with UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (UAE PDPL) and global data protection standards, we process your information strictly under the following lawful bases:
| Lawful Ground | Application to Flowscale Services |
|---|---|
| Contract Performance | Executing our service engagement agreement, preparing balance sheets, running reconciliations, and delivering fractional CFO advisory. |
| Legal & Statutory Compliance | Fulfilling UAE Federal Tax Authority (FTA) mandates, Corporate Tax Law compliance, VAT returns, and AML/KYC requirements. |
| Legitimate Business Interests | Ensuring the security of our IT infrastructure, preventing fraud, improving advisory modeling algorithms, and internal quality auditing. |
| Explicit Consent | Sending marketing newsletters, thought leadership updates, or optional feature notifications (which you may withdraw at any time). |
05How We Use Your Information
We utilize the collected information strictly for professional and operational purposes:
- Core Accounting & Fractional CFO Services: Generating monthly profit & loss statements, balance sheets, cash-flow projections, financial dashboards, and budget forecasts.
- Tax Assessment & Statutory Filings: Preparing, auditing, and filing Corporate Tax returns and periodic VAT submissions to the UAE FTA.
- Platform Optimization & AI Intelligence: Training internal analytical models on anonymized financial patterns to deliver smarter financial insights and predictive cash flow benchmarks.
- Client Communications: Responding to inquiries, sending monthly financial review briefs, tax deadline alerts, and invoice statements.
- Security & Fraud Prevention: Authenticating client portal logins, detecting unauthorized access, and maintaining audit logs.
06Data Sharing & Third-Party Disclosures
Flowscale does not sell, rent, lease, or trade personal or corporate data to third parties under any circumstances. We share data only with authorized sub-processors and authorities under strict confidentiality obligations:
- Certified Technology Providers: Cloud infrastructure (e.g., AWS, Microsoft Azure, Google Cloud) and authorized accounting suites (e.g., Xero, Intuit QuickBooks) governed by strict Data Processing Agreements (DPAs).
- Government & Regulatory Authorities: The UAE Federal Tax Authority (FTA), Ministry of Economy, or law enforcement agencies when mandated by binding UAE law or court order.
- Professional Advisers: Our external legal counsel, auditors, and banking institutions under strict non-disclosure covenants.
- Corporate Restructuring: In the event of a merger, acquisition, or asset sale, client contracts and related data will transfer only under continued strict confidentiality protections.
07Cross-Border Data Transfers
While Flowscale prioritizes data residency in the UAE and regional cloud data centers, certain cloud software vendors may process data in jurisdictions outside the UAE.
In all such cases, transfers comply with Articles 22 and 23 of the UAE PDPL, ensuring that destination countries offer an adequate level of statutory protection, or that transfers are fortified through Standard Contractual Clauses (SCCs), encryption, and robust vendor audits.
08Data Security & Safeguards
We employ multilayered technical, administrative, and physical security measures to protect your information against unauthorized access, loss, or alteration:
- End-to-End Cryptography: 256-bit AES encryption for stored data and TLS 1.3 encryption for all data in transit.
- Access Management: Principle of Least Privilege (PoLP) and mandatory Multi-Factor Authentication (MFA) for all team members and client portals.
- Continuous Monitoring & Auditing: Automated intrusion detection systems, real-time access logging, and regular vulnerability assessments.
- Confidentiality Agreements: All Flowscale advisors, accountants, and engineers are bound by stringent non-disclosure agreements (NDAs) and regular compliance training.
09Retention of Records
In compliance with UAE Commercial Companies Law and the UAE Tax Procedures Law (Federal Decree-Law No. 28 of 2022), accounting books, invoices, contracts, and tax filings must be retained for specific statutory periods:
- Tax & Accounting Records: Retained for a minimum of 5 years following the end of the relevant tax period (or up to 7 years for real estate and long-term capital assets).
- Corporate & KYC Documentation: Kept for the duration of the business engagement plus 5 years post-termination to satisfy UAE AML/CFT obligations.
- Website Analytics: Anonymized server and cookie logs are purged automatically after 14 to 24 months.
Upon expiry of statutory retention requirements, data is permanently erased or irreversibly anonymized using certified digital destruction standards.
10Your Rights & Choices
Under the UAE Personal Data Protection Law (UAE PDPL), data subjects enjoy specific statutory rights regarding their personal data:
- Right to Access: You may request a copy of the personal data we hold about you and details regarding its processing.
- Right to Rectification: You may request the prompt correction of inaccurate or incomplete corporate contact or personal details.
- Right to Erasure: You may request the deletion of your personal data when it is no longer required for its original purpose (subject to statutory UAE tax and AML retention rules).
- Right to Restriction: You may request that we suspend the processing of your data under specific disputed scenarios.
- Right to Data Portability: You may request your financial reports and raw accounting data in a structured, commonly used format (e.g., CSV or Excel).
- Right to Withdraw Consent: Where processing is predicated on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, please contact our data team at hello@flowscale.ae. We respond to verified requests within 30 calendar days.
12Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect revisions in our financial operations, digital products, or relevant UAE regulations (such as updates issued by the UAE Data Office or the Federal Tax Authority).
When material changes are made, we will update the “Last Updated” date at the top of this page and, where appropriate, notify active clients via email or a dashboard notification. Continued engagement with our services after the effective date constitutes acceptance of the revised policy.
13Contact & Grievance Redressal
If you have questions, feedback, or concerns regarding this Privacy Policy or wish to lodge a data subject request, please reach out to our privacy team:
Flowscale Business Advisory
Data Protection & Client Privacy Office