Privacy Policy

1. Who we are

White Paper Accounts Auditing LLC SP (“WPAA”, “we”, “us” or “our”) is a professional services firm based in Sharjah, United Arab Emirates. This Privacy Policy explains how we collect, use, share and protect personal data when you use our website, contact us or engage us for professional services. It should be read together with our Terms of Service.

For the purposes of applicable data protection law, WPAA is responsible for the personal data it collects and processes as described in this policy.

2. Scope of this policy

This policy applies to personal data relating to:

• Visitors to wpaauae.com.
• People who submit an enquiry, consultation request or newsletter subscription.
• Clients and prospective clients, including their owners, directors, beneficial owners, authorised representatives and employees.
• Where relevant to an engagement, a client’s customers, suppliers, counterparties or other related parties.
• Suppliers, partners and other people we deal with in the course of our business.

Where a professional engagement is governed by an engagement letter, that letter may contain additional terms on how information is handled for that engagement.

3. Personal data we collect

Depending on how you interact with us, we may collect:

• Enquiry and consultation details: name, email address, phone number, company name, the service you are interested in, your message and any preferred consultation date and time.
• Newsletter details: your email address and subscription preferences.
• Communications: emails, WhatsApp messages, call notes and other correspondence with us.
• Engagement information: financial records, accounting data, tax information, corporate documents and other material provided for an engagement, which may include personal data of individuals connected to the client.
• KYC and KYCC information: identification documents, trade licences, beneficial ownership details, corporate documents and information about the nature of a business, its transactions, customers or counterparties, as described in section 6.
• Technical and usage data: IP address, browser and device type, pages viewed, referring pages, approximate location and interaction data collected through cookies and similar technologies, as described in section 12.

We ask that you do not send us sensitive personal data through the website forms unless we have requested it for a specific purpose.

4. How we use personal data

We use personal data to:

• Respond to enquiries and consultation requests and arrange meetings.
• Assess, accept, plan, perform and manage professional engagements.
• Carry out client identification, verification, risk assessment and other KYC and KYCC procedures.
• Comply with our legal, regulatory and professional obligations, including anti-money laundering and counter-terrorist financing requirements.
• Issue invoices, manage payments and maintain business records.
• Send newsletters and updates where you have subscribed, with the option to unsubscribe at any time.
• Operate, secure and improve our website and understand how visitors use it.
• Measure the effectiveness of our advertising.
• Establish, exercise or defend legal claims.

5. Legal basis for processing

We process personal data in accordance with applicable UAE data protection law, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data where applicable. Depending on the purpose, we rely on one or more of the following:

• Your consent, for example when you subscribe to our newsletter.
• The need to take steps at your request before entering into an engagement, or to perform an engagement.
• Compliance with legal and regulatory obligations, including anti-money laundering legislation and professional requirements.
• Our legitimate interests in running and improving our business, provided those interests are not overridden by your rights.
• Any other basis permitted by applicable law.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before it was withdrawn.

6. KYC and KYCC information

To comply with applicable legal, regulatory, professional and internal risk-management requirements, we may collect information to identify and verify a client, its beneficial owners and authorised representatives and, where relevant to the engagement, the client’s customers, counterparties or other related parties.

We use this information to decide whether to accept or continue an engagement, to assess and manage risk, to meet record-keeping requirements and, where required by law, to report to the relevant authorities.

Where a client provides information about another person or entity, the client is responsible for ensuring that it is authorised to provide that information and that the disclosure complies with applicable law, including informing the individuals concerned where required.

The nature and extent of the information collected depends on the service, the risks involved and applicable requirements. KYC and KYCC information is kept confidential and accessed only by people who need it for these purposes.

Where the law requires us to report a matter to an authority, we may be prohibited from informing the person concerned.

7. Sharing personal data

We do not sell personal data. We may share it, where appropriate and subject to confidentiality requirements, with:

• Independent professionals, associate firms and consultants who work with us on an engagement, as explained in our Terms of Service.
• Service providers who support our business, such as website hosting, email and office software, accounting systems, analytics and advertising providers.
• Regulators, government authorities, courts, the Federal Tax Authority, the UAE Financial Intelligence Unit and other bodies where required or permitted by law.
• Professional bodies, quality reviewers and insurers where required by professional obligations.
• Banks, free zone authorities or other third parties where you or the client has instructed us to do so.

We require service providers to protect personal data and to use it only for the services they provide to us.

8. International transfers

Some of our service providers, such as email, cloud storage, analytics and advertising platforms, may store or process data outside the UAE. Where personal data is transferred outside the UAE, we take reasonable steps to ensure it receives an appropriate level of protection in accordance with applicable law.

9. How long we keep personal data

We keep personal data only for as long as it is needed for the purposes described in this policy.

Enquiry and consultation details that do not lead to an engagement are kept for as long as reasonably needed to respond and follow up. Newsletter details are kept until you unsubscribe.

Engagement records, working papers and KYC and KYCC information are kept for the periods required by applicable law, regulation and professional standards, which may continue after an engagement ends.

When personal data is no longer needed, we delete it, anonymise it or store it securely until it can be deleted.

10. How we protect personal data

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration. These include access controls, secure systems, confidentiality obligations for our team and limiting access to those who need it.

No method of transmission over the internet or electronic storage is completely secure. If you believe your information has been compromised, please contact us immediately.

11. Your rights

Subject to applicable law and any legal or professional obligations that require us to retain information, you may have the right to:

• Request access to the personal data we hold about you.
• Ask us to correct inaccurate or incomplete personal data.
• Ask us to delete personal data or restrict how we use it.
• Object to certain processing, including direct marketing.
• Withdraw consent where processing is based on consent.
• Request a copy of your personal data in a commonly used format, where applicable.
• Raise a complaint with the competent data protection authority.

To exercise these rights, please contact us using the details in section 16. We may need to verify your identity before responding.

Some rights may be limited where we must keep information to meet legal, regulatory, anti-money laundering or professional obligations.

12. Cookies, analytics and advertising tools

Our website uses cookies and similar technologies. These are set when pages load and help the website function, show us how visitors use it and measure our advertising. We use:

• Google Tag Manager to manage the tags used on the website.
• Google Analytics to understand website traffic and usage. See how Google uses data from sites that use its services.
• Google Ads conversion tracking to measure the effectiveness of our advertising, such as when an enquiry form is submitted.
• Microsoft Clarity to understand how visitors interact with pages through usage analytics and session insights. See the Microsoft Privacy Statement.
• WhatsApp links that open a chat with us. If you use them, your message is handled by WhatsApp under the WhatsApp Privacy Policy as well as this policy.

You can block or delete cookies through your browser settings. Blocking cookies may affect how some parts of the website work. You can also opt out of Google Analytics using the Google Analytics opt-out browser add-on and manage Google ad personalisation in your Google ad settings.

13. Third-party websites

Our website may link to other websites, including government portals, free zone authorities and social media platforms. We are not responsible for the privacy practices of those websites, and we encourage you to read their privacy policies.

14. Children

Our website and services are intended for businesses and adults. We do not knowingly collect personal data from children through the website.

15. Changes to this policy

We may update this Privacy Policy from time to time. The updated version and its effective date will be published on this page. Where changes are significant, we may also notify clients directly.