Privacy notice
إشعار الخصوصية
Last updated: [date to be set at launch]
Who we are
Accountly ([legal entity name, licence number and registered address to be added]) provides accounting software to businesses and accounting firms in the United Arab Emirates. For questions about this notice contact [privacy contact email].
The law we follow
We process personal data in line with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and its implementing regulations, and with the record-keeping duties in UAE tax law (Federal Decree-Law No. 8 of 2017 on VAT and Federal Decree-Law No. 47 of 2022 on corporate tax). Customers established in a free zone with its own data protection law (such as DIFC or ADGM) may have additional rights. [Counsel to confirm the applicable regimes and whether Accountly acts as controller or processor for each category below.]
What we process
- Account data: your name, email address and a one-way hash of your password. We never store passwords in readable form.
- Business records you enter or upload: companies, customers, suppliers, invoices, bills, bank statements, journal entries and documents. For these, your business decides what is processed and why; we process them on your instructions.
- Payroll data: employee names, Emirates ID or labour card numbers, bank details and salaries, used to run payroll and produce WPS files.
- Demo requests: the name, work email, company, phone number and message you type into the website's "Book a demo" form, emailed to our team so we can arrange the demo, and not used for anything else.
- Technical data: sign-in sessions, an audit trail of changes and server logs, used to keep the service secure and to investigate problems. Logs exclude passwords and tokens.
AI features
If your workspace enables the AI assistant or document reading, the relevant records or files are sent to our AI provider (Anthropic) to produce an answer or a draft. AI output is shown to you for review and is never posted to your books automatically. [Counsel to confirm the cross-border transfer basis under the PDPL and the provider's data terms.]
Where data is stored
Production data is stored in a database hosted in the UAE [hosting provider and region to be confirmed]. Backups are encrypted and kept in the same region.
How long we keep it
UAE tax law requires accounting records to be kept for at least five years after the end of the tax period they relate to (longer in some cases, such as real estate). We keep business records for the period your business requires and delete them after your account is closed and that period has passed. [Retention schedule to be confirmed.]
Your rights
Under the PDPL you may ask to access, correct or delete your personal data, to restrict or object to processing, and to receive a copy in a portable format, subject to legal record-keeping duties. Employees and contacts of our customers should first contact the business that holds their data. You may also complain to the UAE Data Office.
Security
Connections are encrypted, access to each company is limited to the people it invites, and every change to the books is recorded in an audit trail.