GDPR Policy

Last Updated Date: June 15, 2026

This GDPR Policy shall be read alongside our Privacy Policy, our Terms and Conditions and our Cookie Policy.

1. Introduction

Finanshels Accounting Technologies LLC and its affiliates and subsidiaries ("Finanshels", "we", "us", "our") iscommitted to protecting the privacy and security of personal data processed in connection with our services. This
GDPR Policy sets out our obligations and your rights under the General Data Protection Regulation (EU) 2016/679
("GDPR" and, where applicable, UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.

This Policy applies where Finanshels processes personal data of individuals located in the European Economic Area
or the United Kingdom, or where Finanshels acts as a data processor on behalf of a client whose operations are
subject to GDPR. This Policy supplements and should be read alongside our Privacy Policy, which sets out in full how
we collect, use, process, and retain personal data.

2. Data Controller

The data controller responsible for the processing of personal data in connection with the Finanshels Site, Portal,
Partner Portal, and FinDelivery is Finanshels Accounting Technologies LLC, Shams Business Center, Sharjah Media
City Free Zone, Al Messaned, Sharjah, UAE. For all data protection enquiries, please contact us at contact@finanshels.com.

Where Finanshels processes personal data on behalf of a client in the course of delivering professional services, the
client is the data controller and Finanshels acts as the data processor in respect of such data, processing it only in
accordance with the client's instructions and applicable law.

3. Personal Data We Collect

The categories of personal data we collect and process are set out in full in our Privacy Policy. In summary, these
include:

  • Identity and contact data: name, email, telephone, postal address, and WhatsApp contact details;
  • Business and financial data: company details, trade licence, tax registration, financial statements, payroll records, and bank account details;
  • Compliance and verification data: Emirates ID, passport copies, ultimate beneficial owner information, and
    source of funds documentation;
  • Technical and usage data: IP address, browser type, device identifiers, and usage information collected
    through cookies and similar technologies;
  • Communication and engagement data: records of all communications through any channel including enquiry
    forms, WhatsApp, and portal messages; and
  • Tool and assessment data: information provided when using tools or calculators on our Site.

Where we process personal data as a data processor on behalf of a client, the categories of data processed will be
determined by the nature of the engagement and the client's instructions.

4. How We Use Your Personal Data

We process your personal data for the following purposes:

  • to deliver and manage our professional accounting, bookkeeping, tax compliance, payroll, AML compliance support, and CFO advisory services;
  • to communicate with you regarding our services and administrative matters;
  • to fulfil our legal and regulatory obligations, including under UAE anti-money laundering legislation;
  • to maintain the security and integrity of our systems and prevent fraudulent activity; and
  • to analyse usage patterns and improve our services and user experience.

5. Legal Basis for Processing

We process your personal data on the following legal bases under GDPR:

  • Contractual necessity: processing necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract;
  • Legal obligation: processing required to comply with our regulatory and statutory obligations;
  • Legitimate interests: processing necessary for our legitimate business interests, provided those interests are
    not overridden by your rights and freedoms; and
  • Consent: processing based on your explicit consent, which you may withdraw at any time without affecting
    the lawfulness of processing carried out prior to withdrawal.

6. Data Sharing and International Transfers

We may share your personal data with the following categories of recipients:

  • our subsidiaries and affiliates for operational and administrative purposes;
  • third-party service providers who process data on our behalf, including cloud hosting, CRM, analytics, payment processing, and technology providers; and
  • regulatory authorities, law enforcement agencies, and courts where required by applicable law.

All third-party service providers are subject to contractual obligations requiring them to process your data only on
our instructions and to maintain appropriate security measures. Where we transfer personal data outside the EEA,
we ensure that appropriate safeguards are in place, including Standard Contractual Clauses approved by the
European Commission or such other transfer mechanisms as are recognised under GDPR.

7. Data Security

Finanshels implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure, or destruction. Our security measures include:

  • encryption of data in transit and at rest;
  • role-based access controls restricting access to personal data to authorised personnel only;
  • regular security assessments and penetration testing; and
  • staff training on data protection obligations and security practices.

Notwithstanding the foregoing, no method of electronic transmission or storage is entirely secure, and Finanshels
cannot guarantee absolute security.

8. Personal Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals,
Finanshels shall notify the relevant supervisory authority without undue delay and, where feasible, within 72
(seventy-two) hours of becoming aware of the breach. Where the breach is likely to result in a high risk to the rights
and freedoms of affected individuals, Finanshels shall also notify those individuals without undue delay. Where
Finanshels acts as a data processor, it shall notify the relevant data controller of any breach without undue delay
upon becoming aware of it.

9. Data Retention

We retain personal data only for so long as is necessary to fulfil the purposes for which it was collected or as
required by applicable law. The specific retention periods applicable to each category of data are set out in our
Privacy Policy. Upon expiry of the applicable retention period, personal data shall be securely deleted or
anonymised. We may retain personal data for longer periods where required to comply with a legal obligation, to
establish, exercise, or defend legal claims, or to resolve a dispute.

10. Your Rights Under GDPR

Where GDPR applies to the processing of your personal data, you have the following rights:

  • Right of access: the right to obtain confirmation that your personal data is being processed and to receive a copy of it;
  • Right to rectification: the right to request correction of inaccurate or incomplete personal data;
  • Right to erasure: the right to request deletion of your personal data where there is no compelling reason for its continued processing;
  • Right to restriction of processing: the right to request that we limit the processing of your personal data in certain circumstances;
  • Right to data portability: the right to receive your personal data in a structured, commonly used, and
    machine-readable format;
  • Right to object: the right to object to processing based on legitimate interests or for direct marketing purposes;
  • Right to withdraw consent: where processing is based on consent, the right to withdraw that consent at any time; and
  • Right to lodge a complaint: the right to lodge a complaint with the supervisory authority in the EEA member
    state where you reside, work, or where an alleged infringement took place.

To exercise any of the above rights, please submit a written request to contact@finanshels.com. We shall respond to
all valid requests within thirty calendar days of receipt. We may request proof of your identity before processing
your request. Please note that certain rights are subject to limitations under applicable law, including where
retention is required to fulfil legal obligations under UAE anti-money laundering legislation.

11. Data Protection Contact

Finanshels has designated a data protection contact responsible for overseeing compliance with this Policy and
applicable data protection laws. For all data protection enquiries, requests, or concerns, please contact:

Finanshels Accounting Technologies LLC
Shams Business Center, Sharjah Media City Free Zone, Al Messaned, Sharjah, UAE
Email: contact@finanshels.com

12. Changes to This Policy

Finanshels reserves the right to update or amend this GDPR Policy from time to time to reflect changes in our
practices or applicable legal requirements. Where changes are material, we shall notify you by posting an updated
Policy on our Site and indicating the date of the latest revision. Your continued use of our Site and Services following
notification of any changes shall constitute your acceptance of the revised Policy.

13. Contact Us

For any questions or concerns regarding this GDPR Policy or our data protection practices, please contact us at:

Finanshels Accounting Technologies LLC
Shams Business Center, Sharjah Media City Free Zone, Al Messaned, Sharjah, UAE
Email: contact@finanshels.com
Phone: +971 4 545 7841
Website: www.finanshels.com

Last updated: 04 September 2026