Privacy Notice
Privacy Notice
Univia Tax — UAE Tax Compliance & Business Records
Effective date: 4 August 2026 Last updated: 19 Jul 2026
This notice explains what personal data Univia Global Consultancy processes when you use Univia Tax, why, on what lawful basis, who else sees it, how long it is kept, and what rights you have.
It is written to meet UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL"), in force since 2 Jan 2022 — https://uaelegislation.gov.ae/en/legislations/1972/download
[REQUIRES QUALIFIED LEGAL REVIEW] — this notice asserts positions about the application of the PDPL, including lawful bases and the mechanism for cross-border transfer under Articles 22 and 23. The PDPL's Executive Regulations and the practice of the UAE Data Office must be checked against this text before publication, and the current status of any adequacy decision or transfer mechanism confirmed.
1. Who we are
Controller: Univia Global Consultancy — Univia Global Consultancy L.L.C-FZ, Trade Licence No. 2534238.01, Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates.
Privacy contact: support@univiaglobal.com. This is the monitored privacy contact and is not represented as a statutory Data Protection Officer appointment.
[REQUIRES QUALIFIED UAE LEGAL REVIEW — complete and retain the DPO assessment before paid launch. A privacy lead supported by external counsel is the interim model; an outsourced/shared DPO may be appointed if the legal threshold or risk profile requires it.]
Underlying technology: the platform and tax engine are currently owned by Umer Nawaz and made available to Univia Global Consultancy L.L.C-FZ through the documented group licensing and services structure. Univia operates the Service and is the controller for the processing activities described in this notice, except where it acts as processor for customer-controlled records.
2. Two different roles — please read
Univia processes personal data in two distinct capacities:
As controller — for data about you as our customer: your account, your billing, your support interactions, your use of the Service. This notice governs that processing.
As processor — for the personal data inside your business records: names and contact details of your customers, suppliers, employees, and (if you are an accounting firm) your clients and their contacts, contained in invoices, bills, receipts, statements, and records you upload or enter. Univia processes that data on your instructions, for the purpose of providing the Service to you. You are the controller for it. The Data Processing Addendum (docs/legal/data-processing-addendum.md) governs that relationship.
If you upload a document, you are responsible for having a lawful basis to disclose the personal data in it to us.
3. What personal data we process
3.1 Account and identity data
• Email address (mandatory, unique)
• Name (optional)
• Password, stored only as a bcrypt hash — never in readable form
• Google account identifier, if you sign in with Google (in which case we store no password)
• Your role within the account (owner, partner, manager, reviewer, preparer)
• Account creation and update timestamps
3.2 Business and tax data
Company name, Tax Registration Number (TRN), entity type, tax year end, free zone status and free zone name, reporting currency. Where you are a sole establishment or a natural-person taxable person, some of this is personal data about you.
3.3 Business records and documents
Documents you upload — sales invoices, purchase invoices, credit notes, bank statements, sales and purchase registers, profit and loss statements, balance sheets, trial balances, general ledgers, and supporting schedules — and the records you create or that are extracted from those documents: customers, suppliers, items, projects, sales documents and their lines, supplier bills, expense receipts, payments and allocations.
These frequently contain personal data about third parties — customer and supplier names and contact details, bank details, employee names on expense claims, and identifiers on bank statements. Univia processes this as your processor (clause 2).
3.4 Computation and filing data
VAT returns and figures, Corporate Tax filings and computations, findings, verification checks, line mappings, commentary, filing readiness assessments and sign-offs.
3.5 AI assistant data
Chat sessions and messages, and the company context supplied with them. Only your own company's context is ever included — no other customer's data is present in your session.
3.6 Firm data
Where a firm uses the Agency functionality: firm details, firm membership and roles, firm-to-client links, and client contact records.
3.7 Billing data
Subscription plan, status, billing interval, and the identifiers issued by our payment processor. We do not store your payment card number, CVV, or bank account details — those are collected and held by the payment processor.
3.8 Technical and security data
IP address (used for rate limiting on login and registration), session token, browser and device information contained in requests, and server and application logs.
3.9 Audit data
An audit trail recording who did what and when — the acting user, the company, the entity affected, the action, associated metadata, and the timestamp. This is a deliberate integrity feature and is retained even where other data is amended.
3.10 What we do not knowingly process
We do not ask for, and the Service is not designed to hold, special-category or sensitive personal data (health, biometric, genetic, religious or political data). Do not upload documents containing it. Emirates ID copies, passport copies, and visa documents are not required by the Service and should not be uploaded.
4. Why we process it, and on what lawful basis
| # | Purpose | Data | Lawful basis (PDPL Article 4) |
|---|---|---|---|
| 1 | Create and operate your account; authenticate you | 3.1 | Performance of a contract with you |
| 2 | Provide the Service: store records, process documents, compute VAT and Corporate Tax, generate findings and working papers | 3.2–3.4 | Performance of a contract; and, for third-party personal data inside records, your instruction as controller |
| 3 | AI-assisted extraction from uploaded documents | 3.3 | Performance of a contract |
| 4 | Operate the AI assistant, where your plan includes it | 3.5 | Performance of a contract |
| 5 | Take payment and manage subscriptions | 3.7 | Performance of a contract |
| 6 | Send service and transactional email (verification, billing, security, service notices) | 3.1, 3.7 | Performance of a contract |
| 7 | Secure the Service: rate limiting, abuse prevention, malware and content checks, tenant isolation | 3.8 | Necessary to protect information security, prevent misuse and perform the service; counsel to confirm the applicable PDPL ground |
| 8 | Maintain the audit trail and support the integrity of tax records | 3.9 | Necessary to perform the service, maintain evidential integrity and comply with legal obligations; counsel to confirm final mapping |
| 9 | Provide support and handle complaints | all as necessary | Performance of a contract |
| 10 | Comply with legal, tax, accounting, and regulatory obligations; establish, exercise, or defend legal claims | as necessary | Compliance with legal obligations; establishment, exercise or defence of legal claims; other lawful ground as applicable |
| 11 | Optional analytics to improve the product | 3.8 | Consent — see the Cookie Notice. Off unless you accept |
| 12 | Marketing email about Univia products | 3.1 | Consent — withdrawable at any time |
[PDPL BASIS — REQUIRES QUALIFIED LEGAL REVIEW, added 20 Jul 2026: rows 7, 8 and 10 above are expressed as "legitimate interest", which is a GDPR concept. The PDPL contains no general legitimate-interest basis; counsel must map each of those purposes to a specific PDPL ground (for example contractual necessity or compliance with a UAE legal obligation, per Article 4 and the Executive Regulations), and this table must be re-worded to match before publication. Counsel must also determine whether Article 10 of the PDPL requires appointment of a Data Protection Officer, given the volume of processing, the use of new technologies, and systematic automated processing in the Service.]
We do not sell personal data. We do not carry out automated decision-making that produces legal effects concerning you: the Service produces drafts for your review, and no decision about you is made by the Service.
5. Who we share it with — subprocessors
To run the Service we use the following providers. Each processes personal data only as needed to provide its part of the Service, and is under contract to do so.
| Provider | Role | Data reaching it | Processing location |
|---|---|---|---|
| Neon | Managed PostgreSQL database — the primary data store | All application data (3.1–3.9) | [CONFIRM — the Neon project region must be recorded here; if the project is not in a UAE or Middle East region this is a cross-border transfer and must be stated] |
| Amazon Web Services (S3) | Object storage for uploaded documents | Uploaded files (3.3) | me-central-1 (UAE) — the configured default region |
| Vercel | Application hosting and delivery | All data in transit through the application; logs | Global edge; primary compute region [CONFIRM] |
| OpenAI | AI processing — document data extraction and the AI assistant | Content of uploaded documents sent for extraction; assistant messages and your company context (3.3, 3.5) | Outside the UAE — see clause 6 |
| Stripe | Payment processing | Your name, email, billing details, and card data collected directly by Stripe (3.7) | Outside the UAE |
| Resend | Transactional email delivery | Email address and message content (3.1) | Outside the UAE |
| Inngest | Background job orchestration for the document pipeline | Job payloads containing document and company identifiers | Outside the UAE |
| Optional sign-in (OAuth) | Your Google account identifier and email, if you use it | Outside the UAE | |
| Upstash (Redis) | Shared rate-limiting store | IP addresses and user identifiers used as rate-limit keys (3.8) | Configured only where enabled — [CONFIRM whether enabled in production] |
| Self-hosted document parsing service (docling) | First-tier document layout parsing before AI extraction | Uploaded document content (3.3) | Self-hosted by Univia — [CONFIRM hosting location; only in use where a parsing service URL is configured, otherwise documents go directly to the AI extraction path] |
| Malware scanning service | Scanning uploaded files | Storage key of the uploaded file | Not currently configured — see clause 8.4 |
| UNFI Technologies (FZE) | Technology development, hosting support and maintenance under intercompany agreements | Access to application data and infrastructure only where necessary, authorised and logged | SRTIP, Sharjah, UAE; overseas access or vendors only as identified in the current subprocessor register |
We also disclose personal data where required by law, court order, or a lawful authority request; to our professional advisers under duty of confidence; and to an acquirer or successor in a reorganisation or transfer of business, subject to the protections in this notice.
A current subprocessor list, and how we notify you of changes, is maintained in the Data Processing Addendum.
6. Cross-border transfers — please read
Providing the Service requires transferring personal data outside the United Arab Emirates. This is material and unavoidable in the current architecture.
Specifically:
• AI processing routes outside the UAE. When a document is processed, its content — including any personal data it contains — is sent to our AI provider (OpenAI) for extraction. When you use the AI assistant, your messages and your company context are sent to the same provider. That provider processes data outside the UAE.
• Payment processing, transactional email, background job orchestration, and application hosting also involve providers that operate outside the UAE.
• Uploaded documents themselves are stored in the UAE, in AWS's me-central-1 region. The transfer to the AI provider is for processing, not primary storage.
Under PDPL Articles 22 and 23, personal data may be transferred outside the UAE where the destination provides an adequate level of protection, or on the basis of a contract containing appropriate safeguards, or with the data subject's explicit consent, or where the transfer is necessary for the performance of a contract with the data subject.
Univia relies on [TRANSFER MECHANISM — CONFIRM WITH COUNSEL: which of PDPL Art. 22 (adequacy) / Art. 23 (contractual safeguards, necessity for contract performance, or explicit consent) is relied on for each destination, and confirm that the executed data processing agreements with each provider carry appropriate safeguards].
We do not permit our AI provider to use your data to train or improve its models. Your content is sent only to fulfil your own request.
If you are not willing for document content to be processed outside the UAE, do not use the document upload or AI assistant features. Manual record entry and the computation engine do not require AI processing.
7. How long we keep it
| Data | Retention |
|---|---|
| Account and identity data | While the account is active; ordinarily deleted or anonymised within 30 days after verified closure, unless a longer period is required for legal claims, fraud prevention or statutory records. |
| Business records, documents, computations, working papers | While the account is active and until the customer deletes them or closes the account, subject to statutory tax, accounting, evidential and dispute-retention requirements. |
| Uploaded files in object storage | Until deleted by the customer, the associated record is deleted, or the account is closed, subject to backup rotation and legal holds. |
| Chat sessions and messages | While the account is active or until deleted by the customer; older conversations may be deleted or anonymised under the published retention schedule. |
| Audit events | For the period reasonably required to maintain security, traceability, legal claims and statutory records; the internal retention schedule controls the exact period. |
| Billing records | For the period required by applicable UAE tax, accounting and commercial law. |
| Security and application logs | Normally up to 90 days, unless required longer for an active security investigation, legal claim or regulatory requirement. |
| Rate-limiting data | Minutes — the length of the applicable window |
| Backups | Retained for the database provider's point-in-time recovery window; deleted data disappears from backups as that window rolls forward |
[REQUIRES QUALIFIED LEGAL REVIEW] — the Service holds records that a taxable person may be legally obliged to retain under UAE tax law. A deletion request may conflict with the customer's own record-keeping obligation. Counsel should confirm the retention floor and how it interacts with the erasure right at clause 8.
8. Your rights under the PDPL
Subject to the conditions and exceptions in the PDPL, you have the right to:
1. Be informed — how your data is processed (this notice).
2. Access — obtain confirmation and a copy of your personal data.
3. Portability — receive data you provided in a structured, machine-readable format, and have it transferred where technically feasible. You can export your records from the Service at any time.
4. Rectification — correct inaccurate or incomplete data. Most account and company data is editable in the Service directly.
5. Erasure — request deletion, subject to our legal obligations and to clause 7.
6. Restrict or stop processing — including objecting to processing carried out on bases other than consent, to the extent the PDPL provides.
7. Withdraw consent — for analytics cookies and for marketing, at any time, without affecting processing already carried out.
8. Complain — to us first (docs/legal/complaints-handling.md), and to the UAE Data Office if you are not satisfied.
8.1 How to exercise them
Email support@univiaglobal.com . We will verify your identity and respond within [RESPONSE PERIOD — CONFIRM against the PDPL Executive Regulations; 30 days proposed]. There is no charge unless a request is manifestly unfounded or excessive.
8.2 An honest limitation
The Service does not currently provide a self-service "delete my account and all my data" button. Account and data deletion is handled manually on request to support@univiaglobal.com . Company records can be archived in-product, which hides them but does not delete them. Univia intends to build self-service deletion; until then, the manual route is the route. [PRODUCT FOLLOW-UP — self-service account deletion.]
8.3 If we are only the processor
If your request concerns personal data inside another customer's business records — for example, you are a customer of a business that uses Univia Tax — we will refer you to that business, which is the controller. We cannot act on your request without its instruction.
8.4 Honest note on malware scanning
Uploaded files are checked against their declared file type before processing, and a file whose contents do not match its declared type is rejected. A malware scanning service is supported by the Service but is not enabled by default; where it is not enabled, documents are recorded honestly as "not scanned" and processed. The document list shows this status on every file. See clause 9 and docs/legal/security-and-incident-notice.md.
9. How we protect it
A fuller and deliberately honest account is at docs/legal/security-and-incident-notice.md. In summary, as at the date of this notice:
• Encryption in transit — HTTPS enforced throughout, with HTTP Strict Transport Security applied for two years including subdomains.
• Passwords — stored as bcrypt hashes only.
• Sessions — JWT sessions capped at 14 days; cookies marked Secure in production with hardened cookie prefixes; authentication enforced by middleware across every application route.
• Tenant isolation — every query is scoped to the acting user and their companies, and cross-tenant isolation is covered by a dedicated automated test suite per table. Database-level row-level security policies are deployed across all 38 application tables; they are currently active on a subset of routes only (document presign, document confirm, and chat) and are enabled by configuration. On other routes isolation is enforced at the query layer. This is stated plainly rather than overclaimed.
• Uploads — files go directly from your browser to object storage using short-lived presigned URLs and never pass through our application server. A 25 MB size cap and an accepted-file-type list apply. The leading bytes of every file are checked against its declared type before any processing.
• Browser hardening — an enforced Content Security Policy with no external script host permitted, framing denied, and a restrictive permissions policy.
• Rate limiting — on login, registration, uploads, document confirmation, chat, imports, and e-invoicing submission.
• Backups — point-in-time recovery from the database provider's write-ahead log history.
• Access control — internal access to customer data is limited and governed by docs/legal/employee-and-contractor-access-terms.md.
No system is perfectly secure. Known residual risks are recorded openly in docs/security/HARDENING.md and summarised in the security notice.
10. Cookies and local storage
See the Cookie Notice (docs/legal/cookie-notice.md). In short: essential cookies keep you signed in and secure the Service; non-essential analytics cookies stay off unless you accept them, and dismissing or ignoring the banner never counts as acceptance.
11. Children
The Service is for business use and is not directed at anyone under 18. We do not knowingly process children's personal data. If you believe we have, contact support@univiaglobal.com and we will delete it.
12. Changes to this notice
We may update this notice. For material changes we will give at least 30 days' notice by email and in-product before the change takes effect, and will update the "last updated" date. Where a change requires your consent, we will ask for it.
13. Contact
Univia Global Consultancy L.L.C-FZ, Trade Licence No. 2534238.01, Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates. Application: https://app.univiaglobal.ae. Data-protection enquiries, rights requests, support, complaints and security reports: support@univiaglobal.com.
You may also complain to the UAE Data Office established under Federal Decree-Law No. 45 of 2021.