1. Controller and scope
The controller for the website and service enquiries is Bright Global Tax Consulting and Accounting FZCO, Trade Licence 39140, IFZA Properties, Dubai Silicon Oasis, Dubai, United Arab Emirates (“BGA”, “we”).
Privacy requests: office@bga.ae. Telephone: +971 56 679 7475.
This notice covers website visits, forms, and conversations initiated through email, Telegram, WhatsApp or telephone. A client engagement may require a separate engagement notice and statutory recordkeeping.
2. Data we handle
- Contact and enquiry data: name, telephone/WhatsApp number, optional email, selected service, message, language, page URL and the time of an affirmative form submission.
- Communications: correspondence you initiate and the information needed to respond, arrange a call or prepare a proposal.
- Technical and security data: IP address, request metadata, user agent, security events and server logs processed by BGA and its hosting/security provider.
- Consent and preference data: cookie categories and, for enquiry forms, the affirmative consent flag, UTC timestamp, privacy-policy and consent-text versions, locale and canonical page URL; plus withdrawal or marketing suppression status where applicable.
- Optional analytics data: page and link interactions, broad device/browser information and conversion events, only after Analytics is granted.
- Optional marketing data: UTM parameters, advertising click identifiers, landing URL, referrer and configured conversion events, only after Marketing is granted.
The six browser-supplied consent fields record what the enquiry form submitted. They are not a digital signature, cryptographic proof, guarantee of identity, or exactly-once delivery record. The server adds its own receipt timestamp to the Telegram notification.
We do not use the website tools to make a solely automated decision that has legal or similarly significant effects on you.
3. Purposes and processing grounds
Responding to your request
We use the details you affirmatively submit to understand the requested service, reply, schedule a discussion and, where requested, prepare or amend a proposal. This is processing needed to take measures at your request with a view to concluding, amending or ending a contract under Article 4(9) of UAE Federal Decree-Law No. 45 of 2021.
Site delivery, security and legal duties
Necessary processing supports site delivery, abuse prevention, security, record integrity, legal claims and obligations imposed by UAE law where applicable. Necessary technologies cannot be disabled through the cookie panel.
Analytics and marketing
Optional Analytics and Marketing providers run only after a clear category choice. Marketing contact is separate from a request for a service response. If BGA offers a marketing opt-in, it must be optional and may be withdrawn. You may object to and stop direct-marketing processing under Article 17 of the UAE PDPL.
Phone, SMS and social-app marketing is also subject to UAE Cabinet Resolution No. 56 of 2024 and related telemarketing controls, including applicable approval, opt-in/contact-channel and Do Not Call Registry requirements. A service enquiry does not by itself authorise unrelated marketing.
Official sources: UAE Federal Decree-Law No. 45 of 2021 (PDPL) and Cabinet Resolution No. 56 of 2024.
4. Providers, recipients and cross-border processing
We limit disclosures to providers needed for the stated purpose, professional advisers where necessary, and public authorities where legally required. Current website and enquiry providers include:
| Provider / recipient | Role and data | When active |
|---|---|---|
| Cloudflare | Website delivery, hosting-layer request handling, security and abuse prevention; may process IP and request/log data. | Necessary for site delivery |
| Telegram | Delivery and storage of an enquiry notification containing the form details, the six browser-supplied consent-record fields, and an authoritative server receipt timestamp. | When you submit a form after checking the required consent box |
| WhatsApp (Meta) | Communication content and account/connection data when you choose to start or continue a WhatsApp conversation. | User-initiated |
| Yandex Metrica | Page, link and conversion measurement. Webvisor/session replay is disabled. | Analytics consent |
| Google Analytics 4 | Page and conversion measurement. Because the current Google tag is linked to Google Ads, it is withheld on an Analytics-only choice. | Analytics and Marketing consent |
| Google Ads | Campaign attribution and configured advertising conversions. | Marketing consent |
| LinkedIn Insight | Campaign attribution and confirmed lead conversion measurement. | Marketing consent |
These providers may process data outside the UAE, and their infrastructure locations can change. Cross-border processing is not based on consent alone. Depending on the destination and purpose, BGA must use an available mechanism under Articles 22–23 of the UAE PDPL, such as a recognised adequate protection environment, applicable agreements/contractual safeguards, explicit transfer consent where appropriate, or a transfer necessary to conclude or perform a contract requested by the data subject. Vendor terms and operational safeguards must be reviewed in practice; this page cannot create them by itself.
5. Retention
- Enquiries and Telegram lead records: up to 24 months after the last interaction, unless a client relationship, legal claim or statutory duty requires a longer period.
- Consent choice: in your browser for up to 180 days, or until you withdraw it, clear browser storage, or a material policy/category version change requires a new choice.
- Session attribution and engagement: until the browser tab/session closes.
- Marketing suppression: a minimal record may be retained as necessary to honour an opt-out and avoid contacting you again.
- Security logs: for a limited period set according to security need and provider configuration.
- Client and statutory records: kept separately under the engagement and applicable UAE accounting, tax, AML, employment or legal retention requirements.
At the end of the applicable period, data is deleted or anonymised unless continued retention is required or permitted.
6. Your choices and rights
Subject to the UAE PDPL and applicable exceptions, you may request information/access, correction, deletion, restriction or stopping of processing, and transfer/portability of personal data. You may object to direct marketing, withdraw consent without affecting earlier lawful processing, and complain to the UAE Data Office where the statutory complaint route applies.
Email office@bga.ae with the request and enough information for us to identify the relevant record. We may need proportionate identity verification. We will explain if a legal retention duty or another permitted exception limits a request.
7. Security and data incidents
BGA applies proportionate technical and organisational measures intended to protect confidentiality, integrity and availability, including access controls, provider controls, minimisation, transport encryption where supported, and incident handling. No internet transmission or storage method is guaranteed completely secure.
Suspected incidents are assessed and contained, and notifications to the UAE Data Office and affected people are made where required by applicable law and regulatory procedures. Report a concern promptly to office@bga.ae.
8. Cookies and similar technologies
Necessary storage keeps the privacy decision and supports security/site delivery. Analytics, Marketing and Functional categories are off by default. The settings panel names each active provider, purpose, storage mechanism and duration before release. Events produced before consent are discarded rather than replayed after consent.
You can reject optional technologies as easily as accepting them, change categories, or withdraw a category at any time. Withdrawal stops new optional calls and clears BGA-accessible named storage; provider-side deletion may also require a request to that provider or to BGA.
9. Changes and important limitation
We update the effective date and policy version when this notice materially changes. A material change to cookie purposes or categories invalidates the earlier browser choice and asks again.