Privacy Policy

Shaula Consulting is a boutique legal consulting firm specialising in corporate and commercial legal matters, based in Abu Dhabi, United Arab Emirates, and serving clients globally. For the purposes of the PDPL we act as the Controller of the personal data described in this notice, and as a Processor where we handle personal data on a client's instructions as part of an engagement.

Questions, requests, or complaints about personal data can be sent to info@shaulaconsulting.com.

• Contact and enquiry data: name, email address, organisation, role, and the content of messages you send us.
• Client and engagement data: information needed to advise you, issue engagement terms, invoice, and keep records of advice given.
• KYC and onboarding data: corporate documents, identification documents, ownership and authorised signatory details, and certification requirements you upload to our secure client portal.
• Account and access data: the email address used to invite you, authentication credentials held in hashed form, and audit records of uploads, replacements, downloads, and notifications.
• Billing data: fee arrangements, invoices, and payment references. We do not store full payment card numbers.
• Technical data: limited log data generated when you use our website or portal, used for security and service integrity.

We do not seek sensitive personal data beyond what is strictly required for identity verification, anti-money-laundering, sanctions screening, and conflict checks.

• Directly from you, by email, in meetings, or through our client portal.
• From people acting for you, such as colleagues, directors, shareholders, or other advisers on your matter.
• From public and commercial sources used for due diligence, such as company registries, sanctions and adverse-media databases.
• Automatically, through security and service logs when you use our website or portal.

Where you provide personal data about other individuals (for example beneficial owners or signatories), you confirm you may share it with us and that they have been told about this notice.

• Performance of a contract: to provide legal consulting services, operate the client KYC portal, and manage billing.
• Legal obligation: to meet know-your-client, anti-money-laundering, sanctions screening, tax, and record-keeping duties.
• Legitimate interests: to secure our systems, maintain audit trails, improve our services, and protect or establish legal rights.
• Consent: where you voluntarily send us an enquiry or ask us to contact you, and for non-essential cookies. Consent may be withdrawn at any time without affecting processing already carried out.

We do not use your personal data for automated decision-making that produces legal effects, and we do not sell personal data or rent it for marketing lists.

We disclose personal data only where necessary: to service providers who host our website, database, document storage, and email delivery under confidentiality obligations; to notaries, attesting authorities, translators, or apostille services where you instruct us to arrange certification; to counsel, auditors, or advisers engaged on your matter; and to regulators, courts, or authorities where required by UAE law.

Our processors act only on our documented instructions and are bound to apply appropriate technical and organisational safeguards.

Our hosting and email infrastructure may store or process data outside the UAE, and clients we serve are located globally. Where personal data is transferred outside the UAE, we rely on transfers to jurisdictions with an adequate level of protection or on contractual safeguards with the recipient, as permitted by Articles 22 and 23 of the PDPL. You may request information about the safeguards applied to a specific transfer.

Client documents are held in a private storage area accessible only to the authenticated client and authorised firm personnel. Access is invitation-only, passwords are stored in hashed form, share links are tokenised and expire, data is encrypted in transit, and every upload, replacement, and certification action is recorded in an audit log.

No system is perfectly secure. If a personal data breach is likely to prejudice your privacy or confidentiality, we will notify the UAE Data Office and affected individuals as required by the PDPL.

We keep engagement and KYC records for the period required by UAE professional, tax, and anti-money-laundering obligations — generally at least five years after an engagement ends — and then delete or anonymise them. Enquiry data that does not become an engagement is deleted once it is no longer needed. Security logs are kept for a short period proportionate to their purpose.

Our website uses strictly necessary cookies to keep you signed in to the client portal and to remember your consent choices, together with optional functional and analytics cookies. You can accept or decline non-essential cookies in the consent banner and change your choice at any time. Full detail is in our Cookie Policy.

• Request information about how your data is processed and to whom it is disclosed.
• Request access to, and a copy of, your personal data.
• Request correction of inaccurate or incomplete data.
• Request erasure, subject to our legal record-keeping obligations.
• Request restriction of processing or object to processing in defined cases.
• Request portability of data you provided to us in a structured format.
• Withdraw consent where consent is the basis of processing.
• Lodge a complaint with the UAE Data Office.

Send requests to info@shaulaconsulting.com. We respond within the period prescribed by the PDPL and may ask you to verify your identity first. Exercising these rights is free of charge unless a request is excessive or repetitive.

Our services are directed to businesses and their representatives. We do not knowingly collect personal data from children. Where a matter requires data about a minor, we process it only on a client's instructions and with the appropriate legal basis and safeguards.

If you believe we have handled your personal data improperly, contact us first at info@shaulaconsulting.com so we can investigate and respond. You also have the right to complain to the UAE Data Office, which supervises compliance with the PDPL.

We may update this notice to reflect changes in our services or in applicable law. The date at the top of this page shows when it was last revised. Material changes affecting current clients will be communicated by email.

Shaula Consulting, Abu Dhabi, United Arab Emirates. All privacy enquiries and data subject requests: info@shaulaconsulting.com. Please mark your message “Privacy request” so it reaches the right person quickly.