Privacy Policy

Shaula Consulting is a boutique legal consulting firm based in Abu Dhabi, United Arab Emirates, serving clients globally. For the purposes of the PDPL we act as the Controller of the personal data described in this notice, and as a Processor where we handle personal data on a client's instructions as part of an engagement.

Questions, requests, or complaints about personal data can be sent to info@shaulaconsulting.com.

• Contact and enquiry data: name, email address, organisation, role, and the content of messages you send us.
• Client and engagement data: information needed to advise you, issue engagement terms, invoice, and keep records of advice given.
• KYC and onboarding data: corporate documents, identification documents, ownership and authorised signatory details, and certification requirements you upload to our secure client portal.
• Account and access data: the email address used to invite you, authentication credentials held in hashed form, and audit records of uploads, replacements, and downloads.
• Technical data: limited log data generated when you use our website or portal, used for security and service integrity.

We do not seek sensitive personal data beyond what is strictly required for identity verification, anti-money-laundering, and conflict checks.

• Performance of a contract: to provide legal consulting services, operate the client KYC portal, and manage billing.
• Legal obligation: to meet know-your-client, anti-money-laundering, sanctions screening, and record-keeping duties.
• Legitimate interests: to secure our systems, maintain audit trails, and protect or establish legal rights.
• Consent: where you voluntarily send us an enquiry or ask us to contact you. Consent may be withdrawn at any time without affecting processing already carried out.

We do not use your personal data for automated decision-making that produces legal effects, and we do not sell personal data or use it for marketing lists.

We disclose personal data only where necessary: to service providers who host our website, database, and document storage under confidentiality obligations; to notaries, attesting authorities, or apostille services where you instruct us to arrange certification; to counsel or advisers engaged on your matter; and to regulators, courts, or authorities where required by UAE law.

Our hosting and email infrastructure may store or process data outside the UAE. Where personal data is transferred outside the UAE, we rely on transfers to jurisdictions with an adequate level of protection or on contractual safeguards with the recipient, as permitted by Articles 22 and 23 of the PDPL.

Client documents are held in a private storage area accessible only to the authenticated client and authorised firm personnel. Access is invitation-only, passwords are stored in hashed form, share links are tokenised and expire, and every upload, replacement, and certification action is recorded in an audit log.

We keep engagement and KYC records for the period required by UAE professional, tax, and anti-money-laundering obligations — generally at least five years after an engagement ends — and then delete or anonymise them. Enquiry data that does not become an engagement is deleted once it is no longer needed.

• Request information about how your data is processed and to whom it is disclosed.
• Request access to, and a copy of, your personal data.
• Request correction of inaccurate or incomplete data.
• Request erasure, subject to our legal record-keeping obligations.
• Request restriction of processing or object to processing in defined cases.
• Request portability of data you provided to us in a structured format.
• Withdraw consent where consent is the basis of processing.
• Lodge a complaint with the UAE Data Office.

Send requests to info@shaulaconsulting.com. We respond within the period prescribed by the PDPL and may ask you to verify your identity first.

We may update this notice to reflect changes in our services or in applicable law. The date at the top of this page shows when it was last revised.