Privacy Policy
FirmFox Management Consultancies LLC ("FirmFox", "we", "us" or "our") is committed to protecting the privacy and security of Personal Data. This privacy policy (the “Privacy Policy”) explains how we collect, use, disclose, store and otherwise process Personal Data (the “Personal Data”) when users and clients (hereinafter referred to as “you” or the “Client”) use our website, online portal, wallets, dashboards, service catalogue and related digital tools (together, the "Platform"), when you request or receive our corporate, immigration, PRO or related services, or when you otherwise interact with us or use the Platform.
This Privacy Policy is primarily prepared by reference to the applicable privacy and data protection laws of the United Arab Emirates ("UAE"). Depending on your location, the location of the relevant customer, or the context in which Personal Data is processed, certain other privacy or data protection laws may also apply. Where mandatory laws of another jurisdiction apply to a particular processing activity, those laws shall apply in addition to, and to the extent of any conflict shall prevail over, this Privacy Policy.
This Privacy Policy should be read together with, and forms part of, the Terms, the applicable Data Protection Addendum ("DPA") entered into between FirmFox and the relevant business Client, and any other terms, conditions, notices or policies referenced in the Terms or made available on the Platform from time to time. In the event of any conflict between this Privacy Policy and the DPA in relation to the processing of Client Personal Data, the DPA shall prevail to the extent of that conflict.
Where FirmFox processes Personal Data on behalf of a business Client for the purpose of providing services under the Terms, FirmFox acts as a data processor and the relevant Client acts as a data controller in respect of that processing. In such cases, the DPA governs the specific processor obligations and responsibilities of each party and supplements this Privacy Policy accordingly. FirmFox may also act as an independent data controller in respect of Personal Data it processes for its own internal purposes, including billing, compliance, fraud prevention, sanctions screening and Platform administration, in which case this Privacy Policy applies directly.
By clicking “I agree”, “Accept”, or by otherwise accessing or using the Platform, you acknowledge that you have read, understood and agree to this Privacy Policy, the Terms, any applicable Data Protection Addendum (when applicable) or processing terms, and any other terms, conditions, notices or policies referenced in the Terms or made available on the Platform from time to time.
1. Personal Data We Collect
The categories of Personal Data we may collect and process include the following:
Identity and contact information, such as name, email address, phone number, nationality, date of birth, gender, job title, employer details, postal address and account credentials.
Government, immigration and identification records, such as passport details, Emirates ID details, visa information, immigration file details, labour card or work permit information, licence details and other official identifiers or records required for the relevant service.
Corporate and employment-related documents, such as trade licences, incorporation documents, establishment cards, powers of attorney, employment documents, salary or designation information, company ownership information and compliance-related documents provided as part of a service request.
Transaction and financial information, such as payment details, invoice information, wallet balances, Expense Balance funding records, FirmFox Credits history, refunds, reconciliations and related records associated with your use of our Platform or services.
Service and case data, such as information contained in Orders, applications, support requests, uploaded documents, status updates, transaction logs, reference IDs and correspondence with us.
Technical and usage data, such as IP address, browser type, device information, log-in history, access timestamps, activity logs and other information generated through your use of the Platform or website.
We may collect Personal Data directly from you, from your employer or organization, from authorized users acting on your behalf, from government authorities or third-party service providers involved in the relevant service, and from publicly available or lawful third-party sources where appropriate.
2. How We Use Personal Data
We may use Personal Data for the following purposes:
to create, manage and administer user accounts and access to the Platform;
to receive, assess, process, manage and fulfil Orders and related service requests;
to prepare, submit, track and follow up on applications, filings and requests with
government authorities, free zones, regulators and other relevant third parties;
to verify identity, conduct due diligence, perform sanctions, anti-money laundering, and know-your-customer checks, and comply with legal and regulatory obligations,
to manage payments, invoices, credits, Expense Balance funding, reservations, deductions, reconciliations and refunds;
to communicate with you about your account, services, transactions, document requirements, regulatory updates, support issues or changes to our terms, policies or processes;
to improve, maintain, monitor and secure the Platform, website and related systems, including through troubleshooting, analytics, fraud prevention and audit logging;
to establish, exercise or defend legal claims, and to enforce our contractual rights and policies; and
to manage our internal business operations, record-keeping, quality assurance and reporting.
3. Legal Basis for Processing
Where required by applicable law, we process Personal Data on one or more of the following bases:
the processing is necessary to provide requested services, operate the Platform, perform a contract or take steps at your request before entering into a contract;
the processing is necessary to comply with a legal or regulatory obligation to which we are subject;
the processing is necessary for our legitimate interests in operating, protecting and improving our business and services, provided those interests are not overridden by applicable law or your rights where relevant;
you have provided consent, where consent is required or otherwise appropriate under the circumstances.
Because our services often involve immigration, licensing, employment and compliance processes, certain data fields and documents may be mandatory. If you do not provide the required Personal Data, we may be unable to open an account, process an Order, complete the requested service or comply with applicable legal requirements.
4. How We Share Personal Data
We may disclose Personal Data to the following categories of recipients where reasonably necessary for the purposes described in this Privacy Policy:
government authorities, free zones, ministries, regulators, courts and other official bodies involved in the relevant service;
third-party service providers and operational partners, such as IT hosting providers, cloud service providers, software vendors, payment processors, wallet providers or settlement partners, identity verification providers, document management providers, couriers, translation providers, attestation providers and customer support tools;
professional advisers, including lawyers, accountants, auditors and insurers;
affiliates, group entities or internal personnel who need access for lawful business, operational, compliance or support purposes;
any party to whom disclosure is required or permitted by applicable law, court order, regulatory request or lawful governmental request;
a prospective or actual purchaser, investor, lender or transaction adviser in connection with a merger, acquisition, restructuring, financing or sale of all or part of our business, subject to appropriate confidentiality protections.
We do not sell Personal Data to third parties for their own independent marketing purposes.
5. International Transfers
The Personal Data we collect from you may be transferred to third-party processors located outside the United Arab Emirates, including to jurisdictions that may not have equivalent data protection laws. However, such transfers will only occur under one of the following safeguards in compliance with UAE data protection law:
Adequacy decisions: Transfers to countries recognized by the UAE Data Office as providing an adequate level of protection (once such a list is published).
Binding contractual commitments: Agreements with processors that include UAE-approved data protection clauses (or equivalent safeguards) to ensure your data receives protection comparable to UAE law.
Explicit consent: Where required, we will obtain your prior consent after informing you of potential risks.
Legal necessity: Transfers necessary for legal claims, contract performance, or public interest purposes.
We will take all reasonable steps to ensure your data remains secure and is processed in accordance with this policy.
6. Data Retention
We retain Personal Data for as long as reasonably necessary for the purposes described in this Privacy Policy, including for the duration of the relevant customer relationship, service engagement, account activity and any applicable follow-up support, compliance or dispute period.
We may retain Personal Data for a longer period where necessary to comply with legal, regulatory, tax, accounting, anti-money laundering, sanctions screening, record-keeping or evidentiary obligations, or where necessary to establish, exercise or defend legal claims.
Where your Account or subscription has expired or been terminated, we may continue to retain certain Personal Data for the purposes described in this section. During this period, you may continue to exercise your applicable privacy rights in respect of that Personal Data in accordance with section 8.
When Personal Data is no longer required, we will take reasonable steps to delete, anonymize, or securely destroy it in accordance with applicable law and our internal retention practices.
7. Security
We take security seriously. While we cannot guarantee to keep your data 100% secure, we are committed to protecting you (and us) from unauthorized access to, or unauthorized alteration, disclosure, or destruction of, Personal Data that we hold by taking the following measures:
We secure information you provide on computer servers in a controlled, secure environment, protected from unauthorized access, use, or disclosure.
We maintain commercially reasonable administrative, technical, and physical safeguards in an effort to protect against unauthorized access, use, modification, and disclosure of Information in its control and custody.
We regularly review our information collection, storage and processing practices, including physical, logical and organizational security measures, to guard against unauthorized access to systems and data stores.
These measures include role-based access controls, secure cloud infrastructure, encrypted connections (HTTPS), authentication controls (including multi-factor authentication for privileged access), and logging and monitoring of access to systems and documents.
Documents and files uploaded through the Platform are stored in secure cloud storage and may be accessed via expiring, authenticated links to reduce the risk of unauthorised long-term access.
However, no data transmission over the Internet or wireless network can be guaranteed. Therefore, while we strive to protect your Personal Information, you acknowledge that:
there are security and privacy limitations of the Internet which are beyond our control;
the security, integrity, and privacy of any and all information and data exchanged between you and the Platform and services cannot be guaranteed; and
any such information and data may be viewed or tampered with in transit by a third party, despite best efforts.
8. Your Rights
Subject to applicable law and the circumstances of the relevant processing, you may have the right to:
request access to Personal Data we hold about you;
request correction, update or completion of inaccurate or incomplete Personal Data;
request deletion of Personal Data, where we are not legally required or otherwise entitled to retain it;
object to or request restriction of certain processing activities, in circumstances recognised by applicable law;
withdraw consent where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;
request portability of your Personal Data where such a right is provided under applicable law.
These rights may be exercised even after your Account or subscription has been closed, for as long as we retain your Personal Data in accordance with this Privacy Policy.
Where FirmFox processes your Personal Data as a data processor on behalf of a business Client who acts as the data controller, requests to exercise your rights in respect of that Personal Data should be directed to the relevant Client as the data controller. If FirmFox receives such a request directly, it may refer the request to the relevant Client and may not respond directly unless instructed by the Client or required by applicable law.
These rights are not absolute. We may decline or limit a request where permitted or required by law, including where the data is needed for legal compliance, fraud prevention, ongoing service delivery, dispute resolution or the establishment, exercise or defence of legal claims.
9. Children's Data
Our Platform and services are not intended for or directed to children, and children under 18 are not permitted to create an account or independently request services through the Platform. By using the Platform, you represent that you are at least 18 years old and have authority to act for any individuals on whose behalf you submit information.
Notwithstanding the above, certain services (for example, immigration, residency or sponsorship services) may require us to process Personal Data relating to children or dependants. In such cases, we will only process children’s Personal Data where it is lawfully provided to us by a parent, legal guardian, sponsor, employer or other responsible business Client in connection with a permitted service, and where such processing is necessary for that service or required by applicable law.
We do not knowingly allow children to use the Platform in their own capacity as primary accountholders, and we do not knowingly collect children’s Personal Data directly from children for independent marketing or profiling purposes.
10. Data Breach
In the event we become aware that the security of the Platform and services has been compromised or Personal Data has been disclosed to unrelated third parties as a result of external activity, including, but not limited to, security attacks or fraud, we reserve the right to take reasonably appropriate measures, including, but not limited to, investigation and reporting, as well as notification to and cooperation with law enforcement authorities. In the event of a data breach, we will make reasonable efforts to notify affected individuals if we believe that there is a reasonable risk of harm to the user as a result of the breach or if notice is otherwise required by law. When we do, we will notify you by email or by another appropriate method permitted or required by applicable law, which may include in-Platform notices, SMS, push notifications or other direct communications.
11. Cookies and Similar Technologies
Our Platform uses only cookies and similar technologies that are strictly necessary for the operation, security and basic functionality of the site (for example, to maintain your session, keep you logged in, and protect against fraud or misuse). These cookies are essential to provide the services you request and cannot be switched off in our systems, although you may be able to adjust your browser settings to block or alert you about them.
We do not currently use non-essential cookies for analytics, advertising or cross-site tracking. If we later introduce analytics, performance or marketing cookies, we will update this Privacy Policy and, where required by applicable law, provide appropriate notice and obtain your consent through a cookie banner or settings interface before such cookies are placed on your device. You will then be able to manage your cookie preferences in line with the mechanisms made available on the Platform and in your browser.
12. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, Platform features, legal obligations, security practices or business operations. We will post the updated version on the relevant website or Platform page and update the "Last Updated" date above.
Where required by applicable law, we will also notify you of material changes by email, portal notice or other appropriate means.
13. Contact Us
If you have any questions, concerns or requests relating to this Privacy Policy or our handling of Personal Data, you may contact us at: