Privacy Policy.

1. Who we are

The Tax Lead is a trading name of The Tax Lead Limited, a company registered in England & Wales (Company No. 14111081) at WeWork, 8 Devonshire Square, London EC2M 4YJ. We operate in the UAE market with Chartered Tax Adviser-led services and VAT registration with the UAE Federal Tax Authority (FTA), pending completion of our UAE free zone establishment.

For UK GDPR purposes, The Tax Lead Limited is the Data Controller. For UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) purposes, The Tax Lead is the Controller in respect of personal data processed in connection with UAE-based services.

2. What personal data we collect

Depending on the services we provide to you, we may collect:

• Identification data — name, date of birth, nationality, residence address, passport / Emirates ID copies, UTR / TIN / tax reference numbers.
• Contact data — email, phone, postal address, WhatsApp number, LinkedIn.
• Financial data — income, assets, liabilities, bank details, prior tax returns, financial statements — strictly for provision of accounting and tax services.
• Business data — where you’re a business client, your company’s information, UBOs, trade licence, directors.
• Communication data — emails, WhatsApp exchanges, call notes, meeting records.
• Website analytics — anonymised page analytics (see our Cookie Policy).

3. Why we collect it (lawful basis)

We process your personal data on one or more of these lawful bases:

• Contract — to perform the engagement letter you’ve signed with us.
• Legal obligation — to meet UK and UAE anti-money-laundering, tax, companies-house, FTA and other regulatory requirements.
• Legitimate interests — to run the firm, communicate with you, improve our services, maintain security and defend ourselves against claims.
• Consent — for marketing emails and non-essential analytics cookies, where separately opted in.

4. Who we share it with

We never sell your personal data. We may share it with:

• Tax authorities — HMRC, UAE FTA, Companies House — for filings and compliance.
• Software providers — Xero, QuickBooks Online, Dext, Microsoft, Signwell — all under data processing agreements.
• Professional partners — introduced auditors, immigration lawyers, bank KYC teams — only with your consent and only what’s needed.
• Our UK sister firm — The Tax Lead Limited — where your engagement spans UK and UAE.
• Regulators — ACCA (our professional body) — where lawfully required.

5. How long we keep it

We keep personal data for as long as we have an engagement with you, plus the retention periods required by UK and UAE law:

• Tax and accounting records — 7 years from the end of the relevant tax year (UK and UAE both).
• AML / client-identification records — 5 years from end of relationship.
• Marketing contacts — until you unsubscribe or 3 years with no interaction.
• Website analytics — 26 months.

6. Your data protection rights

Under UK GDPR and UAE PDPL you have rights to:

• Access your personal data
• Rectification of inaccurate data
• Erasure (right to be forgotten, subject to retention requirements)
• Restriction of processing
• Data portability
• Object to processing based on legitimate interests
• Withdraw consent at any time (for consent-based processing)

To exercise any of these rights, email info@thetaxlead.ae. We respond within 30 days.

7. Security & cross-border transfers

We hold personal data on encrypted cloud systems (Microsoft 365, Xero, Dext, SharePoint) under GDPR-adequate data processing agreements and ISO 27001-aligned controls where applicable.

7.1 Dual-firm model (UK ↔ UAE)

The Tax Lead operates a dual-firm model — The Tax Lead Limited (England & Wales, ACCA regulated) and The Tax Lead UAE. Where you engage both sides, or where either side needs the other to serve you (for example a UK expat matter touching UAE residence, or a UAE sub inside a UK group), personal data is shared between the two sides under an intra-group data-sharing agreement. UK data flowing to the UAE is covered by an International Data Transfer Agreement (UK IDTA) made with reference to the UK ICO's 2022 standard; UAE data flowing to the UK relies on the UK's adequacy status for the UAE PDPL where applicable, and on contractual safeguards otherwise.

7.2 Dhaka (Bangladesh) delivery team

Part of our bookkeeping, management accounts, VAT preparation and administrative work is delivered from Dhaka, Bangladesh, under direct UK Chartered Certified Accountant supervision. Bangladesh is not covered by a UK adequacy decision, and is not currently on the UAE Data Office's list of countries providing an adequate level of protection. We therefore transfer personal data to our Dhaka delivery team under the following Article 46 UK GDPR / UAE PDPL cross-border safeguards:

• UK IDTA (International Data Transfer Agreement) between The Tax Lead Limited and its Dhaka delivery entity, incorporating the UK Addendum to the EU Standard Contractual Clauses.
• UAE PDPL-compliant data processing agreement under Article 23 of Federal Decree-Law No. 45 of 2021, including the required controller-to-processor obligations.
• Transfer Risk Assessment (TRA) covering legal access risks in Bangladesh, with technical safeguards (encryption at rest and in transit, access logging, no local-device storage).
• Role-based access — Dhaka team members access only the data needed for their assigned work; they do not store client data on local devices.
• UK/UAE-side supervision — a UK-qualified Chartered Certified Accountant reviews and signs off work before it reaches you.

You can request a copy of our current TRA and the operative IDTA by emailing info@thetaxlead.ae. You can object to onward processing from Dhaka at any time; where you do, we will route your work entirely through UK and UAE staff.

7.3 Other third-country service providers

Where any other third-country processor becomes involved (for example a US-based cloud subprocessor used by Microsoft, Xero or Dext), we rely on the UK Extension to the EU-US Data Privacy Framework, the UK IDTA, or on adequacy decisions, as appropriate. A full subprocessor list is available on request.

8. Contact & complaints

Data protection queries: info@thetaxlead.ae

If you’re not satisfied with our response, you can complain to the UK Information Commissioner’s Office (ico.org.uk) or the UAE Data Office (dataoffice.gov.ae). You can also use our internal Complaints procedure.