Privacy Notice

NKR Compliance Portal – Privacy Notice (version 1.0, effective [date])

1. Controller. NKR Auditing LLC, [address], Dubai, UAE, is the controller of personal data processed through the Portal. Contact: [admin@portal.nkr.ae].

1. What we collect. Name, work email, mobile number and organisation of each user; login and activity records (time, IP address, actions taken); documents and information uploaded for the engagement, which may include personal data of the client's employees, owners and counterparties; support requests; and, where a user opts in, a WhatsApp number.

1. Why we process it. To provide the compliance services agreed in the engagement letter; to operate the Portal and keep it secure; to communicate about the engagement by email and, if opted in, WhatsApp; to maintain the audit trail required by law and professional standards; and to meet our legal obligations, including tax and anti-money-laundering requirements.

1. Legal basis. Performance of the contract with the client; our legitimate interests in operating a secure service and keeping professional records; compliance with legal obligations; and your consent for WhatsApp messages, which you can withdraw in your profile at any time.

1. Where data is kept. The Portal and its database and files are hosted in the United Arab Emirates (Microsoft Azure, UAE North region). Transactional email is sent through [Resend]; WhatsApp messages, where enabled, are sent through Meta's WhatsApp Business platform via [Twilio]; error monitoring uses [Sentry]. These providers may process limited data outside the UAE under contractual safeguards.

1. Who sees it. Our staff assigned to the engagement and our managers; the users your organisation has nominated, limited to the entities mapped to them; and service providers listed above, only to the extent needed to run the service. We do not sell personal data.

1. Retention. Engagement data stays on the Portal while the engagement is active and for a period afterwards, then is deleted from the Portal; we retain the engagement file in our own records for the period required by law and professional standards (at least [seven] years). The audit log of the engagement is retained with the file.

1. Your rights. Subject to UAE law, you may ask to access, correct or delete your personal data, to restrict or object to processing, or to receive a copy in a portable form, by writing to [admin@portal.nkr.ae]. Some data cannot be deleted while we are required to keep it.

1. Security. Access is by password or one-time code; all traffic is encrypted; files are encrypted at rest; every action is logged; access is withdrawn when a user leaves.

1. Changes. We may update this Notice; you will be asked to acknowledge the new version at your next sign-in.