Privacy Policy

1. What we collect

We only collect what you choose to give us through our forms, WhatsApp, phone or email, plus limited technical data from your browser.

• Contact details: your name, mobile or WhatsApp number, email address and, if you give it, your company name.
• Your request: the service you need, your country and city, timeline, budget range and any message you write.
• Consent record: that you ticked the consent box and the date and time you did so.
• Campaign data: the page you came from and marketing tags in the link you clicked (such as utm_source or a Google Ads click ID), so we know which channels bring enquiries.
• Technical data: IP address, browser type and pages viewed. Analytics and advertising cookies are set only if you accept them in the cookie notice.
• Payments: if you book a paid consultation, Stripe processes your card. We receive confirmation of payment, never your full card number.

2. Why we use it

Our legal basis is your consent, which you give by ticking the box on our forms, and the steps needed to respond to the request you made. You can withdraw consent at any time (see section 6). Withdrawing does not affect anything we did before you withdrew.

• To understand your request and prepare a shortlist of suitable advisors.
• To contact you by phone, WhatsApp or email about your request.
• To introduce you to the advisors you approve, and to follow up on whether the introduction worked.
• To process a paid consultation you book.
• To measure which pages and campaigns lead to enquiries, if you accept analytics and advertising cookies.
• To meet legal, tax and accounting obligations and to protect the site against fraud and spam.

3. Who we share it with

We share your details only with the advisors you approve. We tell you which advisors we suggest, and we pass your details to a firm only after you agree to be introduced to it. We do not sell your personal data and we do not share it with advisors for their own marketing.

We also use a small number of service providers who process data on our behalf and under our instructions:

• Website hosting and database: Vercel and Supabase.
• Email delivery: Resend.
• Payments: Stripe (paid consultations only).
• Analytics and advertising measurement: Google Analytics 4 and Google Ads, only if you accept those cookies.
• Messaging: WhatsApp (Meta), when you choose to contact us on WhatsApp.

4. Transfers outside the UAE and Saudi Arabia

Some of the service providers above store or process data on servers outside the UAE and Saudi Arabia. We use them only where the transfer is allowed under the UAE PDPL and the KSA PDPL, and under contracts that require them to protect your data. If you are introduced to an advisor in the other country (for example a UAE company appointing a Saudi auditor), your details are transferred to that advisor with your approval.

5. How long we keep it

We keep lead data only for as long as we need it to handle your request, follow up on the introduction and meet our legal obligations. After that we delete it or anonymise it so it no longer identifies you. Payment records are kept for the period required by tax and accounting law.

6. Your rights and how to use them

Under the UAE PDPL and the KSA PDPL you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is wrong or incomplete;
• delete your data, unless we must keep it by law;
• stop or restrict a particular use, including direct marketing;
• give you your data in a commonly used electronic format where the law provides for it;
• withdraw your consent at any time.

7. Cookies and analytics

We use a few essential cookies that the site needs to work, such as your language and country preference and your cookie choice. These are always on.

Google Analytics 4 (to understand how the site is used) and Google Ads (to measure which ads lead to enquiries) load only after you click Accept in the cookie notice. If you click Decline, neither tag loads. You can change your choice at any time with the Cookie settings link in the footer.

8. Security

Data is sent over encrypted connections (HTTPS) and stored with access limited to the ISZ team members who need it. No system is completely secure. If a breach affects your data, we will notify you and the relevant authority where the law requires it.

9. Changes to this policy

We will update this page if our practices change and show the date of the latest version at the top. If a change affects how we use data you have already given us, we will ask for your consent again where the law requires it.