Privacy Policy

NKO Legal FZE is the controller responsible for this Privacy Policy where it determines the purposes and means of processing personal data. For some platform features, including customer-managed HR ERP records and customer-uploaded company data, NKO Legal FZE may act as a processor or service provider acting on the customer's instructions.

Controller / platform operator: NKO Legal FZE. Registered address: Sharjah Publishing City, Sharjah, United Arab Emirates. Email: setup@nkocorporateplus.com. Telephone: +97145138912.

Please use the email address above for privacy requests and include “Privacy Request” in the subject line so that the request can be routed appropriately.

This Privacy Policy applies to our websites, software platform, subscription services, template library, corporate services, HR ERP features, customer support channels, billing processes, events, training or onboarding sessions, communications, and related services.

It covers personal data relating to platform users, customer administrators, employees and contractors whose information is uploaded to the HR ERP module, shareholders, directors, officers, authorised signatories, ultimate beneficial owners, visa applicants, corporate service applicants, suppliers, prospects, website visitors and other individuals who interact with us.

This Privacy Policy should be read together with our platform terms, subscription terms, data processing terms, template licence terms, corporate services terms, AML/KYC terms and any additional notices presented at the point of collection.

For account registration, billing, customer communications, marketing, platform security, legal compliance, AML/KYC checks, corporate service administration, and our own business operations, NKO Legal FZE generally acts as controller.

For customer-entered HR ERP data, employee records, leave requests, salary certificate requests, employment documents, company data and internal customer workflow content, the customer is generally the controller and NKO Legal FZE processes that data as a processor or service provider to provide the platform and support services.

Where a customer uploads or submits personal data about another person, the customer is responsible for providing any required privacy notice, obtaining any required consent, identifying a valid lawful basis, respecting labour and employment rules, and ensuring that the data is accurate, lawful and appropriate for the intended purpose.

Account and identity data: name, job title, company name, business contact details, username, account role, user ID, password credentials or authentication identifiers, and communication preferences.

Corporate services data: passport and identification information, visa and immigration information, corporate ownership details, director and shareholder information, ultimate beneficial ownership information, source of funds or source of wealth information, contact information, documents, approvals, authority forms, government portal information and status updates.

HR ERP and employee data: employee profiles, job information, leave requests, attendance records, salary certificate requests, HR support tickets, attachments, documents, communications, approval logs, workflow records and related employment information submitted by the customer or its authorised users.

Billing and transaction data: subscription plan, invoices, payment status, transaction identifiers, billing contact details and limited payment information. Full payment card data is usually processed by payment processors and is not intended to be stored by us.

Technical and usage data: IP address, device information, browser type, operating system, login events, access logs, pages or features used, timestamps, cookies, diagnostics, error logs and security monitoring data.

Support and communications data: emails, phone call notes, chat or support ticket records, feedback, survey responses, requests and complaint information.

Marketing and website data: enquiry forms, preferences, event registrations, website analytics, cookie identifiers and marketing interaction records.

We collect personal data directly from individuals when they create an account, submit a form, request a service, contact us, subscribe, download documents, raise support tickets or use platform features.

We collect personal data from customers and their authorised users when they upload corporate records, employee records, HR requests, visa documents, KYC documents or other content into the platform.

We may receive personal data from government authorities, free zones, immigration authorities, corporate registries, payment providers, identity verification providers, professional advisers, service providers, partners and publicly available or legally accessible sources where relevant to the services requested or our compliance obligations.

We also collect some technical information automatically through cookies, logs, device identifiers and similar technologies.

We process personal data to provide and administer accounts, subscriptions, corporate services, HR ERP services, template downloads, support services, reminders, notifications, compliance checks and related platform functionality.

We process personal data to verify identity, perform KYC, KYB, beneficial ownership, sanctions, politically exposed person and adverse media checks, comply with AML/CFT obligations, prevent fraud, manage risk and protect our legal interests.

We process personal data to communicate with users, provide customer support, respond to requests, issue invoices, process payments, maintain records, enforce our terms, secure the platform, investigate misuse, comply with laws and improve our services.

Where GDPR applies, we rely on one or more lawful bases, including performance of a contract, legal obligation, legitimate interests, consent, and, where applicable, establishment or defence of legal claims. For HR ERP data submitted by customers, the customer is responsible for identifying and documenting its lawful basis for processing employee or worker data.

Our platform may allow customers to manage employee data, HR support tickets, leave requests, salary certificate requests, HR logs, employment documents and related workflows. These features are intended to support customer HR administration and do not replace the customer's own employment, labour, payroll, immigration or HR compliance obligations.

Customers decide what employee data to upload, who may access it, how long it should be retained, whether it should be corrected or deleted, and how employee requests should be handled. NKO Legal FZE may process this information to host, operate, secure, troubleshoot and support the HR ERP service.

Customers must ensure that employees and other workers receive appropriate privacy notices, that sensitive or special-category data is only uploaded where lawful and necessary, and that access permissions are properly managed.

Where customers request company setup, licence support, renewal support, immigration, visa, permit, government portal or related corporate services, we may process personal data and documents needed to prepare, submit, monitor or support those requests.

We may share relevant personal data with government authorities, free zones, regulators, immigration bodies, medical testing centres, Emirates ID or identity authorities, notaries, translation providers, attestation providers, banks, insurers, professional advisers and other service providers where required or useful for the requested service.

We may collect and retain AML/KYC, sanctions and beneficial ownership information to satisfy legal, regulatory, risk-management and internal policy requirements. We may decline, suspend or terminate services where information is incomplete, inconsistent, high-risk or not provided.

We may share personal data with customer account administrators and authorised users; platform hosting, IT, security, analytics, email, support, CRM, payment, identity verification and document-processing providers; professional advisers; auditors; insurers; banks; government authorities; free zones; immigration or labour authorities; regulators; courts; dispute resolution bodies; and parties involved in corporate transactions such as restructuring, sale, merger or financing.

We do not sell personal data. We do not allow third parties to use personal data for their own marketing unless the individual has consented or the law otherwise permits it.

Where we use service providers or subprocessors, we seek to use contractual, technical and organisational controls appropriate to the nature of the processing.

We may use third-party service providers to host the platform, process payments, send transactional emails, provide customer support tools, run analytics, secure the platform, verify identity, process documents, provide cloud storage, support corporate service workflows and maintain business operations.

The categories of service providers may include cloud infrastructure providers, payment processors, email providers, analytics providers, helpdesk providers, security and monitoring providers, identity verification providers, professional advisers, government service intermediaries, document-management providers and communication platforms.

A current list of material subprocessors or service-provider categories may be requested by contacting us using the contact details in this Privacy Policy, subject to confidentiality, security and operational limitations.

Personal data may be processed in the United Arab Emirates and in other countries where our service providers, technology infrastructure, advisers, customers, government workflows or corporate-service partners are located.

Where GDPR or similar transfer rules apply, we take steps designed to support lawful international transfers, which may include adequacy decisions, standard contractual clauses, transfer risk assessments, contractual safeguards, technical safeguards, consent where appropriate, or other lawful transfer mechanisms.

Customers are responsible for ensuring that any personal data they upload or submit from other jurisdictions may lawfully be transferred to and processed through the platform.

We retain personal data for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide services, maintain accounts, comply with legal and regulatory requirements, resolve disputes, enforce agreements, support audits, maintain security and preserve evidence.

Account and subscription data is generally retained while the account is active and for a reasonable period afterwards. Corporate service, immigration, AML/KYC, billing, tax, accounting and legal records may be retained for longer where required or advisable under applicable law, limitation periods, regulatory expectations or internal controls.

Customer-controlled HR ERP and uploaded company data is retained according to the customer's settings, instructions, subscription status, applicable terms and legal-retention requirements. Backup copies may remain for a limited period before being overwritten or securely deleted.

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These may include access controls, authentication controls, encryption in transit where available, role-based permissions, logging, monitoring, backups, vulnerability management, confidentiality obligations and staff access restrictions.

No website, platform, transmission method or storage system is completely secure. Customers and users are responsible for maintaining secure passwords, using appropriate access controls, limiting administrator access, ensuring devices are secure and promptly notifying us of suspected compromise.

We may suspend access, restrict features or require credential resets where we believe this is necessary to protect the platform, customer data, users or NKO Legal FZE.

We may use cookies, pixels, SDKs, local storage, log files and similar technologies to operate the website and platform, keep users signed in, secure sessions, remember preferences, analyse usage, improve services and measure marketing effectiveness.

Some cookies are necessary for the website or platform to function. Other cookies, such as analytics or marketing cookies, may be subject to consent requirements depending on the user's location and the technology used.

Users can manage cookies through browser settings and, where available, through our cookie banner or preference tools. Disabling certain cookies may affect platform functionality.

We may send service, security, account, billing and administrative communications where necessary to operate the platform or provide services. These communications are not always optional.

We may send marketing communications where permitted by law or where the user has consented. Users may opt out of marketing emails by using the unsubscribe link or contacting us. Opting out of marketing does not stop essential service communications.

Depending on applicable law, individuals may have rights to request access, correction, deletion, restriction, objection, portability, withdrawal of consent and information about how their personal data is processed. Individuals may also have the right to complain to a competent data protection authority.

Where NKO Legal FZE is the controller, requests should be sent to setup@nkocorporateplus.com. We may need to verify identity and may refuse or limit requests where permitted by law, including where data must be retained for legal, regulatory, AML/KYC, corporate service, security, dispute, tax or accounting reasons.

Where the personal data is controlled by a customer, such as employee data uploaded into the HR ERP module, we may direct the individual to the relevant customer or handle the request in accordance with the customer's instructions.

Where GDPR applies, individuals may have rights to access, rectify, erase, restrict, object, port data, withdraw consent and complain to a supervisory authority. Where UAE data protection laws apply, individuals may have rights and protections relating to transparent processing, lawful processing, security, correction, deletion, restriction or other rights as applicable under UAE personal data protection requirements and implementing regulations.

Some rights are not absolute. They may depend on the legal basis for processing, the nature of the data, our role as controller or processor, the rights of others, retention obligations, AML/KYC obligations, government service requirements and legal-defence requirements.

If we become aware of a personal data incident affecting personal data for which we are responsible, we will assess the incident and take steps required by applicable law. Where required, we will notify affected customers, individuals or authorities within applicable legal timeframes.

Customers must promptly notify us if they become aware of unauthorised access, compromised credentials, incorrect permissions, accidental disclosure, employee misuse, suspicious activity or any other incident that may affect data processed through the platform.

Our platform and services are intended for businesses and adult users. They are not directed to children. Customers must not upload children's personal data unless it is lawful, necessary for the requested service, supported by appropriate notices or consents, and permitted by our terms and applicable law.

If we become aware that personal data of a child has been submitted without appropriate authority, we may delete, restrict or return the data and may require further information from the customer.

We may use analytics, automation and software tools to operate, secure and improve the platform, route support requests, flag unusual activity, support compliance workflows, generate reminders, and provide administrative functionality.

We do not intend to make decisions producing legal or similarly significant effects solely by automated means without human involvement, unless disclosed separately or permitted by applicable law. Customers remain responsible for reviewing outputs, reminders, compliance checks and HR workflow results before acting on them.

Our websites and platform may link to third-party websites, portals, payment pages, government platforms, free zone portals, service providers or integrations. Their privacy practices are governed by their own notices and policies.

We are not responsible for third-party websites, portals or services that are not operated by NKO Legal FZE. Users should review third-party privacy policies before submitting personal data to them.

We may update this Privacy Policy from time to time to reflect changes in our platform, services, legal requirements, technology, corporate services, HR ERP features, subprocessors or business operations.

The updated version will be posted on our website or platform with an updated effective date. Where required by law or where changes are material, we may provide additional notice through the platform, email or other appropriate channels.

For privacy questions, data subject requests, complaints or concerns, please contact: NKO Legal FZE, Sharjah Publishing City, Sharjah, United Arab Emirates. Email: setup@nkocorporateplus.com. Telephone: +97145138912.

Please include enough information for us to identify the relevant account, service, request and individual. We may ask for additional information to verify identity, authority or account ownership before responding.