Privacy Policy

1. Who we are

This website, xpertgroupglobal.com, presents two separately operated businesses that share the Xpert Group name:

In this policy, "Xpert Group", "we", "us" and "our" mean whichever of these businesses decides how and why your personal information is used (the "controller"):

• Xpert Group FZE-LLC is the controller for the website itself, for enquiries about the UAE, and for clients it serves.
• Xpert Group Pakistan is the controller for enquiries about Pakistan and for clients it serves.

2. Scope of this policy

This policy applies to personal information we collect through xpertgroupglobal.com, through the contact details shown on it (email, telephone and WhatsApp), and in our general business communications. Our country websites (xpertgroup.me and xpertgroup.pk) and our software products may have their own privacy notices, which apply to those services.

We handle personal information in line with the laws that apply to each business, including the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) for Xpert Group FZE-LLC, and the Prevention of Electronic Crimes Act, 2016 and other applicable laws of Pakistan for Xpert Group Pakistan.

3. Information we collect

Information you give us

• Enquiry details: your name, company name, email address, phone or WhatsApp number, the region and service you select, and the content of your message.
• Communications: emails, WhatsApp messages, call notes and any documents you choose to send us.
• Business contact details when you or your organisation work with us as a client, supplier or partner.

Information collected automatically

• Technical data: IP address, browser and device type, pages viewed, referring site and date and time of visit, recorded in server and security logs.
• Cookie data: see our Cookie Policy. Non-essential cookies, such as analytics, are used only with your consent.

Information from others

We may receive your business contact details from someone who refers you to us, or from public sources such as company registers and professional networking sites, where this is relevant to a business enquiry.

Please do not send sensitive personal information (for example health, religious or biometric data) through the website form. If a service needs such information, we will tell you and handle it under the terms of your engagement.

4. How and why we use it

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

5. Client engagement data

When you become a client, we may process additional information such as financial records, tax registration details, identification documents of owners and authorised signatories, and employee or payroll data you provide for us to work on. This information is used only to deliver the agreed services and meet our legal obligations. Its handling is described in your engagement letter or service agreement, which takes precedence over this policy where the two differ.

Where we act on your instructions in processing personal information about your own staff, customers or suppliers, you remain responsible for having a lawful basis to share that information with us.

6. Who we share it with

We do not sell or rent personal information. We share it only where needed, with:

• The other Xpert Group business, only when your request involves both countries or you ask to be referred.
• Service providers who host our website and email, provide cloud storage, security, communication and analytics tools, and who process data on our instructions under confidentiality obligations.
• Government and regulatory authorities, such as the UAE Federal Tax Authority or the Federal Board of Revenue, Pakistan, when we submit registrations, returns or filings on your behalf, or when the law requires disclosure.
• Professional advisers, such as lawyers, auditors and insurers, under a duty of confidentiality.
• A successor business if all or part of a business is reorganised, merged or sold, subject to this policy.

7. International transfers

Because we operate in the UAE and Pakistan and use cloud-based services, your information may be stored or accessed outside the country where you live, including in the UAE, Pakistan and other countries where our service providers operate. When we transfer personal information across borders, we take the steps required by applicable law, such as relying on contractual safeguards with our providers or your consent.

8. How long we keep it

• Enquiries that do not lead to an engagement: up to 24 months from our last contact, then deleted or anonymised.
• Client and financial records: for the period required by tax, accounting and commercial laws. For example, UAE Corporate Tax law generally requires records to be kept for seven years, and Pakistan's Income Tax Ordinance, 2001 generally requires six years. We may keep them longer where needed for a legal claim.
• Website logs: normally no more than 12 months, unless needed to investigate a security incident.
• Marketing preferences: until you unsubscribe. We keep a record of the opt-out so we do not contact you again.

9. How we protect it

We use measures appropriate to the risk, including encrypted connections (HTTPS), access limited to staff who need it, multi-factor authentication on business accounts, regular backups and reputable hosting providers. No method of transmission or storage is completely secure. If a personal data breach is likely to put your rights at risk, we will notify you and the relevant authority where the law requires it.

10. Your rights

Subject to applicable law, you can ask us to:

• Access the personal information we hold about you and receive a copy.
• Correct information that is inaccurate or incomplete.
• Delete information we no longer need or have no legal basis to keep.
• Restrict or object to certain processing, including direct marketing.
• Receive your information in a structured, commonly used format, or have it sent to another organisation (portability).
• Withdraw consent at any time, without affecting processing that took place before you withdrew it.

To make a request, email the business you dealt with: [email protected] (UAE) or [email protected] (Pakistan). We may need to verify your identity first. We aim to respond within 30 days. Some rights are limited where we must keep information to meet a legal obligation, such as tax record-keeping.

11. Marketing

We send newsletters or offers only if you have agreed to receive them, or where the law otherwise allows us to contact existing business clients about similar services. Every marketing email includes a way to unsubscribe, and you can also reply "STOP" to a WhatsApp message or email us.

12. Cookies

We use cookies and similar technologies that are strictly necessary for the website to work. We use analytics and other optional cookies only with your consent. Details and controls are in our Cookie Policy.

13. Children

Our services are intended for businesses and adults. We do not knowingly collect personal information from anyone under 18 through this website. If you believe a child has sent us personal information, please contact us and we will delete it.

14. Third-party sites and apps

Our website links to WhatsApp, LinkedIn, Facebook, Instagram and other websites. When you use those services, their own privacy policies apply, and they may collect information independently of us. For example, a WhatsApp message is processed by WhatsApp (Meta) as well as by us.

15. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows when it was last revised. Where changes are significant, we will highlight them on the website or let our clients know directly.

16. Contact and complaints

For any question about this policy or your personal information, contact:

• UAE: Xpert Group FZE-LLC, SPC Free Zone, Sharjah, United Arab Emirates. [email protected]
• Pakistan: Xpert Group Pakistan, Shaheen House, Tilu Road, Sadiqabad, Rahim Yar Khan, Punjab, Pakistan. [email protected]

Please contact us first so we can try to resolve your concern. If you are not satisfied, you may have the right to complain to the relevant authority. In the UAE, this is the UAE Data Office.