Privacy Policy

1. Who We Are and What This Policy Covers

Incepto Corporate Services FZCO (“Incepto”, “we”, “us” or “our”) is a Dubai-based corporate services provider offering company formation, accounting, tax-related services, regulatory compliance assistance, residency and immigration coordination, PRO services, and corporate banking application support.

We respect the privacy of the individuals whose information we handle. This Privacy Policy explains what personal data we collect, why we use it, with whom we may share it, how we protect and retain it, and how individuals can exercise applicable privacy rights.

This Policy covers our website https://incepto.ae/, contact and consultation forms, quotations and onboarding, email and telephone communications, business messaging channels, events, recruitment enquiries, and our provision of services, including through government and third-party platforms where relevant. It also covers advertising-related enquiries and, if activated, our use of online analytics, Google Ads, Meta advertising services and related measurement technologies.

Incepto generally decides how and why personal data is processed in connection with its own enquiries, client onboarding, compliance obligations and business operations. In particular engagements we may process information on behalf of a client under that client’s instructions. In those circumstances, the applicable agreement and respective legal responsibilities also govern the processing.

This Policy does not replace a separate engagement letter, service agreement, cookie notice, employee notice or other specific disclosure that may apply to particular activities.

2. Personal Data We May Collect

We collect information relevant to the nature of your enquiry, your relationship with us and the services requested. This may include:

Contact and identification information

Name, nationality where relevant, business contact details, telephone number, email address, address, job title, date of birth, passport details, Emirates ID, visa or residency information, photographs and identity-verification documents, when required for a specific service.

Corporate and ownership information

Company names, licence numbers, registered addresses, business activities, shareholdings, beneficial-owner and management details, authorised signatory information, constitutional documents, commercial registrations and supporting evidence.

Accounting, tax and financial information

Invoices, financial statements, tax registration identifiers, records submitted for VAT or Corporate Tax work, payroll-related documents where relevant, transaction information, source-of-funds or source-of-wealth documentation and bank-account details reasonably needed for the agreed service.

Regulatory and due-diligence information

Information required for applicable anti-money laundering, counter-terrorist financing, sanctions screening, know-your-customer (KYC), customer due diligence, ultimate beneficial ownership (UBO) and other legal obligations. This may include screening results, relevant declarations and information about politically exposed persons where required.

Immigration and dependent information

Documents concerning applicants, employees and eligible dependants, which may include personal information about minors where needed for a lawful family residency or immigration application.

Communications and applications

Consultation requests, correspondence, enquiries submitted through forms or messaging platforms, contracts, consent and preference records, feedback, service history and any documents you choose or are required to provide.

Website, device and advertising information

IP address, approximate location derived from technical information, browser and device characteristics, pages visited, referral sources, dates and times of visits, cookie identifiers and similar usage data, to the extent collected by our website or enabled tools. If advertising measurement or audience tools are activated, information may also include campaign identifiers, advertising click identifiers, form submissions, conversion events and interactions with our advertising or landing pages, subject to applicable choices and law.

Enquiries made through advertising platforms

If you submit a lead form on Google, Facebook, Instagram or another third-party platform, we may receive the contact details and responses you choose to submit through that platform. The platform’s own privacy policy and your settings there also apply.

Recruitment information

CVs, employment history, qualifications, professional licences, contact information and other information voluntarily submitted in response to a vacancy or employment enquiry.
We do not ask for more information than is reasonably needed for the identified purpose. Where identification or financial information is particularly sensitive, we seek to limit collection, access and use appropriately.

3. Where Personal Data Comes From

We may obtain information directly from you; from a company, client, employer or representative who has authority to provide it; from advisers or service providers involved in your matter; from publicly accessible official registers; from competent government authorities; and from our website or communication systems.

If you provide personal data about another person, such as a shareholder, employee, beneficial owner, applicant or family member, you should ensure you are authorised to do so and that the person receives the information or notices required by applicable law. We may request further confirmation of your authority or contact the individual where appropriate.

4. Why We Use Personal Data

Subject to the requirements of applicable law, we process personal data to:

  • respond to enquiries, schedule consultations and provide information requested by you;
  • evaluate service needs, confirm eligibility, prepare quotations and take steps towards a contract;
  • establish and manage client relationships and perform agreed corporate services;
  • prepare and coordinate company registration, licence, visa, tax, accounting, compliance, PRO and banking-support documentation;
  • submit information to competent authorities and third parties as authorised or legally required;
  • verify identities, assess risks, conduct lawful screening and comply with AML, UBO, tax, recordkeeping and related requirements;
  • issue invoices, administer payments, maintain financial records and resolve billing matters;
  • communicate material service updates, requested information and contractual notices;
  • operate, maintain, troubleshoot and secure our website, systems and business communications;
  • assess website usage and improve content or services where legally permitted;
  • if implemented, evaluate advertising campaign effectiveness, attribute enquiries to campaigns, manage advertising audiences and display relevant promotions through providers such as Google and Meta, only where lawful and subject to the applicable tracking, consent and opt-out requirements;
  • manage recruitment and business administration;
  • establish, exercise or defend legal claims and respond to lawful requests or proceedings; and
  • send promotional information where there is an appropriate legal basis and any required marketing consent or permission.

We will not use personal data for an incompatible new purpose without a valid legal basis and any additional notice or consent required by law.

5. Lawful Grounds and Consent

The lawful justification for processing depends on the data, purpose and applicable jurisdiction. Under relevant laws, processing may be permitted because you have given valid consent; because it is necessary to take steps you request before a contract or to perform a contract; because we must comply with legal obligations; or because another specific statutory exception or lawful ground applies.

Where the EU GDPR or UK GDPR applies, additional grounds, including legitimate interests where appropriate and properly assessed, may be relevant. We do not assume that a legal basis recognised in one jurisdiction automatically applies under UAE law.

When we rely on consent, we aim to obtain it clearly and separately where required. You can withdraw consent for future consent-based processing by contacting us. Withdrawal does not invalidate earlier lawful processing or prevent information from being retained or used where a separate legal obligation applies.

Providing information necessary for an application, identity check or legally required record may be a condition of receiving the corresponding service. If you do not provide that information, we may be unable to proceed or may need to limit or decline the engagement.

6. Regulatory, KYC and Confidential Information

As a corporate services provider offering regulated or compliance-related work, Incepto may need to verify clients, identify beneficial owners, assess risk, review supporting documentation, retain records and make legally required disclosures. Such processing may continue after an engagement ends to meet statutory retention and compliance responsibilities.

Where applicable, suspicious activity or other legally required reports may be made to competent authorities. Certain disclosures may be confidential or subject to restrictions on informing the person concerned. Nothing in this Policy requires us to disclose information when doing so would contravene a legal prohibition or undermine a lawful investigation.

Incepto’s support with government or bank applications does not mean that Incepto itself determines regulatory, immigration, tax-registration or banking decisions. Those decisions remain with the relevant competent authority or institution.

7. Sharing Information with Others

We do not sell personal data to data brokers or exchange clients’ identification, financial or regulatory records for payment. However, if online advertising tools are enabled, our sharing of website identifiers or advertising events with platform providers may be treated as a “sale” or “sharing” under certain privacy laws, even where no money changes hands. We will provide any required disclosures and opt-out rights in jurisdictions where those rules apply.

We may disclose personal data where necessary and lawful for the stated purposes to:

  • UAE authorities and their authorised systems, including company registries, licensing and free zone authorities, the Federal Tax Authority, immigration and identity authorities, and other competent bodies as relevant to the service;
  • banks, insurers, registries, notarisation, translation and attestation providers where needed for an authorised application;
  • engaged accountants, tax professionals, legal advisers, auditors, consultants and other professional service providers supporting our engagements, including appropriately authorised outsourced professionals;
  • website hosting, cloud storage, email, communications, CRM, IT security, analytics, document management and payment service providers, to the extent actually engaged;
  • advertising and measurement providers, including Google (for example, Google Ads, Google Analytics and related conversion tools) and Meta (for example, Facebook/Instagram advertising, Meta Pixel and Conversions API), if and when those services are enabled and subject to the rules described below;
  • an authorised marketing agency or technology provider operating campaigns or website tools for us under appropriate access and data-handling arrangements, where engaged;
  • our employees and authorised personnel who require the information for their work;
  • law enforcement agencies, regulators, courts or other parties where disclosure is required or permitted by law;
  • a prospective buyer, successor or professional adviser in a genuine business reorganisation, subject to appropriate confidentiality and legal safeguards; and
  • other recipients at your direction or with valid authorisation.

We seek to use appropriate contractual, confidentiality and security safeguards with service providers where required. Some recipients, such as banks and public authorities, determine their own purposes and means of processing and may issue separate privacy notices.

We do not represent that third-party banks, government portals, social networks or messaging services are controlled by Incepto.

8. International Transfers and Overseas Service Providers

Because our clients and suppliers may be located outside the UAE, and some business technology providers operate internationally, personal data may be accessed, transferred or stored outside the country where it was collected.

When a cross-border transfer is subject to legal restrictions, we will identify a permitted transfer mechanism and implement safeguards required by the applicable law. These may include approved contractual protections, legally recognised adequacy arrangements, necessity for an authorised transaction, or specific consent where valid and appropriate.

For processing governed by EU or UK data protection law, we will assess the relevant international-transfer framework and additional protections where required. Countries receiving data may offer different levels of legal protection from the country of origin.

You may contact us to request information about relevant categories of recipients and transfer safeguards, subject to lawful confidentiality and security limits.

9. Cookies, Analytics, Google Ads and Meta Advertising

Our website may use cookies, tags, pixels, local storage and similar technologies for site operation, security, visitor preferences, analytics and, if enabled, advertising and campaign measurement. Some technologies process online identifiers or information about how visitors interact with our website.

Essential technologies are used to operate and protect the website, process requests and maintain necessary functionality. Preference technologies remember settings. Analytics technologies help us understand website usage. Advertising technologies may record visits, page views, advertisement interactions, enquiries and other conversion events; measure advertising effectiveness; limit repetitive advertisements; or help display promotions to potentially interested audiences.

Google services (when enabled)

We intend to use Google Ads and may use Google Analytics, Google Tag Manager, Google conversion tracking, remarketing or enhanced-conversion functions. Depending on the tools configured and the choices you make, Google may receive information such as device or cookie identifiers, IP address, browsing or conversion events, advertisement click identifiers and, where separately enabled and legally permitted, securely transformed contact information for conversion matching. Secure transformation or hashing does not necessarily make personal data anonymous.

Meta services (when enabled)

We intend to advertise through Meta platforms, including Facebook and Instagram. If we activate Meta Pixel, Meta Conversions API or related business tools, Meta may receive website events, device or browser identifiers, advertisement engagement data and, where separately configured and lawfully collected, information used to match an enquiry or conversion to an advertising account. We may also receive the information you voluntarily provide using Meta lead advertisements or business messaging tools.

We may use consented or otherwise lawfully obtained contact details for audience matching or campaign measurement only where the relevant platform terms and applicable law permit it. We do not intentionally provide passport copies, Emirates IDs, detailed tax filings, bank statements, AML screening files, dependent records or other sensitive client-service documents to advertising platforms for targeting. We will not use advertising audiences in a manner that unlawfully exploits sensitive information.

Your cookie and advertising choices

Where consent is required, non-essential advertising or analytics technologies will not be activated for the relevant visitor until valid consent is obtained. We intend to provide cookie controls that enable visitors to accept, reject or adjust non-essential categories, and to change their choices later. If certain technologies are not deployed, the corresponding disclosures do not mean that those technologies are already operating.

Where applicable, our implementation of Google technologies will communicate legally required consent choices through appropriate technical signals (such as Google Consent Mode) and our Meta implementation will respect applicable consent choices. Website consent does not by itself replace any separate consent required for promotional messages or the uploading of customer lists.

For information about the platforms’ independent processing, please see Google’s Privacy Policy and Meta’s Privacy Policy. You may also use the advertising-preference controls provided by those services. The actual cookie names, providers, purposes and lifetimes should be kept available through the website’s cookie settings or a supplementary cookie list once the tools are deployed.

If your browser blocks cookies, parts of the website may operate differently. Where the relevant law grants a right to opt out of targeted advertising or the sale/sharing of personal information, you may exercise that right through the controls made available for your location or by contacting us at info@incepto.ae. We will also address legally recognised browser privacy signals where applicable.

10. Marketing, Advertising Enquiries and Communication Choices

When you ask us for information or submit a consultation request, we use your details to respond, discuss the services you requested and manage necessary follow-up communications. Such responses are distinct from optional newsletters and promotional campaigns.

Google and Meta lead forms: if you complete an enquiry form displayed within a Google, Facebook or Instagram advertisement, we may receive and use the submitted details to respond to your request, arrange a consultation and provide relevant service information. The advertising platform may also process the data under its own notice. An enquiry does not automatically mean that you have agreed to unrelated direct marketing.

Promotional communications: we may send service announcements, articles, offers or marketing messages by email, telephone, WhatsApp or other channels only where the applicable rules permit them and where any necessary consent or other permission has been obtained. We maintain marketing preference and opt-out records as appropriate. You may unsubscribe through the method in a message or contact info@incepto.ae to withdraw marketing permission or object to direct marketing.

Targeted advertising and measurement: if advertising tools are activated, we may measure conversions or build remarketing audiences using permitted data and appropriate consent or opt-out mechanisms. You can control some advertising preferences within Google, Facebook and Instagram, as well as through our website choices. We will not use client onboarding, KYC, AML or tax records to create promotional audiences without a specific lawful basis and any required notice and permission.

UAE telemarketing: where applicable, outbound sales calls will follow relevant UAE controls on approvals, calling hours, caller identification, do-not-call preferences, repeat calls and call recording notices. Where a call is recorded, we will give the notice required by law.

Opting out of promotions does not prevent essential service, contractual, transactional or legally required communications.

11. Third-Party Websites and Communication Channels

Our website may contain links or integrations involving WhatsApp, social networks, map services, booking tools, banks, government portals and other independently operated websites. When you choose to use such services, their own terms and privacy practices may apply.

Information shared by email, public social media or messaging applications may also be processed by the relevant communications provider. Please avoid sending passports, bank details or other sensitive documents through unsecured or public channels unless a suitable transmission method has been agreed.

We are not responsible for independent third parties’ decisions or practices, but this does not remove any legal responsibility Incepto has for its own selection, use or disclosure of personal data.

12. Information Security

We use administrative, organisational and technical safeguards appropriate to the information and processing risks, which may include restricted access, confidentiality obligations, appropriate authentication, access reviews, secure data transmission and storage controls, backups, incident response and provider oversight.

Security procedures are reviewed and adapted in line with operational needs and applicable obligations. No website, email system or data transmission can be guaranteed absolutely secure. We do not promise any particular encryption algorithm, security certification or payment technology unless it is actually implemented and verified.

If you believe information shared with Incepto has been exposed or misused, please contact us promptly at info@incepto.ae so we can assess the concern.

13. Data Incidents and Breach Notifications

If we become aware of a suspected personal-data incident, we will assess its nature, scope and potential impact, take appropriate containment and remediation steps, and make notifications to individuals or competent authorities when and within the timeframes required by the laws applicable to the incident.

Notification obligations differ across jurisdictions and may depend on the risk involved. This Policy does not replace our internal incident-management procedures or create an unsupported fixed notification deadline.

14. How Long We Retain Information

We retain personal data only as long as reasonably necessary for the relevant purpose, subject to statutory recordkeeping, contractual obligations, dispute resolution and legitimate preservation requirements under applicable law. Different categories have different retention periods.

For example, UAE Corporate Tax records generally must be preserved for at least seven years after the relevant tax period. Where the UAE AML recordkeeping framework applies to our activities, certain transaction and customer due-diligence records generally must be retained for at least five years from the legally specified event; investigations or other proceedings may require longer retention. VAT, employment, immigration, accounting and other records may be governed by different periods or exceptions.

Ordinary website enquiries, recruitment applications, cookie-consent logs, advertising conversion information and marketing records are retained according to their purpose and Incepto’s internal retention schedule, and subject to the platform’s own retention settings where it acts independently. Data used for advertising should not be held indefinitely merely because a campaign may resume. We periodically review whether retention remains necessary.

When retention is no longer justified, we take reasonable steps to securely delete, anonymise or otherwise dispose of the relevant information, including by instructing service providers where appropriate. Backup deletion may follow an established technical lifecycle, subject to security and access controls.

15. Your Privacy Rights

Subject to applicable law, identity verification and legal exceptions, you may have rights to:

  • obtain information about how your personal data is used and request access;
  • correct inaccurate information and complete incomplete information;
  • request deletion where continued retention is not justified or legally required;
  • withdraw consent where processing relies on consent;
  • object to certain processing, including direct marketing, or ask for restriction where provided by law;
  • request a portable copy or transfer of personal data where applicable;
  • seek appropriate information about qualifying automated decisions or profiling; and
  • raise a concern or complaint with an appropriate supervisory authority where you are entitled to do so.

Please send requests to info@incepto.ae, with the subject Privacy Request. We may need proportionate information to verify your identity or authority before acting. We will respond within the period required by applicable law and explain where an exception or lawful retention obligation limits a request.

We cannot necessarily delete records that tax, AML, corporate, immigration or other applicable laws require us to keep.

16. Automated Decisions and Profiling

We may use routine software functions to organise enquiries, check information completeness, manage workflows or flag matters for human review. If enabled, advertising platforms may use automated audience segmentation, campaign optimisation or interest predictions to decide which advertisements are displayed. These advertising functions are distinct from decisions on whether Incepto will accept a client or provide a service. We will not rely on solely automated decisions producing legal or similarly significant effects on individuals without complying with the applicable notice, lawful-basis and safeguard requirements.

If our use of automated decision-making materially changes, we will provide any additional information and rights required by applicable law.

17. Children and Dependant Applicants

Our website and professional services are not marketed to children. However, certain legitimate immigration, residency or family-related services may require information about children and other dependants provided by a parent, guardian or suitably authorised person.

We handle such information for the relevant authorised service and legal requirements, with appropriate care and limited access. We do not knowingly use children’s personal data for behavioural advertising or unrelated promotional purposes. Parents and guardians can contact us about the information provided for a dependent, subject to applicable legal rights and restrictions.

18. Recruitment and Employment Enquiries

If you submit a job application, we process your information to evaluate qualifications, communicate about recruitment, verify information where permitted and meet employment-related legal obligations. We may retain candidate data for a reasonable, documented period or longer where you have agreed to consideration for future vacancies or a legal obligation applies.

Where an employee-specific or contractor-specific privacy notice is provided, it may supplement this Policy.

19. International Visitors and Additional Laws

Incepto is established in the UAE. The UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data is a principal data-protection framework relevant to our UAE operations, subject to its statutory scope and exceptions. Additional UAE sectoral rules may apply to financial, immigration, employment, tax and regulated compliance records. The DIFC and ADGM have distinct data-protection regimes where their jurisdictional rules apply.

Certain non-UAE laws, including the EU General Data Protection Regulation (EU GDPR), UK GDPR and other national or state privacy laws, may apply to particular processing based on their territorial and substantive tests. Website accessibility from another country alone does not automatically make every overseas privacy law applicable.

Where such a law applies, we will assess and implement any additional required notices, lawful bases, individual rights, transfer protections, processor arrangements or local representative arrangements. Under certain US state privacy laws, for example, disclosures of identifiers to digital advertising platforms for cross-context behavioural advertising may trigger specific notices and opt-out rights. We will provide those rights where the particular law applies to us. This Policy does not claim blanket certification of compliance with every international privacy regime.

20. Changes to This Privacy Policy

We may update this Policy to reflect legal developments, changes to our services, technology, security practices or data handling. The current version will appear on this website with its revision date. Where required by law, we will provide additional notice or obtain consent before materially changing how personal data is processed.

Continuing to use the website does not replace any consent or other legal requirement that applies to a particular processing activity.