Privacy Policy

1.1 IAC Technology & Business Solutions L.L.C (“IAC Technology”, “we”, “us”) runs this website and the IAC e-invoicing platform. This policy explains what personal data we collect, why we use it, who we share it with and the choices you have.

1.2 It applies to visitors of our website, people who contact us, and users of our platform. Where we process documents for a customer, that customer’s own privacy notice also applies to the people named in those documents.

1.3 We handle personal data in line with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and other applicable laws.

• Personal data: any information about a living person who can be identified from it, alone or combined with other information.
• Usage data: technical information created automatically when someone uses our website or platform, such as pages viewed and time spent.
• Cookies: small files stored on your device that let a website recognise it.
• Controller: the organisation that decides why and how personal data is used. We are the controller for the data in this policy, except where clause 6 says otherwise.
• Processor: an organisation that handles personal data on a controller’s behalf and on its instructions.
• Data subject: the person the personal data is about.

3.1 Details you give us: your name, job title, company, email address, phone number and the content of messages or forms, for example when you book a readiness call.

3.2 Account details: login names, roles and settings for platform users.

3.3 Business documents: invoices and related documents processed on the platform, which may include names and contact details of people at your company or your customers.

3.4 Usage data: IP address, browser and device type, pages visited, dates and times, and diagnostic logs.

3.5 Location: only an approximate country or city derived from your IP address, unless you choose to share more precise location through your device settings.

4.1 We use personal data to:

• provide, operate and support the platform and your account;
• transmit, validate and report documents as required by the UAE e-invoicing rules;
• answer your enquiries and arrange readiness calls;
• tell you about changes to our services, terms or this policy;
• monitor performance, find and fix technical problems and keep the platform secure;
• understand how our website and platform are used so we can improve them;
• send you news about our services, where you have not opted out. Every marketing email has an unsubscribe link.

5.1 We use personal data only where we have a valid reason, namely:

• because it is needed for our contract with you, or for steps you requested before signing;
• because UAE law requires it, including tax and e-invoicing rules;
• where you have given consent, which you can withdraw at any time;
• for our legitimate business interests, such as securing and improving our services, where those interests are not outweighed by your rights.

6.1 Our platform uses automated rules and machine-learning models to read, check and classify business documents, for example to detect missing fields or suggest how a line should be categorised.

6.2 When we process a customer’s documents, we do so as that customer’s processor. Where personal data in documents is used to train our models, we act as controller for that limited purpose, based on our legitimate interest in improving the service. The personal data is used only during training and then deleted; we keep only the improvement to the model.

6.3 We do not use automated processing to make decisions about you that have legal or similarly significant effects without human involvement.

7.1 We share personal data only as needed with:

• service providers who host, support or help us analyse our services, under contracts that limit their use of the data to our instructions;
• other Peppol service providers, so that documents reach the recipient you chose;
• the Federal Tax Authority and other UAE authorities, where the law requires it;
• courts, regulators or law enforcement, when we are legally required or must protect our rights, our users or the public;
• companies in the IAC group or a buyer of our business, under the same protections as in this policy.

7.2 We do not sell personal data.

8.1 Some of our service providers may store or access data outside the UAE. We transfer personal data abroad only where UAE law allows it, for example to countries with adequate protection or under contractual safeguards, and we make sure it stays protected to the standard described here.

9.1 We keep personal data only as long as we need it for the purposes in this policy. Invoices and tax records are kept for the period required by UAE tax law.

9.2 Usage data is normally kept for a shorter time, unless we need it longer to investigate a security issue or improve the platform.

10.1 We use technical and organisational measures to protect personal data, including encryption in transit, access controls and monitoring. No system connected to the internet can be guaranteed completely secure, but we work to keep the risk low and will notify you and the authorities of a breach where the law requires.

11.1 Subject to UAE law, you can ask us to:

• confirm whether we process your personal data and provide a copy of it;
• correct data that is wrong or incomplete;
• delete your data, unless we must keep it by law;
• limit how we use your data, or stop using it for a particular purpose;
• send your data to you or to another provider in a common, machine-readable format;
• stop processing based on your consent or on our legitimate interests, including direct marketing.

11.2 Email us at info@iac-einvoice.ae. We may ask you to confirm your identity first. You may also complain to the UAE Data Office.

12.1 We use essential cookies to make the website and platform work and keep them secure. With your consent, we also use analytics cookies to understand how visitors use our pages. You can change your choice at any time through your browser settings.

12.2 Our website does not currently respond to browser “Do Not Track” signals.

13.1 If you pay us by card, the payment is handled by a third-party payment provider that meets the PCI DSS card security standard. We do not receive or store your full card number.

14.1 Our pages may link to websites we do not run, such as official government sources. We are not responsible for their content or privacy practices, so please read their own policies.

15.1 Our services are meant for businesses and are not aimed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, contact us and we will delete it.

16.1 We review this policy regularly and may revise it. We will post the new version here with a new “last updated” date and, for material changes, tell platform users by email or in the portal before they take effect.

17.1 For questions about this policy or your personal data, contact IAC Technology & Business Solutions L.L.C at info@iac-einvoice.ae.