ASB Consulting (hereinafter referred to as the “Company” or “ASB”) is committed to respecting the privacy of its clients and protecting the personal data, commercial and financial information, and documents it accesses, receives, or processes in the course of providing its professional, consulting, and administrative services.

The Company provides accounting, bookkeeping, financial reporting, tax consulting, tax return preparation and filing, human resources, employee administration, government relations (PRO) services, company formation, amendments and liquidation, and assistance with procedures through relevant government and electronic platforms in the Kingdom of Bahrain and the Kingdom of Saudi Arabia, as well as other services agreed upon with clients.

Given the nature of these services, the Company's operations may require access to financial and commercial information, official documents, and personal data relating to clients, their employees, representatives, or other relevant parties.

This Policy explains the types of data and information the Company may handle, the purposes for which such data is used, how it is protected, retained and shared, and the rights relating to such data.

This Policy applies to data collected, received, or processed through the Company's website, contact forms, advertising forms, email, communication channels, contracts, client-provided documents, and the platforms and systems used to provide the Company's services.

Depending on the nature of the services provided, the Company may handle the following categories of data and information:

2.1. Personal and Contact Information

• Names, job titles, professional titles, and positions.
• Telephone numbers, email addresses, and business addresses.
• Details of authorized representatives and client contact persons.
• Identification documents, passports, residency permits, work permits, and other official documents where required to carry out the requested procedures.
• Signatures and documents relating to authorizations, powers of attorney, and legal representation.

2.2. Financial and Accounting Information

• Financial statements, trial balances, general ledgers, and accounting entries.
• Sales and purchase invoices, receipts, expenses, and revenue records.
• Bank statements, financial transactions, and bank reconciliations.
• Accounts receivable, accounts payable, balances, and financial adjustments.
• Payroll information, employee benefits, entitlements, and related settlements.
• Records, files, and documents required to prepare financial reports or perform the agreed accounting services.

2.3. Tax and Regulatory Information

• Tax and Zakat returns and their supporting documents.
• Value Added Tax (VAT) information, invoices, and tax records.
• Correspondence, notices, and requests for information issued by tax and regulatory authorities.
• Documents relating to tax examinations, audits, objections, refund claims, and settlements.
• Registration details, licenses, commercial registrations, and investment records, depending on the scope of the services.

2.4. Employee and Human Resources Information

• Employee names, contact details, identification information, and residency details.
• Employment contracts, amendments, termination records, and employee entitlements.
• Salaries, wages, and related payment or transfer information.
• Social insurance records, employment registrations, and work permits.
• Expiry dates of documents, licenses, residency permits, and work permits.
• Leave, attendance, absence, and other information required for the agreed services.
• Documents relating to recruitment, employee transfers, document renewals, termination of employment, and final exit procedures, as applicable.

The Company does not request health information or other sensitive personal data unless it is genuinely necessary to provide a specific service and is handled in accordance with applicable legal requirements.

2.5. Corporate Data and Confidential Commercial Information

• Commercial registrations, business activity licenses, and investment licenses.
• Information concerning owners, shareholders, authorized signatories, and beneficial owners, where required.
• Contracts, agreements, powers of attorney, and business correspondence.
• Information relating to business operations, suppliers, and customers.
• Business plans, budgets, financial forecasts, and operational information.
• Documents relating to company formation, amendments, or liquidation.

The Company treats such information as confidential where its nature, contractual obligations, or applicable laws and regulations require confidentiality, whether or not it contains personal data.

2.6. Government Systems and Platform Information

Based on the authorizations and access rights granted to it, the Company may handle information available through government platforms and electronic systems relevant to the services, including platforms relating to taxation, commerce, investment, labor, social insurance, residency, and human resources.

Such information is used solely to carry out the requested procedures within the scope of the authorization or agreement with the client, subject to the applicable platform terms and relevant legal requirements.

The Company's access to or use of a client's accounts, permissions, or login credentials must not extend beyond the authorized purposes.

The Company may obtain data and information through the following channels:

• Directly from clients or their authorized representatives.
• Through contracts, quotations, service request forms, and professional correspondence.
• Through email, telephone, social media, website forms, LinkedIn Lead Gen Forms, and advertising campaigns.
• Through files, records, and documents uploaded or provided by clients.
• Through accounting systems, business management platforms, and government systems, in accordance with approved permissions and authorizations.
• From government or regulatory authorities or service providers, where obtaining such information is lawful and necessary to perform the services.

Depending on its role in processing the data, the Company obtains and uses information on an appropriate lawful basis and does not request data beyond what is reasonably necessary to provide the service or achieve the specified purpose.

Depending on the requested service, the Company may use data and information for the following professional and operational purposes:

• Providing accounting, financial, consulting, and tax services.
• Preparing financial reports, financial statements, tax returns, and regulatory documents.
• Carrying out human resources, government relations, and administrative procedures.
• Managing company registrations, licenses, amendments, and liquidation procedures.
• Monitoring applications, approvals, renewals, and deadlines.
• Communicating with clients regarding services, requests, missing documents, and related matters.
• Fulfilling contractual, accounting, regulatory, and legal obligations.
• Documenting completed work and managing invoices, receivables, and professional records.
• Protecting systems against unauthorized use and managing security and operational risks.
• Improving service quality and systems and preparing appropriate operational statistics where necessary.

The Company recognizes that the financial and commercial documents, employee data, and official records it handles may be sensitive or confidential. Accordingly, the Company adheres to the following principles:

• Using information only for the purpose for which it was collected or as agreed with the client.
• Restricting access to authorized employees and collaborators whose duties require access to the information.
• Not disclosing client information or using it for personal benefit or the benefit of another party without a lawful justification.
• Not publishing client documents, financial data, or employee information, or using such information in marketing materials or identifiable case studies, except where appropriately and lawfully authorized.
• Handling correspondence, documents, files, and electronic or physical copies according to the level of confidentiality appropriate to their nature.
• Complying with relevant contractual, professional, and legal confidentiality obligations.

The Company's confidentiality obligations continue after the termination of a contract or the cessation of services for as long as the information remains confidential by nature or its protection is required under applicable laws or agreements.

Nothing in this Policy overrides any stricter confidentiality obligation imposed by a separate agreement, service contract, professional requirement, or applicable law.

The Company seeks to implement administrative, technical, and organizational measures appropriate to the nature of the data and the associated risks. Depending on the systems and tools used, these measures may include:

• Restricting access to files and systems according to roles and responsibilities.
• Using appropriate measures to protect accounts, systems, and files against unauthorized access.
• Protecting devices, communication channels, and files used in business operations.
• Managing the sharing and transmission of documents to authorized recipients.
• Reviewing access permissions when responsibilities change or access is no longer required.
• Implementing appropriate procedures for retaining, destroying, or deleting data when it is no longer needed, subject to legal obligations.
• Responding to security incidents, taking appropriate containment measures, and reporting incidents where legally required.

The Company seeks to reduce the risks of loss, alteration, disclosure, or unauthorized access. However, no electronic system or method of data transmission can be guaranteed to be entirely free from all security risks.

The Company does not sell personal data, client lists, or clients' financial and commercial documents to third parties for their independent marketing purposes.

Certain data may need to be shared, strictly to the extent necessary, in the following circumstances:

7.1. Government and Regulatory Authorities

Where submitting an application, return, registration, renewal, or official request, or where required by a legal obligation or a lawful request from a competent authority.

7.2. Technology Service Providers

With hosting providers, email providers, cloud storage providers, accounting and business management system providers, communications providers, and information security providers, where their services are necessary to operate the business or deliver the requested service, subject to appropriate data protection measures and applicable legal requirements.

7.3. Professional Advisers and Service Providers

Where legal advisers, professional consultants, auditors, or competent service providers are engaged, provided that such involvement is necessary and lawful for performing the work, protecting rights, or fulfilling obligations.

7.4. Clients, Their Representatives, and Parties Relevant to the Service

Where procedures require documents or information to be shared with the client, the client's authorized representatives, or other parties with whom the client deals in connection with the service.

7.5. Legal Obligations and Protection of Rights

Where disclosure is required by law or an order issued by a competent authority, or is necessary to establish, exercise, or defend a legal claim, subject to applicable requirements.

The Company seeks to limit data sharing to what is necessary and to consider the recipients' authority, the nature of the data, and the relevant legal requirements.

Clients may provide the Company with data relating to their employees, partners, representatives, or other individuals for the purpose of delivering the agreed services.

In such circumstances:

• The Company uses the data within the scope of the service and the authorization granted.
• Responsibility for determining the purpose of processing and establishing the necessary lawful basis depends on the allocation of responsibilities between the Company and the client, the nature of the relationship, and applicable laws.
• Clients are responsible, to the extent required by applicable law, for ensuring that providing the data to the Company is lawful and that the necessary authorizations and consents have been obtained where required.
• The Company does not use employee or third-party data for purposes unrelated to the service unless an independent lawful basis exists.

Where data processing agreements are entered into, the contracts and agreements will specify each party's responsibilities according to its actual role as a data controller, data processor, or other applicable role under the relevant legal framework.

Certain services may require access to electronic platforms or government systems using permissions or authorizations approved by the client.

The Company undertakes to:

• Use the access permissions granted to it solely to carry out the agreed procedures.
• Avoid conducting transactions outside the scope of the authorization or exceeding the permissions granted.
• Avoid sharing login credentials, verification codes, or authentication methods with unauthorized persons.
• Use platform-approved access methods where available and avoid retaining login credentials unless there is a legitimate operational necessity and an appropriate protection mechanism.
• Terminate access or revoke permissions managed by the Company when they are no longer required, subject to available procedures and the parties' obligations.

The client remains responsible for managing its own access permissions and authorized users and for reporting any unauthorized access or use it discovers, subject to the responsibilities allocated to each party under the relevant contract and applicable law.

The Company retains data and information for as long as necessary to fulfill the purposes for which they were collected, provide services, meet contractual and professional obligations, comply with accounting, tax, and legal recordkeeping requirements, and address potential disputes or claims.

Retention periods may vary depending on the type of document, the nature of the service, the legal requirements of the relevant jurisdiction, and applicable professional or contractual obligations.

When data is no longer required, the Company seeks to delete, destroy, or anonymize it, as appropriate and technically feasible, unless retention is required or permitted by law.

Certain copies may remain in backups or archived records for a limited period in accordance with technical backup cycles and applicable retention procedures, while appropriate measures continue to protect such information.

Subject to applicable law, the rights of other parties, and relevant legal exceptions, individuals may have the right to:

• Understand how their personal data is used and the purposes of processing.
• Request access to their personal data or information about it.
• Request correction of inaccurate data or completion of incomplete data.
• Request deletion of data or restriction of processing where permitted by law.
• Withdraw consent where processing is based on consent, without affecting the lawfulness of processing carried out before the withdrawal.
• Object to certain types of processing or request that processing cease, where such rights are provided by applicable law.
• Submit a complaint to the competent data protection authority in accordance with applicable procedures.

These rights do not mean that every request can be fulfilled in every circumstance. Certain records may not be deleted or restricted where retention is required by law or where the information is necessary to establish legal rights or fulfill existing obligations.

Requests will be reviewed in light of the requester's identity and authority, the scope of the request, and the relevant legal requirements. The Company may request additional reasonable information to verify identity or authorization before taking action.

The Company may use its website, LinkedIn forms, advertising campaigns, email, and social media to promote its services and receive requests for contact, meetings, and quotations.

Information collected through these channels may include names, job titles, company names, email addresses, telephone numbers, business sectors, requested services, and other information voluntarily provided by the individual.

This information is used to respond to inquiries, assess professional needs, and communicate about relevant services.

Individuals may object to marketing communications or request that they stop by using an available unsubscribe mechanism or contacting the Company, subject to any communications necessary to perform an existing contract or fulfill a legal obligation.

The Company's website may use cookies or similar technologies to operate the website, remember user preferences, analyze visits, and measure content or advertising campaign performance, depending on the tools actually enabled.

Some of these technologies may be provided by third-party service providers, and the data collected may vary according to their configurations.

Non-essential cookies are used in accordance with applicable legal requirements concerning consent and disclosure. Users may manage cookie settings through the website's tools, where available, or through their browser settings. Disabling certain cookies may affect some website functions.

The Company's website or correspondence may contain links to government platforms, external services, or websites operated by third parties.

Such websites and services are subject to the privacy policies and terms of use of their respective operators. The Company does not independently control their data handling practices.

Users are encouraged to review the privacy policies of those parties before submitting information to them. Information shared through an external platform may also be subject to that platform's terms and the relevant legal requirements.

If the Company becomes aware of a security incident affecting data for which it is responsible, it will take appropriate steps to investigate and contain the incident, assess its impact, and mitigate potential harm.

The Company will notify the competent authorities and affected data subjects where required by applicable law and within the prescribed timeframes and procedures.

This section does not guarantee that security incidents will never occur. It describes the Company's commitment to taking appropriate protective measures and responding in accordance with its legal and contractual responsibilities.

The Company may update this Policy from time to time to reflect changes in its services, systems, operational requirements, or legal obligations.

The updated version will be published on the Company's website, together with a revised last-updated date. Any additional notification or consent requirements will be observed where required by law.

For inquiries or requests relating to privacy, data protection, or confidentiality, please contact:

Please describe the nature of your request and identify the country relevant to the service. Where necessary, provide the minimum information required to verify your identity or authority. Do not include passwords, verification codes, or unnecessary sensitive documents in your initial inquiry.

The Company will handle requests in accordance with the procedures, timeframes, and obligations prescribed by applicable law.