Privacy notice
How Xentral Tax handles the data you give it. Written under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). Legal review pending before public launch.
What we process and why
Account data (name, e-mail, workspace) to sign you in and run your workspace. Business and tax data (entities, registrations, documents, invoices, bank lines, figures) to prepare draft returns and pass them to a registered tax agent for review. Payment data is handled by the payment provider; we store the amount, a reference and the outcome, never card details.
Legal basis
Performance of the contract with you; your explicit consent for the processing of tax documents, which you can withdraw; legal obligations to keep tax records for the statutory retention period.
Who sees it
People you invite to your workspace, within the role you give them. The tax agent assigned to a return. Nobody else. Technical administrators cannot open documents or returns. No data is sent to an external AI or cloud provider without a documented transfer assessment approved by the compliance administrator; none is approved at the moment.
Where and how long
On servers in the UAE region we operate, encrypted at rest with a key per workspace. Tax records are kept for the retention period set by law (5 years for VAT, 15 years for real estate, 7 years for corporate tax) and cannot be deleted while a legal hold applies. Everything else is deleted on request.
Your rights
Access, correction, deletion, withdrawal of consent, and complaint. Use the request form under Settings, Your data, or write to hello@xentral.ae.
Free zone companies
If your business is in DIFC or ADGM, their own data protection laws apply in addition. Tell us and we apply the stricter rule.