Privacy Policy & Data Charter

This Privacy Policy governs the operations of ADVAQ (operating internationally as ADVAQ Cross-Border Advisory), headquartered in Lahore, Pakistan, with cross-border professional representation spanning the United Kingdom, the United States, the United Arab Emirates, and Pakistan.

All advisory engagements, client data handling, and statutory filings are supervised directly by Muhammad Abdullah Qadeer, Advocate, an Advocate licensed by the Punjab Bar Council, and an authorized IRS PTIN Tax Preparer (Preparer Tax Identification Number). For the purposes of applicable data protection legislation—including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU GDPR (Regulation EU 2016/679), the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), and applicable US State Data Privacy frameworks—ADVAQ serves as the Data Controller for all client personal, corporate, and financial information.

Because ADVAQ operates across international legal borders, our data governance architecture aligns with the most stringent data protection frameworks worldwide:

To deliver cross-border entity incorporation, statutory tax preparation, corporate compliance, and legal drafting, we collect and process the following structured categories of data:

In accordance with international data protection standards (Article 6 UK/EU GDPR and Article 4 UAE PDPL), ADVAQ processes client personal data under four distinct lawful bases:

• 1. Performance of a Contract (Art. 6(1)(b) GDPR):Processing necessary to execute our professional engagement agreement—such as filing incorporation documents with UK Companies House, lodging Form SS-4 / 5472 with the IRS, obtaining a UAE Freezone trade license, or drafting bespoke commercial agreements.
• 2. Compliance with Mandatory Legal Obligations (Art. 6(1)(c) GDPR):Processing required to satisfy statutory government rules, including mandatory AML/CFT verification under UK MLR 2017, FinCEN Corporate Transparency Act reporting, UAE Cabinet Resolution No. 58/2020 UBO submissions, and tax reporting to HMRC, IRS, FTA, and FBR.
• 3. Legitimate Professional Interests (Art. 6(1)(f) GDPR):Processing required to maintain internal statutory audit trails, protect against fraudulent identity manipulation, enforce contract terms, prevent cybersecurity attacks, and maintain proof of legal advisory services rendered.
• 4. Explicit Client Consent (Art. 6(1)(a) GDPR):Where a client explicitly requests third-party introductory facilitation—such as submitting corporate onboarding applications to digital banking providers (e.g. Mercury, Relay, Wise, Wio) or payment gateways (Stripe).

As a cross-border legal and corporate advisory practice, ADVAQ is subject to strict statutory duties under international Anti-Money Laundering (AML), Counter-Terrorist Financing (CFT), and Know Your Customer (KYC) regulatory regimes.

Because ADVAQ orchestrates international corporate setups between the UK, USA, UAE, and Pakistan, client information must necessarily be transmitted across national borders to official government registries and authorized local registered agent partners.

Where personal data originates within the UK or European Economic Area (EEA) and is transferred internationally, ADVAQ ensures adequate safeguards under Chapter V of the GDPR by utilizing:

• Standard Contractual Clauses (SCCs): Incorporating European Commission and UK International Data Transfer Agreements (IDTA) with all technology sub-processors and overseas registered agents.
• End-to-End Encryption in Transit & At Rest: Utilizing TLS 1.3 encryption protocols during all cross-border transmissions and AES-256 encryption on all stored client repositories.
• Direct Sovereign Lodgement: Direct transmission to sovereign government portals (Companies House WebFiling, IRS e-Services/Fax gateways, UAE EmaraTax portal, SECP eServices) without passing through non-essential intermediaries.

ADVAQ only shares client records with the following authorized third parties strictly on a need-to-know basis to fulfill contracted corporate engagements:

In accordance with international tax codes and statutory company law, ADVAQ is legally obligated to retain corporate and financial records for mandatory statutory periods. We do not retain data longer than legally mandated:

Upon the expiration of statutory retention windows and upon client instruction following entity closure, all personal KYC scans and confidential working files undergo secure multi-pass cryptographic deletion.

Regardless of your citizenship or physical jurisdiction, ADVAQ accords all clients the following enterprise data rights:

To exercise any of these statutory rights, submit a formal Data Subject Access Request (DSAR) to contact@advaq.com. We respond to all verified requests within 30 calendar days.

ADVAQ maintains an ethical, privacy-first technical architecture:

We protect client records with defense-in-depth security measures:

• Multi-Factor Authentication (MFA): Enforced across all internal administrative access points, filing consoles, and database partitions.
• Cryptographic Isolation: Confidential legal drafting notes and tax worksheets are encrypted with AES-256 keys.
• 72-Hour Breach Notification: In the unlikely event of a confirmed security incident affecting personal data, ADVAQ will notify impacted clients and regulatory authorities (such as the UK ICO) within 72 hours in compliance with Art. 33 GDPR.
• Continuous Vulnerability Audits: Regular security patching, automated SSL certificate rotations, and DDoS mitigation.

For privacy inquiries, Data Subject Access Requests (DSAR), regulatory audits, or confidential compliance escalations, contact our designated Data Protection Lead directly: