Data Processing Agreement

1. Purpose and Scope

When Nexivol files tax returns, registers companies, or handles financial data on behalf of clients, we act as a Data Processor processing data on the client's instructions. This Data Processing Agreement (DPA) describes our obligations as a processor and is incorporated into our Terms of Service.

2. Data We Process on Your Behalf

• Personal identification data: full name, CNIC/NICOP/passport numbers, date of birth, address
• Financial data: income details, bank account information, asset values, investment holdings
• Tax identification data: NTN, TRN (UAE), SSN/ITIN (US), UTR (UK)
• Business data: trade license details, company registration numbers, financial statements
• Documents: salary certificates, bank statements, property documents, employment letters

3. How We Process Your Data

We process your data:

• Only for the specific purpose of delivering the services you have engaged us for
• Only on your documented instructions (the engagement agreement and your subsequent directions)
• With access restricted to Nexivol personnel directly involved in your engagement
• With appropriate security measures including encrypted storage and access controls
• Without transfer to any third party except the relevant regulatory authority (FBR, FTA, SECP, IRS, HMRC) as required to complete your filing

4. Sub-processors

We currently do not use sub-processors who have access to client personal data. All work is performed by Nexivol personnel directly. If this changes, we will notify affected clients before engaging any sub-processor.

5. Security Measures

• All client documents are stored in access-controlled environments
• Personnel with access to client data are bound by confidentiality obligations
• Regulatory portal credentials (IRIS, EmaraTax, IRS) are stored securely and never shared
• Client portal passwords and access tokens are handled using secure credential management practices

6. Data Breach Notification

In the event of a personal data breach affecting your data, we will notify you within 72 hours of becoming aware of the breach, including the nature of the breach, categories of data affected, likely consequences, and measures taken or proposed.

7. Return or Deletion of Data

Upon termination of an engagement, we will — at your choice — return all client personal data in our possession or certify its deletion, within 30 days of your written request, subject to any retention obligations imposed by applicable tax or corporate law.

8. Audit Rights

You have the right to audit our data processing practices with reasonable written notice. We will provide documentation of our security measures and processing activities upon request.

9. Applicable Standards

This DPA is designed to meet the requirements of Pakistan's data protection principles, UAE PDPL (Federal Decree-Law No. 45 of 2021), and UK GDPR Article 28 (processor obligations). Where you are subject to EU GDPR, the same obligations apply under Article 28.

Contact Us

Questions about this document:

Email: info@nexivol.com
WhatsApp: +92 333 104 4500
Registered Office: Blue Area, Islamabad, Pakistan
Operating Address: Dubai, United Arab Emirates