Data Protection Policy

Effective Date: January 2026

Gaambit Global Audit & Advisory Services LLC (“Gaambit”, “we”, “our”, “us”) is committed to protecting personal and business data in accordance with applicable data protection laws and professional standards in the United Arab Emirates.

This policy outlines how we safeguard information processed in connection with our audit, tax, advisory, technology, and consulting services.

1. Scope

This policy applies to all personal data, business data, and sensitive information processed by Gaambit in the course of delivering services to clients and operating our website.

2. Types of Data Processed

We may process:

• Personal identification data
• Contact information
• Employee and payroll data
• Financial and accounting records
• Tax and compliance documentation
• Business and operational data
• Technical and system information

These data categories arise from our integrated finance, technology, and advisory services.

3. Principles of Data Protection

We process data in accordance with the following principles:

• Lawfulness, fairness, and transparency
• Purpose limitation
• Data minimization
• Accuracy
• Storage limitation
• Integrity and confidentiality

4. Security Measures

We implement appropriate technical and organizational safeguards, including:

• Access control and authentication
• Encryption and secure systems
• Cybersecurity monitoring
• Network and infrastructure protection
• Regular security assessments

These measures align with our cybersecurity and technology governance capabilities.

5. Data Access & Authorization

Access to data is restricted to authorized personnel based on role and business need. All personnel are trained in data protection and confidentiality requirements.

6. International Data Transfers

Due to our global delivery model, data may be processed outside the UAE by affiliated teams and partners under strict safeguards to ensure protection equivalent to UAE standards.

7. Data Retention

Data is retained only as long as necessary for service delivery, legal compliance, and professional obligations. Secure disposal procedures are applied thereafter.

8. Third-Party Processors

Where third-party service providers process data on our behalf, they are required to implement appropriate security measures and comply with confidentiality and data protection obligations.

9. Incident Management

We maintain procedures for detecting, reporting, and responding to data breaches. Appropriate corrective actions will be taken in accordance with applicable laws.

10. Contact Information