Privacy policy

A & H Consulting Group LLC (“A&H”, “we”, “us”) is committed to protecting the personal data entrusted to us. This policy explains what we collect, why we collect it, how long we keep it, and the rights you can exercise. It applies to our website, our client engagements, and our recruitment activity.

We process personal data in accordance with the EU General Data Protection Regulation (Regulation 2016/679), the Dutch GDPR Implementation Act (Uitvoeringswet AVG), and UAE Federal Decree Law No. 45 of 2021 on the Protection of Personal Data, as applicable to the relationship between us.

1. Who is responsible for your data

A & H Consulting Group LLC is the data controller for personal data collected through this website, for business development, and for recruitment. Our registered head office is:

• Middle East: Level 2, Unit 2, IFZA Freezone, P.O. Box 515000, Dubai, United Arab Emirates
• Europe: Hessenbergweg 8, 1101 BT Amsterdam, Netherlands

Data protection enquiries should be addressed to privacy@aandhconsultinggroup.com.

Where we process personal data on behalf of a client as part of a consulting engagement, the client is the data controller and we act as a data processor under a written data processing agreement. In that situation, the client’s own privacy notice governs how the data is used, and requests from data subjects should be directed to the client.

2. What personal data we collect

Information you provide directly

• Enquiry details: name, work email address, organisation, phone number where provided, the area of interest you select, and the content of your message.
• Recruitment information: your CV, covering note, employment history, qualifications, right to work information, and references.
• Engagement correspondence: contact details and communications exchanged with us during the course of a client relationship.

Information collected automatically

• Technical data: IP address, browser type, device type, referring page, and pages viewed. This is collected through server logs and, where enabled, privacy preserving analytics.
• Security data: request metadata retained briefly to detect and prevent automated abuse of our contact form.

We do not collect special category data through this website, and we ask that you do not include sensitive personal information in enquiry messages.

3. Why we process it, and our lawful basis

• Responding to your enquiry. On the basis of your consent and our legitimate interest in conducting business correspondence.
• Delivering and administering client engagements. On the basis of performance of a contract, or steps taken at your request prior to entering one.
• Recruitment. On the basis of steps taken prior to entering an employment contract and our legitimate interest in assessing candidates.
• Securing our website and systems. On the basis of our legitimate interest in preventing fraud, abuse, and unauthorised access.
• Meeting legal and regulatory obligations. Including accounting, tax, and anti money laundering requirements.

We do not sell personal data, and we do not use enquiry details for unsolicited marketing.

4. How long we keep it

• Enquiries that do not become engagements: 24 months from last contact, then deleted.
• Client engagement records: for the duration of the engagement and seven years afterwards, to meet contractual, accounting, and professional obligations.
• Unsuccessful job applications: 12 months, unless you ask us to keep them longer for future openings.
• Server and security logs: no more than 90 days.

5. Who we share it with

We share personal data only where necessary, and only with parties bound by confidentiality and data protection obligations:

• Hosting and infrastructure providers that operate this website and our internal systems.
• Email and productivity providers used to receive and respond to correspondence.
• Professional advisers such as accountants, auditors, and legal counsel, where required.
• Regulators and law enforcement, where we are legally obliged to disclose.

We do not transfer client data to subcontractors without the client’s written authorisation.

6. International transfers

We operate from the United Arab Emirates and the Netherlands, so personal data may be processed in either jurisdiction. Where personal data is transferred out of the European Economic Area, we rely on an adequacy decision where one applies, or otherwise on the European Commission Standard Contractual Clauses, together with a transfer risk assessment.

On client engagements, data residency requirements are captured during discovery and reflected in the solution architecture. We do not move client data between jurisdictions without written instruction.

7. How we protect it

• Encryption of data in transit (TLS) and at rest.
• Least privilege access control with multifactor authentication enforced.
• Credentials held only in a managed secrets store, never in code or email.
• Segregated environments for each client engagement.
• Access reviewed periodically and revoked on engagement close.
• Logging and monitoring, with a documented incident response procedure.

No system can be guaranteed completely secure. Where a personal data breach is likely to result in a risk to individuals, we will notify the relevant supervisory authority and affected individuals without undue delay and in accordance with applicable law.

8. Your rights

Subject to the applicable law, you may have the right to request access to your personal data; to have inaccurate data corrected; to have data erased; to restrict or object to processing; to receive your data in a portable format; and to withdraw consent at any time where processing relies on consent.

To exercise any of these rights, email privacy@aandhconsultinggroup.com. We will respond within one month. We may ask you to verify your identity before we act on a request.

If you are not satisfied with our response, you have the right to lodge a complaint with a supervisory authority. In the Netherlands, that is the Autoriteit Persoonsgegevens. In the United Arab Emirates, it is the UAE Data Office.

9. Cookies

This website uses only the cookies strictly necessary for it to function. We do not use advertising or cross site tracking cookies. Full detail is set out in our cookie policy.

10. Changes to this policy

We may update this policy to reflect changes in our practices or in the law. The date at the top of this page records the most recent revision. Material changes affecting existing clients are notified directly.

11. Contact

Questions about this policy or about how we handle personal data should be sent to privacy@aandhconsultinggroup.com, or by post to our registered head office at Level 2, Unit 2, IFZA Freezone, P.O. Box 515000, Dubai, United Arab Emirates.