Privacy Policy
Taha Younis & Company
Effective date: February 2025
Last updated: August 2026
1. Who we are
Taha Younis & Company ("TY&Co", "we", "us", "our") is a business services firm providing accounting, HR, automation and company registration services. We operate through two legally registered entities:
| Entity | Jurisdiction | Registered address |
|---|---|---|
| Taha Younis & Company (SMC-Private) Limited | Islamabad, Pakistan | 3rd Floor, Office No. 16, I-8 Markaz, Islamabad |
| Taha Younis and Company | Jeddah, Kingdom of Saudi Arabia | Office No. 17, 2nd Floor, Bin Yala Center, Al Bawadi, Jeddah |
Each entity acts as the data controller for the personal data it collects in the course of serving its own clients. Where data is shared between the two entities for the purposes of a single client engagement, they act as joint controllers. This policy applies to both, to the website www.tahayounis.com, and to the social media pages and business accounts we operate.
If you are unsure which entity holds your data, contact us at the address in section 14 and we will tell you.
2. Scope
This policy covers personal data we process when you:
- visit or use www.tahayounis.com;
- contact us by email, a website form, or a messaging channel we operate;
- engage us as a client, or act as a representative, director, shareholder, employee or beneficial owner of a client;
- apply for a role with us;
- follow, message, comment on, or otherwise interact with our official pages on LinkedIn, Facebook, Instagram or TikTok.
It does not cover the practices of those social media platforms themselves, which are governed by their own privacy policies.
3. What personal data we collect
3.1 Data you give us directly
- Identity and contact data: name, job title, employer, email address, telephone number, postal address.
- Engagement data: the content of your enquiries, messages and correspondence with us.
- Client onboarding data: information required to provide our services and to meet our own legal and regulatory obligations. Depending on the service, this may include national identity card or passport details, tax registration numbers, shareholding and director details, and bank account details for payment processing.
- Payroll and HR data, where we provide HR or payroll services to a client organisation. In this case we act as a processor on that client's instructions, and the client is the controller.
3.2 Data collected automatically
- Technical data: IP address, browser type and version, device type, operating system, referring page, and pages viewed on our website.
- Cookie data: see section 10.
3.3 Data from third-party sources
- Public business registries (SECP, FBR, Saudi Ministry of Commerce, ZATCA) where required to deliver a service.
- Social media platforms, as described in section 4.
3.4 Sensitive data
We do not seek sensitive personal data (such as health data, biometric data, religious belief, political affiliation, caste or ethnicity) and ask that you do not send it to us. Where a specific statutory filing requires a category of data that local law treats as sensitive, we collect only what that filing requires, process it solely for that purpose, and delete it in line with section 8.
4. Social media platform data
We use approved third-party tools and official platform APIs to publish content to, and read analytics from, business pages and accounts that we ourselves own and administer. This section explains that processing specifically.
4.1 What we access
Through the LinkedIn Community Management API, the Meta Graph API (Facebook Pages and Instagram Professional accounts) and the TikTok Content Posting API, and only in respect of accounts we own or are authorised to administer, we access:
- Account and page metadata: page name, page identifier, profile image, administrator role.
- Content we create: posts, captions, images and video we schedule or publish, and their publication status.
- Aggregate analytics: impressions, reach, engagement counts, follower counts and follower demographics, as provided by the platform in aggregate form.
- Public interactions with our content: comments and mentions on our own posts, and direct messages sent to us through the platform, together with the public username of the person who sent them.
4.2 What we do not do
- We do not scrape platforms or collect data outside the official APIs.
- We do not access, collect or store the private data of platform users who have not interacted with us.
- We do not sell, rent, license or otherwise transfer platform data to any third party.
- We do not use platform data to build advertising profiles of individuals, or transfer it to any data broker or advertising network.
- We do not use platform data to train machine learning or artificial intelligence models.
4.3 Why we process it
To publish and schedule our own marketing content, to respond to enquiries received through social channels, and to measure the performance of our own content. Our legal basis is our legitimate interest in operating and measuring our own communications.
4.4 Retention and revocation
Access tokens are stored encrypted at rest and are used only to perform the actions described above. Aggregate analytics are retained for no more than 24 months. Direct messages and comments are retained for the period set out in section 8.
You may revoke our access at any time from your own platform settings. Where we are the account owner, disconnecting the account in our scheduling tool immediately revokes and deletes the stored token, and we delete any platform-derived data held for that account within 30 days.
5. Why we process your data, and on what basis
| Purpose | Legal basis |
|---|---|
| Responding to your enquiry | Steps taken at your request prior to entering a contract |
| Delivering accounting, HR, automation or registration services | Performance of a contract |
| Meeting statutory, tax, anti-money-laundering and regulatory obligations | Legal obligation |
| Securing our systems and preventing fraud | Legitimate interest |
| Sending you service updates or marketing about our services | Consent, or legitimate interest where you are an existing client |
| Measuring website and social content performance | Legitimate interest |
Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.
6. Marketing communications
We send marketing email only where you have asked to hear from us, or where you are an existing client and the message concerns services similar to those we already provide to you. Every marketing email carries an unsubscribe link, and unsubscribing takes effect within 10 business days. Unsubscribing from marketing does not stop operational messages about a live engagement.
7. Who we share data with
We do not sell personal data. We share it only as follows.
Service providers acting on our instructions:
- Website and application hosting: Hetzner Online GmbH, with servers located in Germany.
- Content delivery, DNS and security: Cloudflare, Inc.
- Business systems and CRM: our self-hosted Odoo instance, hosted as above.
- Transactional and marketing email, social media scheduling and payment processing: providers engaged under written data processing agreements.
Each is bound by a written agreement requiring them to process data only on our instructions and to maintain appropriate security.
Between our two entities, where a client engagement spans Pakistan and Saudi Arabia. Accounting records are kept separately per entity; contact and engagement records are shared.
Professional advisers, including our own auditors and legal counsel, under a duty of confidentiality.
Regulators and authorities, where we are required by law to disclose, including to SECP, FBR, ZATCA, the Saudi Ministry of Commerce, or a court of competent jurisdiction.
A successor entity, in the event of a merger, acquisition or restructuring, subject to this policy continuing to apply.
8. How long we keep data
| Category | Retention period |
|---|---|
| Enquiries that do not become engagements | 24 months from last contact |
| Client engagement and correspondence records | 10 years from the end of the engagement, or longer where a statutory retention period requires it |
| Accounting and tax records | As required by Pakistani and Saudi tax law |
| Anti-money-laundering and client due diligence records | As required by applicable law |
| Website server logs | 12 months |
| Social media analytics | 24 months |
| Job applications from unsuccessful candidates | 12 months, unless you ask us to keep them longer |
When a retention period ends we delete the data or irreversibly anonymise it.
9. International transfers
Because we operate in both Pakistan and Saudi Arabia, and because some of our service providers are located in the European Economic Area and the United States, your data may be transferred across borders.
Where personal data originating in the Kingdom of Saudi Arabia is transferred outside the Kingdom, we do so in accordance with the Personal Data Protection Law and its implementing regulations, and apply the transfer conditions and safeguards required by those regulations.
For all other transfers we apply contractual safeguards with the receiving party requiring a standard of protection equivalent to that described in this policy.
10. Cookies
Our website uses strictly necessary cookies, which keep the site secure and functioning. These cannot be switched off.
We do not currently set analytics or marketing cookies. If we introduce them, we will ask for your consent first and update this policy before doing so.
You can block or delete cookies through your browser settings, though this may affect how the site works.
11. Security
We apply technical and organisational measures proportionate to the risk, including encryption in transit (TLS) and at rest for credentials and tokens, role-based access control, multi-factor authentication on administrative accounts, network firewalls, and regular backups held separately from production systems. Access to client data is limited to personnel who need it to do their job.
No system is perfectly secure. If a breach occurs that is likely to cause harm to you, we will notify you and the relevant authority without undue delay, and in any event in accordance with the notification timeframes required by applicable law.
12. Your rights
Subject to applicable law and to our own statutory record-keeping obligations, you may ask us to:
- Access the personal data we hold about you, and receive a copy.
- Correct data that is inaccurate or incomplete.
- Delete data where we no longer have a lawful reason to keep it.
- Restrict or object to processing we carry out on the basis of legitimate interest.
- Port data you gave us to another provider, in a structured, commonly used format.
- Withdraw consent where consent is the basis for processing.
- Be informed of the destination of your data where it has been disclosed to a third party.
We respond within 30 days. We may ask you to verify your identity before acting, and we will tell you if a statutory retention obligation prevents us from deleting something.
Individuals in the Kingdom of Saudi Arabia may also lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA).
Pakistan has not yet enacted a comprehensive data protection statute; the Prevention of Electronic Crimes Act, 2016 and its 2025 amendment currently provide the relevant framework. We have chosen to extend the rights set out above to all individuals regardless of where they are located, and we will align this policy with the Personal Data Protection Act once it is promulgated.
13. Data deletion requests
To request deletion of your personal data, including any data we hold that originated from a social media platform, email info@tahayounis.com with the subject line "Data Deletion Request" and tell us:
- your name and the email address or platform username we would know you by;
- which data or which platform account the request concerns.
We acknowledge within 5 business days and complete verified deletion requests within 30 days. Where we cannot delete data because a law requires us to retain it, we will tell you which law and for how long, and we will restrict all other processing of that data in the meantime.
14. Contact
Email: info@tahayounis.com
Pakistan office: 3rd Floor, Office No. 16, I-8 Markaz, Islamabad
Saudi Arabia office: Office No. 17, 2nd Floor, Bin Yala Center, Al Bawadi, Jeddah
15. Children
Our services are directed at businesses, not individuals under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
16. Changes to this policy
We may update this policy as our services or the applicable law change. The effective date at the top shows when it was last revised. Where a change materially affects how we use your data, we will notify you by email or a prominent notice on the website before it takes effect. Previous versions are available on request.