Privacy Policy
Finrom Technologies and the EWRA Platform are committed to protecting the privacy, confidentiality, and security of institutional and customer personal data in full compliance with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and international data governance standards.
Customer document scans (passports, Emirates IDs) are cached locally on your device mirror and excluded from remote cloud database sync to prevent document sprawl.
We never sell, rent, or monetize your customer KYC dossiers or risk assessments. Your data belongs exclusively to your organization.
Gemini Vision OCR extraction is strictly ephemeral in transit. Uploaded corporate or identity documents are never used to train machine learning models.
1. Scope & Regulatory Framework
This Privacy Policy explains how Finrom Technologies collects, protects, utilizes, and stores information through the EWRA software platform.
Our privacy framework is structured in full compliance with UAE Federal Decree-Law No. (45) of 2021 regarding Personal Data Protection (PDPL), Executive Regulations issued pursuant thereto, and the risk management and record-retention directives established by the Central Bank of the UAE (CBUAE) and the Financial Action Task Force (FATF) Recommendations.
2. Data Controller vs. Data Processor Distinctions
Under UAE data protection principles, responsibilities are bifurcated based on the context of processing:
We act as Data Controller with respect to account profile information, billing details, authentication tokens, administrative log entries, and direct correspondence with our support and legal teams.
When your institution uploads customer KYC documents (passports, national IDs, trade licenses), enters beneficial ownership information, or logs compliance case files, your institution acts as the Data Controller. Finrom acts strictly as the Data Processor, processing customer records solely in accordance with your instructions and statutory compliance needs.
3. Categories of Information We Collect
We process the following categories of information:
- User & Account Credentials: Full name, corporate email address, profile image, and unique user identifier (UID) provided via Google OAuth Single Sign-On.
- Institutional Assessment Data: Responses to the 11 AML/CFT/CPF risk domains, control effectiveness weights, institutional notes, board summaries, and policy choices.
- Customer Due Diligence (CDD / KYC) Records:
- Natural Persons: Name, nationality, date of birth, residential address, identification numbers (passport, Emirates ID), source of funds, and PEP flags.
- Corporate Entities: Registered company name, trade license number, commercial registry details, legal form, jurisdiction of incorporation, and Ultimate Beneficial Owners (UBOs) holding ≥ 25% ownership.
- Document Scans: Digital copies of trade licenses, articles of association, passports, and national ID cards uploaded into the onboarding wizard.
- Compliance Sign-offs & Audit Trails: Reviewer names, timestamped approval decisions, 4-eyes validations, Senior Management Overrides, and MLRO declarations.
4. Lawful Bases & Purposes of Processing
We process personal and compliance data exclusively for:
- Performance of Contract: Providing scoring engines, risk matrices, customer due diligence workflows, and generating audit-ready PDF packs.
- Compliance with Legal & Regulatory Obligations: Assisting financial institutions and DNFBPs in meeting their mandatory obligations under UAE Federal Decree-Law No. (20) of 2018 and CBUAE regulatory standards.
- Legitimate Interests & System Integrity: Protecting against unauthorized access, auditing compliance workflows, and securing multi-tenant operations.
5. Automated OCR Processing via Google Gemini Vision
To accelerate customer onboarding, the platform incorporates automated Optical Character Recognition (OCR) powered by Google Gemini Vision.
When a compliance analyst uploads an identification document, the file is securely transmitted via TLS 1.3 to Google Gemini Vision APIs solely to parse key fields (name, document number, expiry date, date of birth). The extraction runs ephemerally in memory; no uploaded customer documents are stored by Google for artificial intelligence or model training purposes.
6. Storage Architecture & Client-Side File Safeguards
The EWRA Platform employs a privacy-first hybrid data architecture designed to mitigate the risk of centralized data breaches:
Heavy base64 document payloads (dataUrl, pdfDataUrl) are persisted exclusively in the user's local browser storage (localStorage). They are automatically stripped before synchronization to Firestore, ensuring that raw identity document files stay on your device and are never broadcast across shared databases.
Assessment scores, customer metadata, and questionnaire answers are stored in Google Cloud / Firebase Firestore under secure paths scoped strictly to the authenticated user's account (users/{uid}/state/*). All communications are secured using HTTPS/TLS 1.3, and data is encrypted at rest using AES-256.
7. Statutory AML Record Retention Requirements
Under Article (16) of UAE Federal Decree-Law No. (20) of 2018 and regulatory guidance issued by the Central Bank of the UAE and Ministry of Economy, reporting entities are required to retain all customer identification records, KYC documents, and transaction assessment trails for a minimum of five (5) years from the date of the completion of the transaction or the termination of the business relationship.
In accordance with these statutory mandates, compliance records held in active repositories remain accessible throughout the subscription term. Following account termination, data is archived for thirty (30) days for export, after which records are purged unless prolonged retention is expressly mandated by an ongoing regulatory inquiry or court order.
8. Sub-Processors & Infrastructure Partners
We work with trusted enterprise cloud infrastructure providers:
| Sub-Processor | Purpose | Data Location |
|---|---|---|
| Google Cloud / Firebase | User Authentication, Firestore Database, Hosting | UAE / Global Tier-1 Data Centers |
| Google Gemini Vision | Ephemeral OCR text extraction from document scans | Ephemeral in-transit processing |
| Telegram Bot API | Optional user feedback notification relay via server proxy | Voluntary feedback submissions only |
9. Data Subject Rights Under UAE PDPL
Pursuant to UAE Federal Decree-Law No. (45) of 2021, data subjects are granted specific statutory rights regarding their personal data, including:
- Right of Access: Obtain confirmation and copies of your personal data processed on the platform.
- Right to Rectification: Request correction of inaccurate, outdated, or incomplete data.
- Right to Data Portability: Export assessments and customer dossiers in structured, machine-readable formats (PDF / JSON).
- Right to Restriction / Objection: Request restriction of processing where applicable under law.
- Right to Erasure: Request deletion of personal records, subject to mandatory AML statutory retention exemptions under Federal Decree-Law No. (20) of 2018.
To exercise any of these rights, please contact our Data Protection Officer at privacy@finrom.ae.
11. Data Protection Officer (DPO) & Contact
If you have questions, inquiries, or complaints concerning this Privacy Policy or our information handling practices, please contact our designated Data Protection Officer:
Read the Terms of Service
Learn about our licensing terms, compliance disclaimers, acceptable use rules, and governing UAE law.