Privacy Policy
Effective Date: October 2026 • Version 2.0
1. Who We Are & Data Controller Identity
An Noor Financial Advisors (“we”, “us”, or “our”) is an independent professional accounting, tax preparation, and advisory practice. For personal data collected through our public website at annoorfinancial.com, An Noor Financial Advisors acts as the Data Controller.
Controller Contact Details:
An Noor Financial Advisors
Office No. 1008, 10th Floor, Eden Heights, Jail Road
Lahore, Punjab 54000, Pakistan
Email: [email protected]
2. Scope of This Policy
This Privacy Policy applies to personal information collected through our public website, quote request forms, contact inquiries, and associated digital interactions.
This policy does not govern client engagements governed by formal professional service agreements, which are subject to separate confidentiality terms, engagement letters, and applicable statutory record-retention obligations.
3. Information We Collect
A. Information You Voluntarily Provide
When you submit an inquiry through our contact form, quote modal, or direct communication channels, we may collect:
- Full name and professional contact title
- Business or company name
- Email address and phone number (including WhatsApp if provided)
- Geographic jurisdiction or state of operations
- Service requirements (e.g., US business tax, bookkeeping cleanup, monthly accounting)
- Message context and preliminary inquiry details
B. Information Collected Automatically
When you access our website, technical diagnostic data is automatically recorded by our hosting infrastructure and security layers:
- Internet Protocol (IP) address and approximate geographic location (city/country level)
- Browser type, version, operating system, and language settings
- Referring URL and pages viewed
- Date, timestamp, and duration of page requests
C. Information Collected Through Tracking Technologies
Depending on your cookie selections, we may use Google Analytics 4, Microsoft Clarity, and Apollo lead intelligence. When Analytics consent is granted, Microsoft Clarity processes website interaction telemetry (such as clicks, scrolling, mouse movement, page interaction, diagnostic/performance events, and session replay / DOM interaction telemetry) to identify user experience friction and improve site layout. In accordance with Microsoft's official data protection and masking standards, sensitive keystrokes, personal details, and numeric form input fields are masked by default and not recorded. For an itemized inventory of all cookies, local storage identifiers, and lifespans, please review our Cookie Policy.
4. Data Minimization & Sensitive Financial Records
Important Security Notice Regarding Public Forms:
Public inquiry forms are transmitted via secure HTTPS/TLS but are intended for initial business inquiries and preliminary scope discussions and should not be used to transmit sensitive tax or financial records.
Examples of data not to submit through public forms include Social Security Numbers (SSNs), complete tax returns, bank statements, bank account credentials, payment card information, QuickBooks passwords, and MFA codes. After initial scope confirmation, we provide approved instructions for securely transmitting sensitive tax or financial records.
5. Purposes of Processing & Legal Bases (GDPR / UK GDPR)
Where European or UK data protection laws apply, we process personal data under distinct lawful bases set out in Article 6 of the General Data Protection Regulation (GDPR), separating each processing purpose:
| Processing Activity | Categories of Data | GDPR Lawful Basis |
|---|---|---|
| Request for quote / service information initiated by visitor | Name, business email, phone, preliminary scope details | Art. 6(1)(b) — Taking steps at the data subject's request prior to entering into a contract. |
| General non-contractual correspondence & administrative inquiries | Contact details, message content, correspondence history | Art. 6(1)(f) — Legitimate Interests in communicating with website visitors, where supported by a legitimate interest assessment. |
| Client feedback submitted via website (Private / Non-published) | Company name, service received, feedback comments | Art. 6(1)(f) — Legitimate Interests in evaluating service quality, operational oversight, and internal performance assessment. |
| Public client testimonial publication & promotional display | Company name, service received, quote/remarks, authorized corporate logo | Art. 6(1)(a) — Freely given, specific, and revocable Consent / affirmative publication authorization (unbundled from inquiry forms). |
| Execution of contracted professional engagements | Accounting ledgers, payroll records, invoices, tax documents | Art. 6(1)(b) — Contractual necessity to deliver contracted accounting, bookkeeping, or advisory services. |
| Statutory tax, accounting & compliance record retention | Invoices, submitted tax filings, audit trails, compliance records | Art. 6(1)(c) — Compliance with concrete legal obligations under applicable tax, commercial, and financial record-keeping laws. |
| Website security, Turnstile bot prevention & network defense | IP address, HTTP request headers, Turnstile telemetry | Art. 6(1)(f) — Legitimate Interests in securing digital infrastructure and defending services against fraud and automated cyber threats. |
| Optional website analytics & performance measurement (GA4 & Clarity) | Pseudonymous device IDs, visit metrics, interaction telemetry | Art. 6(1)(a) — Freely given, specific, informed, and revocable Consent (via cookie preference center). |
| Optional B2B lead intelligence & corporate visitor recognition (Apollo) | Company IP match, domain visit activity | Art. 6(1)(a) — Freely given, revocable Consent, under the implemented strict privacy model. |
6. Technology Vendors, Processors & Independent Controllers
We share personal data only with trusted technology infrastructure providers and professional platforms. We distinguish between data processors acting on our behalf and independent data controllers:
- Cloudflare, Inc. (USA / Global): Data Processor under the Cloudflare Customer Data Processing Addendum (DPA). Provides DNS routing, content delivery, DDoS protection, and Cloudflare Turnstile automated bot mitigation.
- Supabase Pte. Ltd. (Singapore) / Supabase, Inc. (USA): Data Processor under the Supabase Data Processing Agreement (DPA). Supabase Pte. Ltd. serves as the primary contracting processor entity; Supabase, Inc. acts as an operational US affiliate. Provides hosted PostgreSQL database infrastructure and administrative authentication.
- Google Ireland Limited (EEA/Switzerland) / Google LLC (USA): Data Processor for Google Analytics 4 under the Google Analytics Data Processing Terms (gated strictly on explicit visitor consent).
- Microsoft Ireland Operations Limited (EEA/UK) / Microsoft Corporation (USA): Independent Data Controller under the Microsoft Clarity Terms of Use and Microsoft Privacy Statement. Provides Microsoft Clarity session analytics and interaction telemetry (gated strictly on visitor consent). When Analytics consent is granted, Microsoft Clarity may collect and process website interaction information such as clicks, scrolling, mouse movement, page interaction, diagnostic/performance events, and session replay / DOM interaction telemetry. In accordance with Microsoft's official data masking and data protection standards, sensitive form input fields (such as passwords, credit card numbers, and numeric sequences) are masked by default and not recorded.
- ZenLeads Inc. d/b/a Apollo.io (USA): Mixed Role (Data Processor for on-site script deployment under the Apollo.io Data Processing Addendum; Independent Data Controller for business profile matching and B2B database enrichment). Gated strictly on visitor marketing consent.
- Hostinger International Ltd. (Cyprus) / Hostinger, UAB (Lithuania): Data Processor under the Hostinger Data Processing Addendum (DPA). Provides web server hosting and network routing.
- Plus Five Five, Inc. d/b/a Resend (USA): Data Processor under the Resend Data Processing Addendum (DPA). Provides transactional email dispatching infrastructure.
7. International Data Transfers & Safeguards
An Noor Financial Advisors operates its principal professional offices in Lahore, Pakistan. When an individual located in the European Economic Area (EEA), United Kingdom, or other international jurisdictions submits an inquiry directly to us, data is collected directly by our firm. Under European Data Protection Board (EDPB) Guidelines 05/2021 on the interplay between the territorial scope and Chapter V, direct collection from data subjects by a non-EEA controller does not by itself constitute an Article 44 transfer involving a separate exporter.
However, onward processing of data involves third-party cloud infrastructure located primarily in the United States, Singapore, and the European Union:
- Data Privacy Framework (DPF) Reliance: Google LLC, Microsoft Corporation, Cloudflare, Inc., ZenLeads Inc. d/b/a Apollo.io, and Plus Five Five, Inc. d/b/a Resend maintain active certifications under the EU-U.S. Data Privacy Framework (DPF), the UK Extension, and the Swiss-U.S. DPF.
- EEA-Based Hosting Processor: Hostinger International Ltd. is established in Cyprus (with operational affiliate Hostinger, UAB in Lithuania). EEA-based contracting processor; onward transfers outside the EEA are governed by the transfer safeguards described in Hostinger's DPA.
- Standard Contractual Clauses (SCCs): For processors not operating under adequacy decisions or DPF certifications (such as Supabase Pte. Ltd. in Singapore), international processing is governed by executed Data Processing Agreements incorporating European Commission Standard Contractual Clauses (Module 2 Controller-to-Processor) and applicable UK transfer addenda.
Formal verification of vendor DPA execution status and supplementary transfer measures is maintained as part of our internal data governance compliance records (Contractual Verification Required).
8. Data Retention Matrix
We retain personal data only for as long as necessary to fulfill the specific purposes outlined in this policy:
| Data Category | Retention Period | Rationale |
|---|---|---|
| General Inquiries & Quotes | Up to 24 months from last communication | Evaluation of prospective engagements and communication continuity. |
| Client Feedback & Public Testimonials | Private feedback: up to 3 years; Public testimonials: retained until publication authorization is withdrawn | Operational evaluation and authorized commercial representation. Where authorization is withdrawn, public display is terminated without undue delay. |
| Consent Records | 12 months | Demonstrating accountability and compliance with ePrivacy rules. |
| Google Analytics Data | 14 months | Configured user-level retention standard in GA4. |
| Security & Web Server Logs | 30 to 90 days | Detection of suspicious network activity and system defense. |
9. Client Feedback, Testimonial Publication & Withdrawal of Authorization
We distinguish between private client feedback and publicly displayed client testimonials:
- Default Private Storage: Submissions made through our client perspective form are stored in an unpublished administrative queue (
is_published = false) and are never displayed on our website automatically. - Unbundled Authorization: We publish client remarks only where the submitter has provided affirmative, explicit authorization via the unbundled authorization control on the submission form, or through separate written client consent.
- Public Display Scope: Where publication is authorized, we display only the company name, service category, quotation remarks, and optional corporate logo. We do not display individual contact email addresses or personal phone numbers.
- Right to Withdraw / Removal: An authorized client representative may withdraw publication authorization at any time by sending an email to [email protected]. Upon receipt of a verified request, we will remove the testimonial from public website display without undue delay. Note that withdrawal of consent applies prospectively and does not affect the lawfulness of prior authorized display, nor does it guarantee immediate removal from third-party search engine caches or external web archives outside our direct operational control.
10. Information Security Safeguards
We maintain administrative, organizational, and technical safeguards designed to protect personal data against accidental loss, unauthorized access, destruction, or disclosure.
All website data in transit is protected using Transport Layer Security (TLS/HTTPS). Database access is restricted by role-based authorization and multi-factor authentication. While we take all commercially reasonable steps to protect personal information, no internet transmission or electronic storage method is completely invulnerable, and we cannot guarantee absolute security.
11. European & UK Privacy Rights
If you reside in the European Economic Area (EEA), United Kingdom, or Switzerland, you possess specific rights under data protection laws:
- Right of Access: Request a copy of the personal information we hold about you.
- Right to Rectification: Request correction of inaccurate or incomplete personal records.
- Right to Erasure (Right to be Forgotten): Request deletion of your personal data where no overriding legal basis applies.
- Right to Restriction: Request that we restrict processing under certain conditions.
- Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format.
- Right to Object: Object to processing based on legitimate interests or direct marketing.
- Right to Withdraw Consent: Revoke consent for optional cookies or tracking at any time without penalty.
You also have the right to lodge a complaint with your local data protection supervisory authority.
12. United States State Privacy Disclosures
Residents of California, Virginia, Colorado, Connecticut, Utah, and other US states have specific statutory privacy rights. An Noor Financial Advisors provides the following disclosures:
California (CCPA / CPRA) Statutory Thresholds & Applicability:
Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (Cal. Civ. Code § 1798.140(d)), a business is a covered entity if it does business in California and meets at least one of the following tests:
- Had annual gross revenues in excess of $26.625 million in the preceding calendar year (adjusted for inflation effective January 1, 2025 by the California Privacy Protection Agency / CPPA);
- Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more California consumers or households; or
- Derives 50 percent or more of its annual revenues from selling or sharing consumers' personal information.
Whether An Noor Financial Advisors meets the statutory threshold of a covered "business" under California law depends on commercial accounting facts outside this codebase (Business / Legal Determination Required). To establish a rigorous data governance baseline, we voluntarily provide this Notice at Collection and extend rights-ready privacy choices to all visitors.
Notice at Collection & Categories Disclosed:
- Identifiers: Name, business email address, phone number, IP address.
- Commercial Information: Inquired service scopes and company profile.
- Internet Activity: Pages visited, interaction duration, referring channels (collected only with affirmative consent).
We do not sell personal information for monetary payment. Under California and other state privacy laws, the deployment of third-party analytics or B2B lead intelligence tools (such as Apollo) may be deemed "sharing" for cross-context behavioral marketing. You have the unconditional right to opt out of such technologies at any time.
Exercising Your Opt-Out Rights:
Use our preference center to disable optional analytics and marketing technologies.
13. Global Privacy Control (GPC)
We recognize and honor the Global Privacy Control (GPC) signal broadcast by your web browser. If your browser sends a valid GPC signal, our systems automatically suppress marketing and lead intelligence technologies, treating the signal as an affirmative opt-out request under applicable California and state privacy statutes.
14. Children’s Privacy
An Noor Financial Advisors provides professional services to adults aged 18 or older and to business organizations. Our website is not directed to children, and we do not knowingly seek personal information from children. If you believe a child has provided us with personal information, please contact us immediately and we will take prompt steps to delete such records.
15. Third-Party Websites & External Links
Our website may contain links to external sites (such as government portals, social media profiles, or third-party tools). We are not responsible for the privacy policies, data practices, or content of external websites. We encourage you to review the privacy notices of any third-party websites you visit.
16. Updates to This Privacy Policy
We may revise this Privacy Policy periodically to reflect changes in our legal obligations, technology integrations, or internal operations. The updated version will be indicated by the “Effective Date” at the top of this page. Material revisions affecting consent categories will prompt a renewed decision banner upon your next visit.
17. Contact Us & Privacy Requests
To exercise your privacy rights, request data deletion, or ask questions regarding this policy, please submit your request to our data protection contact:
Privacy Inquiries & Requests:
Email: [email protected]
Attention: Privacy & Compliance Lead
An Noor Financial Advisors, Office No. 1008, 10th Floor, Eden Heights, Jail Road, Lahore, Pakistan
We respond to verified privacy requests within the statutory timelines required by applicable law (typically 30 days for GDPR requests and 45 days for CCPA requests).