Data Terms: Datasets, Hosting, Processing, Ownership and Protection

DRAFT, NEEDS LEGAL REVIEW. Not yet in force. Not a live offer.

Everything about data: selling or licensing datasets, hosting and storing data, processing personal data for customers (Data Processing Terms), ownership, cross-border transfer, retention, deletion and UAE PDPL. Separate from Analytics and AI.

1. Definitions

1. "Customer Data": data you or your users give us or create in a service, including personal data.
2. "Dataset": a structured collection of data that we compile or licence to sell, with its documentation.
3. "Personal Data", "Controller", "Processor", "Processing": meanings as in the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, "PDPL") and its executive rules.
4. "Derived Data": output made from Customer Data or a Dataset, such as scores, reports or models.

2. Data licensing and selling datasets

1. A Dataset is licensed, not sold, unless the quote says "outright sale". The licence is non-exclusive, non-transferable and for your internal business use, for the term, field and territory on the quote.
2. Restrictions: no resale, sublicensing, publishing, or making available as a service or data feed, unless the quote allows redistribution. No use to identify individuals who are not identified in the Dataset. No use for unlawful profiling, discrimination or harassment.
3. Sources and quality: we describe the source type, collection period, fields, update frequency and known limits in the Dataset's data sheet. Datasets are supplied "as compiled". We do not promise completeness or fitness for a decision. You are responsible for decisions you make from the Dataset.
4. Public sources: where a Dataset rests on public or open sources, their licences are respected and noted in the data sheet. We do not include data collected in breach of a site's rules or the law.
5. Personal data in Datasets: we sell Datasets with personal data only where we have a lawful basis and can pass it to you lawfully. You become a controller for your use and must meet the PDPL, including notices, rights and security.
6. Delivery: by secure download, API or a transfer arranged with you. Delivery is complete on access being made available. Updates are included only if the quote says so.
7. Samples: a free sample may be used only to evaluate the Dataset.
8. Audit: on reasonable notice you will show us how you use and store the Dataset. We may add watermarks or seeded records to detect leaks.
9. Withdrawal: if we learn that a Dataset or part of it cannot lawfully be supplied, we may withdraw it, tell you, and refund the unused part of the fee. You delete the withdrawn data.
10. Returns: no returns or refunds once a Dataset is delivered, except where it does not match its data sheet in a material way and we cannot cure it within 30 days.

3. Data hosting and storage

1. We host and store Customer Data to provide the service. The region, storage class, backup and recovery options are on the quote.
2. Standard measures: encryption in transit and at rest, access control by role, logging of admin access, separate environments, regular backups where sold, and vulnerability management. We describe the measures in a security summary on request.
3. Capacity: storage and transfer limits are on the plan. Overage is charged at the rate on the quote.
4. Recovery targets (recovery point and recovery time) are stated on the plan if a recovery option is sold. Otherwise none apply.
5. Prohibited data: you may not store illegal content, or data you have no right to hold. We may remove or block it where the law or an authority requires.
6. Subprocessors: we use named service providers (for example, data centres and support tools). We keep a list, and give 30 days' notice of additions; you may object on reasonable data protection grounds.

4. Ownership

1. You own Customer Data and you keep all rights in it. We receive only the right to process it as set out in this page and the contract.
2. We own Datasets, our methods, schemas, tools and any Derived Data that is built only from our own data. Derived Data built from Customer Data belongs to you, but we may use aggregated and anonymised statistics that do not identify you or any person, to run and improve the services.
3. Models: we do not train general models on Customer Data unless you agree in writing.
4. Feedback you give may be used by us freely.

5. Data Processing Terms (DPA)

1. These terms apply when we process Personal Data for you as your processor. They form part of the contract.
2. Roles: you are the controller and decide the purpose and means. We are the processor and act only on your documented instructions (the contract and your settings), unless the law requires otherwise, in which case we tell you first where we can lawfully do so.
3. Details of processing (subject, duration, nature, purpose, data types, groups of people) are listed on the order. You warrant that you have a lawful basis, that notices and consents are in place, and that your instructions comply with the PDPL.
4. Staff: those who access the data are bound by confidentiality and are trained.
5. Security: we apply the technical and organisational measures in section 3, suited to the risk.
6. Subprocessors: as in section 3, under written terms no less protective than these, and we remain responsible for them.
7. Individuals' rights: we help you respond to requests for access, correction, deletion, restriction, portability and objection within the time the PDPL requires. Requests sent to us we forward to you within 5 working days.
8. Breach: we tell you without undue delay and in any event within 48 hours of confirming a personal data breach affecting your data, with the facts we have and the steps we take. You decide whether to notify the regulator (the UAE Data Office) and individuals; we help.
9. Assessments: we help with data protection impact assessments and with dealings with the regulator, at reasonable cost.
10. Audit: once a year, or after a breach, you may audit our compliance by written request on 30 days' notice, in working hours, at your cost, under confidentiality. We may satisfy this by giving a current independent report or the answers to a questionnaire.
11. Return and deletion: see section 7.
12. Conflicts: for personal data, this section prevails over other terms. Where we act as controller for our own purposes (such as customer accounts, billing and security), we handle personal data as set out in our privacy notice.

6. Cross-border transfer

1. We keep Customer Data in the region on your order. Personal Data leaves the UAE only where the PDPL allows: to a country the UAE recognises as adequate, under approved contract terms or binding rules, with your consent, or on another legal ground the PDPL names.
2. If a service needs a transfer (for example, a provider's support from another country or a resold cloud region), we say so at quotation and record the safeguard used.
3. Free zone note: the Ajman Free Zone entity's data practice follows the federal law and any free zone data rules that apply. [Draft: legal review to confirm the applicable regime and any free zone regulator rules.]
4. Government requests: if an authority demands access to your data, we tell you first where lawful, push back on requests that are not legally valid, and give only the data that is legally required.

7. Retention and deletion

1. We keep Customer Data only while the service runs and for the periods below.
2. Return: on request or on end of service, you may export in a common machine-readable format for 30 days.
3. Deletion: after the return period we delete live copies within 30 days and backups within 90 days, unless the law requires us to keep the data. We then certify deletion if you ask.
4. Legal holds and records: we keep invoices, contracts, payment, KYC and compliance records for the period the UAE law requires (generally at least 5 years), and delete them afterwards.
5. Logs: security and access logs are kept for 12 months, and then deleted or anonymised.
6. Trial and enquiry data: deleted after 12 months of no activity.

8. Security incidents and business continuity

1. We keep an incident plan and test it at least once a year. We tell affected customers as set out in section 5.
2. We do not promise that data will be free from loss or attack. We promise to apply the measures described and to act quickly.

9. UAE PDPL compliance summary

1. We follow the principles of the PDPL: fair and lawful processing, clear purpose, minimum data, accuracy, limited storage, security, and transparency.
2. Lawful bases we rely on include consent, performance of a contract, legal obligation and legitimate interest where the law allows. Where consent is needed, it is clear, specific and withdrawable.
3. Sensitive Personal Data (such as health, biometric, religion, criminal record) is processed only with explicit consent or another ground the PDPL allows, and with stronger controls.
4. Individuals' rights: to be informed, to access, to correct, to erase, to restrict, to port, to object (including to profiling and automated decisions). Requests go to the data contact shown on our privacy notice and are answered within the legal time.
5. Records: we keep records of processing and, where required, appoint a data protection officer.
6. Marketing: we send marketing only with consent or as the law allows, and every message has an opt-out.
7. Children: our services are for business use and are not directed at children.
8. Other regimes: where you use our service for individuals in other countries, you remain responsible for the laws that apply to you, and we will work with you on any extra terms those laws need.

10. Liability for data

1. General Terms limits apply. In addition, we are not liable for loss caused by your instructions, your credentials, your unlawful data or your use of a Dataset against its licence. Each side is responsible for its own regulatory fines to the extent caused by its own breach.