Data Processing Agreement

Cloudtechtiq IT Infrastructure LLC (“CloudTechtiq”, “we”, “us”) is a limited liability company registered in Dubai, United Arab Emirates, with its registered office at 21-301, 3rd Floor, Business Village, Block-B, near Clock Tower Roundabout, Deira, Dubai, United Arab Emirates.

This Data Processing Agreement (“DPA”) governs our processing of personal data on your behalf where you are the controller and we act as processor, in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and its implementing regulations as in force from time to time.

It forms part of the Terms of Service and takes effect automatically where we process personal data on your behalf. A countersigned copy on our standard form is available on request for procurement files.

Where we determine the purposes and means of processing — for example, our own customer relationship records — we act as controller and our Privacy Policy applies instead.

Subject matter: provision of cloud infrastructure, Microsoft licensing and administration, AWS managed services, IoT and video analytics services as described in your order form.

Duration: for the term of the services, plus the retrieval and deletion period described below.

Nature and purpose: hosting, storage, transmission, backup, monitoring, support and such other operations as are necessary to provide the services, in each case on your documented instructions.

Categories of data subject: as determined by you — typically your employees, contractors, customers and end users.

Types of personal data: as determined by you. You are responsible for deciding what personal data enters the services and for telling us before introducing sensitive personal data or a materially higher-risk category.

• Process personal data only on your documented instructions, including as to cross-border transfer, unless required otherwise by UAE law — in which case we will inform you before processing, where lawful to do so.
• Ensure that personnel authorised to process personal data are bound by confidentiality obligations and are trained appropriately.
• Implement and maintain the technical and organisational measures described below.
• Respect the conditions on engaging sub-processors set out in this DPA.
• Assist you, taking into account the nature of processing, in responding to requests from data subjects exercising their rights.
• Assist you with security, breach notification, data protection impact assessment and prior consultation obligations, taking into account the information available to us.
• At your choice, delete or return personal data at the end of the services, and delete existing copies unless UAE law requires retention.
• Make available the information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits as described below.

• Establish and maintain a lawful basis for the processing you instruct, and provide any notices and obtain any consents required.
• Ensure your instructions to us comply with UAE law.
• Configure the services appropriately — including access control, retention settings, encryption options and residency selection — and review those settings when your circumstances change.
• Not introduce personal data into the services in a manner that exceeds what is necessary for your stated purpose.
• Tell us before introducing sensitive personal data or a category of processing that would materially change the risk profile.

We maintain an information security management system certified to ISO/IEC 27001:2022, and a SOC 2 Type II report available under non-disclosure agreement. Measures include:

• encryption of personal data in transit (TLS 1.2 or above) and at rest (AES-256);
• logical separation of customer environments;
• role-based access control on the principle of least privilege, with mandatory multi-factor authentication for administrative access and logging of all such access;
• network segmentation, firewalls and intrusion detection;
• tested backup and disaster recovery procedures;
• documented and rehearsed incident response; and
• secure disposal of media and cryptographic erasure of storage on decommissioning.

We may update these measures provided the level of protection is not reduced.

You give general authorisation for us to engage sub-processors, on condition that each is bound by written terms imposing data protection obligations no less protective than those in this DPA, and that we remain fully liable to you for their performance.

A current list of sub-processors, including the processing they perform and the country in which they operate, is available on request to info@cloudtechtiq.ae. We will give you at least 30 days' notice before adding or replacing a sub-processor. If you object on reasonable data protection grounds within that period, we will work with you to find an alternative; if none is available, you may terminate the affected service without penalty and receive a pro rata refund of prepaid fees.

Personal data processed in the provision of UAE services is held within the United Arab Emirates by default. We will not transfer personal data outside the UAE except:

• on your documented instruction;
• to a state or territory determined by the competent UAE authority to provide adequate protection;
• under a contract obliging the recipient to apply the standards required by the PDPL; or
• on another basis expressly permitted by the PDPL.

Where a product you have purchased inherently involves processing outside the UAE — for example, a vendor-operated SaaS platform — we will identify that before provisioning so you can make an informed decision.

Where we receive a request from a data subject relating to personal data we process on your behalf, we will not respond directly except to confirm receipt and to direct them to you. We will forward the request to your registered contact without undue delay and assist you in responding, including by providing search, export, correction and deletion capability within the services.

Send requests for assistance to info@cloudtechtiq.ae.

We will notify you without undue delay, and in any event within 24 hours of becoming aware of a personal data breach affecting personal data we process on your behalf. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records affected so far as known, the likely consequences, the measures taken or proposed, and the contact point for further information.

We will provide further information as the investigation progresses, and will cooperate with you in meeting your notification obligations to the UAE Data Office and to affected data subjects. Notification is not an admission of fault by either party. Report suspected incidents to info@cloudtechtiq.ae.

We will make available the information necessary to demonstrate compliance with this DPA, including our current certifications and, under non-disclosure agreement, our SOC 2 Type II report and a summary of penetration test findings.

Where that is insufficient for your regulatory obligations, you may audit once in any twelve-month period on 30 days' written notice, during business hours, without disrupting our operations or the confidentiality of other customers. Audits are at your cost unless a material non-compliance is found. A regulator with lawful authority may audit without those restrictions.

On termination of the services you may retrieve personal data for 30 days. After that period we delete it from production systems, and from backups within a further 90 days as backup media rotates.

Where UAE law requires us to retain specific records — for example, tax and billing records — we retain only what is required, for no longer than required, and continue to protect it under this DPA.

Liability under this DPA is subject to the limitations in the Terms of Service. Where this DPA conflicts with the Terms of Service in relation to the processing of personal data, this DPA prevails. Where it conflicts with a signed data processing agreement between the parties, the signed agreement prevails.

This DPA is governed by the federal laws of the United Arab Emirates and the laws of the Emirate of Dubai, and the parties submit to the exclusive jurisdiction of the courts of Dubai.

To request a countersigned copy or the current sub-processor list, contact info@cloudtechtiq.ae.