Data Processing Agreement

This agreement applies whenever you put personal data into ValiCrew. It forms part of the Terms of Service and takes effect automatically — you do not need to sign or request a separate copy. If your organisation requires a countersigned version, write to [email protected].

Roles

You are the data controller. We are the data processor.

You decide which people to record, what to record about them, and why. Lenouar Artificial Intelligence Developing Services LLC holds and processes that data on your behalf, on your instructions, and for no other purpose.

What we process

Categories of people: your employees, contractors and drivers; the clients or residents you serve where you choose to record them; your own staff who use the workspace.

Categories of data: identity and contact details; identity documents including Emirates ID, passport and visa references; employment terms; designation and department; spoken languages; gender where you record it; schedules, attendance and leave; clock-in coordinates where your configuration captures them; salary, allowances, loans and end-of-service settlements; bank account details for salary transfer; vehicle and driving licence records; documents you upload.

Purpose: operating the workforce and fleet administration service you have subscribed to.

Screen recordings count. If one of your users records their screen through the in-app widget to show us a problem, that recording will normally contain personal data drawn from your workspace. It is processed under this agreement like any other workspace data — used only to investigate the issue reported, never for anything else — and deleted once the issue is resolved. See Feedback, Suggestions & Recordings.

Duration: for as long as your workspace is active, plus the retention period described in Data Retention & Deletion.

Our obligations

We process only on your documented instructions. Using the service is the instruction. We will not process your workspace data for our own purposes, will not sell it, and will not use it to train AI models.

We keep it secure. Encryption in transit and at rest, per-tenant isolation, role-based access control, audit logging, encrypted backups with tested restores, and malware scanning on upload. See the Security Policy.

We bind our people to confidentiality. Access is limited to staff who need it to operate or support the service, and is logged.

We help you meet your duties. The platform provides subject-access export, correction, erasure and retention tooling directly in the workspace, so you can answer most requests yourself without waiting on us. Where you need more, we will assist.

We tell you about breaches without undue delay after becoming aware of one, with enough detail for you to meet your own PDPL Article 9 notification obligations.

We return or delete data when your workspace ends, per Data Retention & Deletion. You can export at any time while the workspace is active or read-only.

Sub-processors

You give general authorisation for us to use sub-processors. The current list, with each one's purpose and location, is published at Sub-processors.

We impose data-protection obligations on each of them no less protective than those in this agreement, and we remain responsible to you for their performance.

Before adding or replacing a sub-processor we will update that page and notify workspace administrators by email at least 30 days in advance. If you object on reasonable data-protection grounds and we cannot offer an alternative, you may terminate the affected part of the service and stop paying for it.

International transfers

The application, database and backups are hosted in Abu Dhabi, United Arab Emirates. Personal data in your workspace stays in the UAE.

Certain supporting functions — payment processing, platform email, bot protection — are provided from outside the UAE and are identified on the sub-processor page. Transfers are limited to what those functions require, are covered by contractual safeguards with each provider, and rely on the bases permitted under PDPL Articles 22 and 23.

Your obligations

You confirm that you have a lawful basis for the data you record, that you have given the people concerned the information they are entitled to, and that your instructions to us do not put us in breach of applicable law.

The Worker Privacy Notice is provided as a starting point you can adapt and give to your staff.

Audit

On reasonable written notice, and no more than once a year unless a regulator requires otherwise, we will provide the information reasonably necessary to demonstrate our compliance with this agreement.

Liability

Liability under this agreement is subject to the limits in the Terms of Service.

Contact

Data protection matters: [email protected] Contractual matters: [email protected]