Data Processing Terms

These terms are between your business and Iuvora, the business that operates E-Tally, currently completing its registration and licensing in India. [TO CONFIRM: the contracting entity and its authorised signatory before any enterprise agreement is signed.]

For the records you keep in your workspace, you decide what is collected and why, and we act on your instructions in operating the service. In common data protection language, you are the controller and we are the processor for that information.

For your own account with us, for example the administrator's email address and our server logs, we decide how that information is used. Our privacy policy covers it.

[TO CONFIRM: the legal framework these terms sit under, and whether this split is the correct classification for every category of data. Legal research points to the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and the processor duties in its Article 8. Whether that law applies to us, and whether these terms satisfy it, must be confirmed by UAE-qualified counsel. The wording above describes the arrangement in practice; it is not a legal conclusion.]

You confirm that you are entitled to collect and use the information you put into your workspace, including information about your own customers, suppliers and staff, and that you have given those people whatever notice they are owed.

Please do not put special categories of information into E-Tally, such as health records or government identity documents, unless we have agreed that in writing. The product is designed for billing and accounting records.

Types of information, depending on what you enter:

• your contacts: names, company names, email addresses, phone numbers, addresses, tax registration numbers
• your commercial records: products, prices, quotations, invoices, payments, purchases, inventory and expenses
• your people: the team members you invite, their names, email addresses and the roles you give them
• activity records created by the workspace software, such as who changed a record and when

Whose information: your customers, suppliers, staff and the users of your workspace.

Only to provide the service to you: running your workspace, keeping encrypted backup copies of it, keeping it secure and available, and helping you when you ask for support.

We do not use your workspace information for our own purposes, do not sell it, and do not use it to train any model or to advertise.

Your workspace information is confidential. Only the people operating the service may access it, only where needed to run it or to answer your request, and they are bound to keep it confidential.

The measures listed in the security section of our privacy policy apply to workspace information. The most relevant ones here:

• each customer's workspace has its own database and its own stored files; they are not mixed
• sign-in links are signed, single-use and short-lived, and email confirmation links expire within 24 hours
• a session or sign-in link issued for one workspace is refused by every other workspace
• all access is over encrypted HTTPS connections
• database and application services are not reachable from the internet
• sign-in tokens are removed from server logs
• backup copies of workspace databases are encrypted on our own server, with a key we control, before being sent to off-site storage, so the storage provider cannot read them

[TO CONFIRM: encryption of data at rest on the live servers (backups are already encrypted before upload, as above), an enforced backup schedule and retention period, and independent security testing.]

Inside your workspace you control access: the workspace owner invites people and assigns roles, and a team member cannot reach accounting configuration or settings, or grant themselves additional access.

On our side, administrative access to the servers is limited to the people operating the service and uses key-based authentication.

We use the following providers to deliver the service. They may process workspace information as part of hosting or sending email on our behalf:

• DigitalOcean — hosting of servers and live databases, in its Singapore region (sgp1)
• Backblaze B2 — storage for encrypted backup copies of workspace databases, in the United States (us-east region). Backups are encrypted on our own server, with a key we control, before upload; Backblaze cannot read their contents.
• Resend — delivery of service emails to addresses you or your team supply, processed in Resend's EU region (eu-west-1)
• Hostinger — DNS for etally.ai and our own business mailboxes
• Let's Encrypt and deSEC — certificates that secure connections; they hold no workspace information

We will tell customers before adding a provider that processes workspace information. [TO CONFIRM: the notice period, whether customers may object, and written data protection agreements with each provider above. Those agreements are not yet in place.]

Workspace information lives in more than one country: the live database is stored in Singapore, encrypted backup copies of it are stored in the United States, and service emails are processed in the EU. Information therefore crosses borders in the ordinary course of running the service.

Hosting your workspace in Singapore and keeping an encrypted, off-site backup copy in the United States is how the service is delivered and protected, and you authorise those transfers by using E-Tally. You remain responsible for having whatever authority you need to send your own staff's and customers' information to us.

[TO CONFIRM: the transfer mechanism for each provider. Legal research notes that there is no adequacy decision for Singapore or the United States under the UAE data protection law, and points to contractual safeguards plus customer authorisation as the route. Whether standard contractual clauses are required, and their form, must be confirmed by UAE-qualified counsel. No safeguard is claimed here until agreements are in place.]

We keep workspace information for as long as the workspace exists. You can export it yourself from within the application at any time.

When you ask us to close a workspace, its database and files are deleted from the live system. Copies remain in operational backups until those are replaced or removed. [TO CONFIRM: how long backups are kept, the deletion deadline we commit to, whether we confirm deletion in writing, and the export formats offered. Backups are taken by operator tooling rather than on an enforced schedule, so no period is promised.]

If we become aware of an incident affecting your workspace information, we will investigate, take steps to contain it, and tell you what we know: what happened, which information was affected as far as we can tell, and what we are doing about it.

[TO CONFIRM: a fixed notification deadline. Research suggests a contractual window measured in hours and separately describes regulator reporting duties in the UAE and India; those are different obligations with different timeframes. We are not adopting a number until counsel confirms which applies to us.]

If someone asks you to access, correct or delete their information, most of it you can handle yourself inside the workspace. Where you cannot, we will help you within a reasonable time.

If such a request reaches us directly, we will not answer it ourselves. We will pass it to you, unless the law requires otherwise.

We will provide the information reasonably needed to show how we handle your workspace information, and will cooperate with reasonable questions from you.

[TO CONFIRM: audit rights, their frequency and cost, and whether an independent assessment report will be made available. No audit right is granted or refused here, and no independent assessment has been carried out.]

These terms apply for as long as we process your workspace information. When the service ends, the deletion section above governs what happens to it.

For the handling of workspace information, these terms take precedence over the Terms of Service and the Privacy Policy. Everything else stays as stated in those documents. If a signed agreement exists between us, that agreement comes first.

Questions about these terms, or to request a signed agreement: anas.shareef@outlook.com. [TO CONFIRM: a dedicated data protection address, and the signatory who can execute an agreement, once registration completes.]