Sia T3 1. Parties and scope
This agreement is between the company that creates a company space on Sia T3 (the Customer) and SIA Nexus Group L.L.C-FZ, Meydan Free Zone, Dubai, UAE (SIA Nexus). It forms part of the Terms of use and applies to personal data that SIA Nexus processes for the Customer in providing Sia T3. The Customer accepts it by creating its space.
2. Roles
The Customer is the controller of the personal data in its space. SIA Nexus is its processor. Each party complies with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where it applies, the GDPR.
3. Instructions
SIA Nexus processes the Customer's personal data only to provide Sia T3 as described in the Terms and the Customer's settings, and on the Customer's other documented instructions, unless the law requires otherwise (in which case SIA Nexus will tell the Customer first, unless the law forbids it). Annex C describes the processing.
4. Confidentiality
Everyone at SIA Nexus who can access the Customer's data is bound to keep it confidential and accesses content only to provide the service, to help when the Customer asks, or when the law requires.
5. Security
SIA Nexus keeps the technical and organisational measures in Annex B, and may improve them over time but not reduce the overall level of protection.
6. Sub-processors
The Customer agrees to the sub-processors in Annex A. SIA Nexus will give at least 30 days' notice (in the app or by email to the Admin) before adding or replacing one; if the Customer objects on reasonable data-protection grounds and we can't resolve it, the Customer may close its space. SIA Nexus imposes data-protection obligations on each sub-processor no less protective than these and remains responsible for them.
7. Helping the Customer
Sia T3 lets the Customer find, export, correct and delete personal data itself (Your data, Settings, and each record). SIA Nexus will also help, as reasonably needed, with people's requests to exercise their rights, with data protection impact assessments, and with questions from the authorities. A request SIA Nexus receives directly about the Customer's space is passed to the Customer.
8. Personal data breaches
SIA Nexus will notify the Customer without undue delay, and aim to do so within 72 hours, after becoming aware of a breach affecting the Customer's data, with the information the Customer needs to meet its own obligations, and will take reasonable steps to contain it.
9. Return and deletion
The Customer can download a complete copy of its space at any time. When the Customer closes its space, it is locked at once and deleted, including backups on the server, 30 days later; encrypted off-site copies expire within a further 30 days. Copies the Customer keeps in its own Google Drive or OneDrive are under its own control.
10. Information and audits
SIA Nexus will make available the information reasonably needed to show compliance with this agreement and answer the Customer's reasonable questions. Any audit beyond that is by agreement, on reasonable notice, at the Customer's cost and without access to other customers' data.
11. Where data is kept
The Customer's data is stored in Dubai, UAE. SIA Nexus will transfer it outside the UAE only to the sub-processors in Annex A and only with the safeguards the law requires.
12. General
Liability under this agreement is subject to the limits in the Terms. If this agreement conflicts with the Terms about personal data, this agreement prevails. It lasts as long as SIA Nexus processes the Customer's data. Notices about this agreement go to privacy@siat3.com.
Annex A: Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| WHG Hosting Services Ltd | Server hosting and data centre | Dubai, UAE |
| Apple, Google, Microsoft, Mozilla | Delivering push notifications users turn on (the notification text only) | Their own infrastructure |
| Backblaze, Inc. (once switched on) | Encrypted off-site backups | To be confirmed before use |
Google Drive or Microsoft OneDrive copies are used only if the Customer connects its own account; they are the Customer's own service, not SIA Nexus's sub-processor.
Annex B: Security measures
- A separate database, file store and server process per space; no data shared between customers.
- HTTPS for all connections; HttpOnly, SameSite cookies.
- Passwords stored as scrypt hashes; pauses after repeated wrong attempts.
- Two-step sign-in (authenticator app, recovery codes), which the Customer's Admin can require.
- Role-based access within the space (Admin, manager, user, finance, HR, AML officer); private notes visible to their author only.
- An access log of sign-ins and sensitive actions, available to the Admin.
- Daily backups on the server (14 kept); encrypted off-site backups; files on the host readable by the service account only.
- The operator's console protected by password and two-step sign-in and showing counts only, not content.
Annex C: The processing
- People concerned: the Customer's staff and users; its clients and their contacts; client-portal users; people whose identity documents the Customer stores for AML.
- Kinds of data: names and contact details; work records (tasks, time, leave, expenses, documents, messages); client records and invoices; files the Customer uploads; for AML, identity documents and screening results; sign-in log entries.
- Purpose and nature: hosting, storing, backing up, displaying and sending notifications about the data, so the Customer can run its work in Sia T3.
- Duration: while the Customer's space exists, then deletion as in section 9.