Privacy Policy

This policy explains how SMBDM Technology handles personal data in connection with Moazaf, in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).

We are the controller for account administration, billing, support, security and marketing information about our customers' users.

We are a processor for employee and other personal data that customers manage in their workspaces. For that data, the customer is the controller and section 9 of our Terms applies. Marketplace Providers become controllers of the data you share with them to perform a Marketplace Service.

Depending on the features you use:

• account names, emails and contact details;
• company and employee records;
• passport, visa and Emirates ID information;
• bank details and payroll information;
• leave and attendance records;
• uploaded files and renewal information;
• Marketplace orders and related documents;
• billing details, support correspondence and security logs.

Customers must make sure that their collection and use of employee data is lawful.

We use this information to:

• provide the service;
• authenticate users and enforce permissions;
• fulfil Marketplace orders;
• send service messages;
• administer subscriptions;
• support customers;
• protect the service;
• meet legal obligations.

Where we are the controller, we rely on the lawful basis that fits each purpose. Accepting this policy is not blanket consent.

• Hosting: Amazon Web Services, Mumbai, India.
• Email: Amazon SES.
• Document AI (only when switched on): OpenAI and Anthropic, set so they do not use customer data to train their models.
• Payments: Stripe.
• Marketplace Providers: for orders you place.

We do not claim that data stays only in the UAE. Backups are kept in the same AWS region.

Workspace data is visible to authorised users according to the customer's permissions. It is shared with the service providers above, with Providers for orders you place, with integrations you authorise, and with authorities where the law requires.

We do not sell personal data.

Personal data may be processed outside the UAE, including in India and the United States. We do this only on a basis permitted by PDPL, using contractual safeguards with our providers.

Our safeguards include encryption, and permission-based masking of Emirates ID numbers, passport numbers and IBANs. No system is completely secure, and we do not claim any certification.

We use cookies for sign-in, language preference and recording which page a new signup came from. We do not use advertising cookies.

We keep data for as long as needed for the purposes above, following customer instructions and legal obligations. Cancelling a subscription does not delete a workspace.

After a workspace is closed:

• data can be exported for 30 days;
• it is then deleted from production;
• backups expire within 35 days;
• invoices and credit notes are kept for seven years after the end of the year they were issued, as UAE tax law requires, and then deleted; security records are kept for five years where the law requires.

Audit-log retention by plan is separate from employee-record retention.

Under PDPL you may have the right to:

• access, correct or erase your data, or obtain a copy of it;
• restrict or object to processing;
• withdraw consent.

If your data is in a customer's workspace (for example, as an employee), contact that customer first. We will help them respond.

We may verify your identity before acting on a request. You may also complain to the UAE Data Office. We reply within 30 days.

If a breach affects personal data:

• where we are the processor, we notify the affected customer without undue delay;
• where we are the controller, we notify the regulator and affected individuals as PDPL requires.

Privacy enquiries: legal@moazaf.com. General: hello@moazaf.com. Address: Office C-11, Al Khabaisi, Deira, Dubai, United Arab Emirates.

We will date updates to this policy and give notice of material changes.