Data Processing

Roles

Your company is the controller of the personal data it puts into the platform. toDubai is the processor and acts on your documented instructions, which in practice means using the data to run the service you are paying for and nothing else.

What is processed

• Categories of people: your clients and their contacts, company shareholders and signatories, employees named on visa and service requests, your own staff, and your partner agencies.
• Categories of data: names, contact details, nationality, passport and Emirates ID details, photographs, employment details on visa requests, company and license information, correspondence, and financial records relating to services provided.
• Purpose: processing license applications and service requests, managing client relationships, financial administration, and providing progress visibility to your clients and partners.

Our obligations

• Process personal data only on your instructions and to provide the service.
• Ensure people with access are bound by confidentiality obligations.
• Apply the technical and organisational measures described on our security page.
• Assist you in responding to requests from individuals about their data.
• Notify you without undue delay if we become aware of a personal data breach affecting your data.
• Delete or return your data at the end of the agreement, at your choice.

Sub-processors

We use a small, fixed set of service providers to deliver the platform. As of the date above, these cover:

• Cloud hosting and encrypted object storage for the application and uploaded documents.
• WhatsApp Business messaging, for lead intake and the chat inbox.
• Telegram, for internal staff alerts.
• Email delivery, for invoices, receipts, quotations and notifications.
• In-app support chat.
• An AI provider, used by the activity finder to match business descriptions to licensed activities.

We will tell you before adding or replacing a sub-processor that handles your data, and you may object on reasonable grounds. Current provider names are available on request and listed in your agreement.

Transfers

Some sub-processors operate outside the United Arab Emirates. Where that is the case, we rely on providers offering appropriate contractual protections for international transfers.

Requests from individuals

If someone whose data sits in your instance contacts us directly, we will not act on their request. We will tell them to contact you, and tell you it happened. Where you need our help to respond, we will provide it.

Audit

You may ask us for information reasonably necessary to demonstrate our compliance with these terms. We will answer specific questions from your compliance or technical reviewers in writing.

Return and deletion

On termination we provide a final export of your data through the export centre and then delete it in line with the retention period in your agreement.

Contact

Data protection questions go to hello@todubai.ae.