Who is what
You are the controller and we are the processor for booking, appointment and slot records; customer contact details, booking history, frequency, spend and no-show behaviour; message delivery, response, consent and opt-out records; and any other personal data you export or synchronise to the service.
We are an independent controller for merchant account, contact and billing records; security, fraud-prevention and abuse-detection data; service logs and diagnostics; and our own marketing to businesses. That processing is governed by our Privacy Policy, not by these terms.
Aggregated, de-identified data created from running the service is not personal data. Nothing in these terms applies to it.
What we process, and why
The subject matter is identifying appointment capacity that is about to expire, running recovery campaigns against your own customer records, and measuring the incremental attended visits that result. It lasts for the term of the agreement, plus the retention periods below.
We collect, structure, store, analyse, score, profile, transmit messages, record responses, measure statistically against a randomly selected hold-out group, report, support billing, and — where you use our booking layer — take bookings and synchronise availability with your connected calendar.
The personal data involved is: name; mobile number; email where held; booking and appointment records including date, time, duration, service and staff member; where you use the booking layer, availability and busy periods read from your connected calendar and bookings written to it; price and spend history; attendance, no-show and cancellation history; lapse status; message delivery and response events; consent and opt-out records; and, where you are a health-regulated business, the fact of an appointment at a health facility and the service booked.
Where you are a health-regulated business, a booking record may reveal health status by inference, and we treat it as health information under our health data terms. Clinical records, images, results, prescriptions and treatment notes are excluded from the service by the agreement.
The people involved are your customers and patients, and your staff to the extent they appear in booking records as the assigned provider.
What we commit to
We process only on your documented instructions — the agreement, these terms, and the configuration you set in the service — unless the law requires otherwise, in which case we will tell you before processing unless the law forbids it. We will tell you if we think an instruction breaks the law.
Confidentiality. Everyone we authorise to process personal data is under an enforceable duty of confidentiality that survives their engagement.
Security. We maintain the measures set out below.
Helping you with individual rights. We will help you respond to requests from individuals, using appropriate technical and organisational measures. If we receive a request directly, we will not answer it substantively — we will refer the person to you and tell you within three working days.
Helping you with compliance. We will help you with security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing and what we know.
Records. We keep a record of the processing we carry out on your behalf, and we cooperate with the Commissioner of Data Protection on request. We maintain our registration with the Commissioner and renew it annually.
Sub-processors
You give general written authorisation for us to use sub-processors, subject to this section. The current list, with locations and the data each handles, is published at offpeek.ae/legal/sub-processors.
We give you at least thirty days' notice before adding or replacing a sub-processor, by email to your account contact and by updating the published list.
You can object on reasonable data-protection grounds within that period. We will discuss it in good faith. If it cannot be resolved, you can terminate the affected part of the service without charge and without liability for the unexpired term.
We impose written obligations on every sub-processor that are no less protective than these terms, and we remain fully liable to you for what they do.
No sub-processor may store, process or access health information from outside the United Arab Emirates. Our published list identifies which sub-processors are approved for health information and which are not.
Automated and semi-autonomous systems
The service processes personal data through systems that operate autonomously or semi-autonomously.
For the models we build and run for our own account, we are the deployer and the provider, and we carry the responsibilities that go with that. Where we run a model on your documented instruction, for your benefit and under your direction, we act as operator and you are the deployer. That allocation is separate from, and does not determine, the controller and processor roles above.
As deployer we operate within purposes defined by people, maintain a register of AI processing activities separate from our record of processing, keep documented bias-mitigation measures, maintain a data protection impact assessment, and appoint an Autonomous Systems Officer for as long as the processing is high risk.
We will help you respond to any objection to a decision based solely on automated processing, including by providing what is needed for a human review. We do not rely on any exception where the person is a minor.
Data breaches
We will tell you without undue delay after confirming a personal data breach affecting your data, and in any event within seventy-two hours of confirmation. Where health data is affected, that period is twenty-four hours, so you have time to meet your own regulator's deadline.
We will describe, as far as we know it, what happened, the categories and rough number of people and records affected, the likely consequences, what we have done or propose to do, and a contact point. Where we cannot give it all at once, we will follow up without undue further delay.
We will take reasonable steps to contain and fix it, and we will not make a public statement identifying you without your written consent unless the law requires it.
Notifying the Commissioner and affected individuals is your responsibility as controller, and where relevant your health regulator's requirements apply. We will give you what you reasonably need to do that.
Where data goes
Health information does not leave the United Arab Emirates. We will not store, process, generate, transform, transmit or allow access to it from outside the UAE. Remote access from abroad is a transfer for this purpose.
For other personal data, we transfer outside the DIFC only where the destination is on the Commissioner's list of adequate jurisdictions, or an approved safeguard applies — for us, the standard contractual clauses published by the Commissioner, adopted in full and unamended — or a specific exception applies. We assess and document the destination and the recipient before each category of transfer, and keep that assessment.
You authorise us to enter into those standard contractual clauses with a sub-processor on your behalf where that is needed.
Where a public authority asks us for your personal data, we assess whether the request is valid and proportionate, challenge it where there are reasonable grounds, and tell you before responding unless we are legally prohibited.
Retention, return and deletion
We keep personal data by data type for the periods set out in our Privacy Policy, and no longer than necessary for the purpose.
Termination does not trigger deletion. We keep on retaining under those periods until you ask us to do otherwise or a period expires.
On your written request, at any time, we will either return your personal data in a structured, commonly used, machine-readable format, or delete it — your choice — within thirty days, and certify deletion if you ask.
That does not apply, and we will keep the data, where retention is required by law — including the obligation under UAE law to keep health information for at least twenty-five years from the last health procedure; or to support a tax invoice or accounting record, for seven years; or where it is necessary to establish, exercise or defend legal claims; or as evidence of a consent or opt-out that either of us relies on; or to support a measurement record behind an invoice already issued, for seven years.
Where we keep data on one of those grounds, we isolate it, restrict processing to that purpose, and delete it when the purpose ends.
Backups are purged on the ordinary backup cycle, which can take up to ninety days after deletion from live systems. During that period the data is not available for ordinary processing.
Aggregated, de-identified data is not personal data, is not returned or deleted, and is kept indefinitely.
Audit
We will give you the information you reasonably need to demonstrate compliance, and will allow and contribute to audits, including inspections, by you or an auditor you appoint.
An audit may be carried out once in any twelve-month period, on thirty days' written notice, during business hours, without unreasonable disruption and subject to confidentiality. You bear your own costs. We may satisfy a request by providing a current third-party audit report or certification where that reasonably covers what you asked for.
An additional audit may follow a data breach affecting you, or where a regulator requires it. Audit rights do not extend to our model weights, source code, or any other controller's data.
Security measures
Encryption. TLS 1.2 or above in transit, with modern cipher suites. AES-256 at rest for all databases, object storage and backups. Key management through a managed service with rotation and separation of duties.
Access control. Role-based access on a least-privilege basis, reviewed quarterly for privileged accounts. Unique named accounts — shared credentials are prohibited. Multi-factor authentication for all administrative and remote access. Row-level security so no controller's records are reachable from another's session. Session timeout after no more than fifteen minutes of inactivity on interfaces showing customer records. Access revoked within one working day of a role change or departure. Inactive accounts disabled after forty days.
Logging and monitoring. Audit logging of authentication, authorisation and access to customer records, kept for at least twelve months. Alerting on unusual access patterns and bulk export. Break-glass access to live systems requires approval, is time-limited, and is logged for review.
Application and infrastructure. Signed webhooks and request signing on inbound integrations. Rate limiting and abuse detection on public interfaces. Secrets held in a dedicated store, never in source control. Segregated development, staging and live environments, with live personal data never used in development or testing. Vulnerability scanning, dependency monitoring and a documented patching cadence. Independent penetration testing at least annually, with findings tracked to closure.
Residency. All merchant booking data hosted in a United Arab Emirates region. Health information processed and stored only within the UAE, with access from outside prevented technically rather than by policy alone.
People. Background screening appropriate to the role before access is granted. Written confidentiality undertakings that survive the engagement. Data protection and security training before access and every year after.
Resilience. Automated encrypted backups with periodic restoration testing. Documented business continuity, disaster recovery and incident response plans, reviewed annually.
Liability and general
Liability under these terms is subject to the limits in the agreement, except where our Terms of Service disapply the cap.
An individual may bring a claim directly in the DIFC Courts for material or non-material damage, including distress. Each of us will cover the other for loss arising from our own breach of these terms, to the extent we are responsible for it.
These terms take effect with the agreement and continue for as long as we process personal data on your behalf. They are governed by DIFC law, and the dispute resolution provisions of the agreement apply.
We may amend these terms on thirty days' notice where a change in law or regulatory guidance requires it, or where the amendment does not materially reduce the protections given.
Data protection questions: dpo@offpeek.ae