Seemi Cloud Services Agreement

Version: Draft 1.2
Effective date: 31st October 2025
Last updated: 31st October 2025

Agreement summary

This Seemi Cloud Services Agreement, including all schedules incorporated into it, governs every Seemi Cloud tenant and every service, resource group, component, storage account, backup, feature and support service used through that tenant.

The Agreement is intended for:

• Businesses, organisations and public-sector entities.
• Sole traders, freelancers and independent professionals.
• Individual developers and other adult consumers.
• Customers located in the UAE and other supported countries.

Each tenant requires separate acceptance. By creating a tenant, the accepting person confirms that they are at least 18 years old, have supplied accurate information, and either contract personally or have authority to bind the named organisation.

Mandatory consumer and statutory rights remain unaffected where they cannot lawfully be excluded.

Part A: Core service terms

1. Parties and contact information

1.1 Seemi

The Services are provided by:

Seemi Technology Group - F.Z.C
Licence number: 47760
Registered office: B.C. 1302265, Ajman Free Zone C1 Building, Ajman Free Zone, Ajman, United Arab Emirates
Makani / postal code: 4442612247
Website: https://seemi.net
Cloud portal: https://cloud.seemi.net

“Seemi Cloud” is a product and service of Seemi Technology Group - F.Z.C. In this Agreement, “Seemi,” “we,” “us” and “our” refer to Seemi Technology Group - F.Z.C.

1.2 Contact channels

• Customer support and billing: cloud.support@seemi.net
• Legal, privacy, abuse and government requests: cloud.legal@seemi.net
• Formal notices to Seemi: cloud.legal@seemi.net, with a copy to the registered office where physical delivery is required by law.

1.3 Customer

“Customer,” “you” and “your” mean the individual or legal entity identified during tenant creation. If an individual creates a tenant for an organisation, the organisation is the Customer and the individual represents that they have authority to bind it.

2. Definitions

• Agreement: This document, its schedules, the applicable SKU description, pricing displayed before provisioning, and any written tenant-specific terms approved by Seemi.
• Applicable Data Protection Law: Any privacy, data-protection or data-security law applicable to Seemi’s processing of Personal Data under the Agreement, including, where applicable, the UAE Personal Data Protection Law, the GDPR, the UK GDPR and applicable United States state privacy laws.
• Authorised User: A person invited or permitted by the Customer to access a Tenant, Resource Group or Component.
• Component: A billable or non-billable deployed resource, including a container, application, database, data volume, storage account, bucket, backup or related service.
• Consumer: An individual obtaining Services for personal purposes, and any other person treated as a consumer under mandatory applicable law.
• Customer Content: All applications, container images, source code, databases, files, objects, secrets, configurations, logs, prompts, outputs or other information supplied, stored, transmitted or generated by or for the Customer through the Services. Customer Content does not include Account Data independently collected and controlled by Seemi for account administration, billing, fraud prevention, security or legal compliance.
• Customer Personal Data: Personal Data contained in Customer Content and processed by Seemi on behalf of the Customer.
• Data Centre Region: The geographic location selected or assigned for a Component, storage service or backup.
• Data Protection Addendum or DPA: The data-processing terms in Part C and any applicable privacy or international-transfer schedule incorporated into the Agreement.
• Free SKU: A no-charge Service identified as free, trial, testing, development or evaluation use.
• GDPR: Regulation (EU) 2016/679, including its implementation under applicable European Union or European Economic Area law.
• L1, L2 and L3: Seemi Cloud access levels. The definitive permissions associated with each access level are described in the then-current permission matrix made available through the portal or documentation.
• Personal Data: Information relating to an identified or identifiable natural person, and any equivalent term such as personal information under Applicable Data Protection Law.
• Personal Data Breach: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise processed.
• Paid SKU: A Service for which usage or recurring charges apply.
• Processing: Any operation performed on Personal Data, whether or not by automated means, including collection, access, storage, transmission, retrieval, use, disclosure, restriction, deletion or destruction. “Process,” “processed” and “processing” have corresponding meanings.
• Resource Group: A logical grouping of Components within a Tenant and an access-control boundary.
• Restricted Data: Data subject to specific legal, regulatory, contractual or industry requirements beyond the standard controls expressly included in the selected SKU, including regulated health data, payment-card data, biometric identifiers, government-classified data and data subject to mandatory localisation requirements.
• Security Measures: The technical and organisational measures described in Section 14 and the applicable Technical and Organisational Measures Schedule.
• Service: Any Seemi Cloud functionality made available under this Agreement.
• SKU: A published package or billing unit with stated specifications, limits, features and pricing.
• Subprocessor: A third party engaged by Seemi to process Customer Personal Data on behalf of the Customer.
• Tenant: A separately accepted, administered and invoiced Seemi Cloud account boundary.
• UAE Personal Data Protection Law: UAE Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data, as amended or replaced.
• UK GDPR: The GDPR as incorporated into the law of the United Kingdom, as amended or replaced.

3. Eligibility and customer information

3.1 Eligibility

A Customer may create and use a tenant only if:

• The accepting individual is at least 18 years old and has legal capacity to contract.
• The Customer is not subject to applicable sanctions or restrictions that prevent Seemi, its bank, payment processor or infrastructure provider from supplying the Services.
• The Customer is located in a country or territory supported by Seemi.
• The Customer provides accurate, complete and non-misleading registration, identity, organisation, contact and billing information.
• The Customer accepts this Agreement separately for each tenant.

3.2 Business customers

A person accepting for an organisation represents that:

• The organisation legally exists or is a valid sole trade or professional undertaking.
• The person has authority to bind the organisation.
• The organisation’s legal name, registration country, registration or licence number, registered address and tax information are accurate.

3.3 Individual customers

An individual acting personally must:

• Use their own legal identity and accurate contact and billing details.
• Confirm they are at least 18 years old.
• Not create or administer a tenant for a child.
• Comply with all laws applicable to their use of the Services.

3.4 Verification

Seemi relies on customer-supplied information but may request identity, business, payment, beneficial-ownership, authority or source-of-funds documentation where reasonably required for legal compliance, fraud prevention, payment risk, abuse investigation or security.

Seemi may reject, restrict, suspend or terminate a tenant if information is false, incomplete, outdated, unverifiable or reasonably suspected to be misleading. Self-certification does not remove Seemi’s obligations under mandatory law.

3.5 Multiple tenants

A Customer may create multiple tenants. Each tenant:

• Requires separate acceptance of the Agreement.
• Is separately administered and invoiced.
• Has its own users, Resource Groups, Components, usage and billing records.
• May have tenant-specific payment or commercial terms approved by Seemi.

3.6 Customer and Agency Use; Resale Restrictions

Customers may use Seemi Cloud to host and operate websites, applications and other lawful workloads for themselves or for their clients. Developers, consultants and agencies may administer Components for clients, provided that:

• The Customer remains responsible for all charges, users, Customer Content and compliance associated with the tenant in-line with this agreement.
• The Customer has authority from its client to host and administer the relevant workload and data.
• The Customer does not represent that the underlying Seemi Cloud infrastructure is owned or operated by the Customer.
• The Customer does not grant its client direct contractual rights against Seemi.

Without Seemi’s prior written approval, the Customer must not:

• Resell, sublicense or white-label Seemi Cloud infrastructure, storage, SKUs, credits or tenant access as a standalone cloud or hosting service.
• Create Components primarily for onward resale of raw compute or storage capacity.
• Present itself as an authorised Seemi Cloud reseller, distributor or partner.
• Transfer promotional, free or service credits to another customer or tenant.

A Customer wishing to operate as a reseller or managed hosting provider may request approval through cloud.support@seemi.net. Seemi may require separate reseller terms, verification procedures, support responsibilities, minimum commitments or revised pricing.

Ordinary use by a developer, consultant or agency to build, host and manage a client’s application is not prohibited resale where the Customer remains fully responsible under this Agreement.

4. Accounts, authentication and access control

4.1 Authentication

Seemi Cloud uses supported third-party single sign-on services, presently including Microsoft and Google. Password-based login is not provided by Seemi. The Customer remains responsible for:

• Protecting its identity-provider accounts and recovery methods.
• Configuring strong authentication and multifactor authentication where available.
• Removing access promptly when a user no longer requires it.
• Reviewing tenant and Resource Group permissions.

4.2 Customer-appointed users

The Customer may nominate Authorised Users and grant L1, L2 or L3 rights at supported levels of the Tenant, Resource Group and Component hierarchy. The Customer is responsible for all authorised actions taken through its tenant, including actions by invited users.

A user with L3 rights over a Resource Group may be able to create, modify, stop, restore or delete billable Components within that Resource Group. Such actions bind the Customer.

4.3 Emergency and support access

Seemi may disable access, restrict a user, apply forward authentication, isolate a Component, or obtain administrative access to a resource where reasonably necessary to:

• Provide requested support.
• Protect the platform, the Customer, other customers or third parties.
• Investigate suspected fraud, security incidents or Agreement violations.
• Respond to a credible abuse report.
• Comply with law or a valid direction from a competent authority.
• Restore, migrate, maintain or troubleshoot infrastructure.

Where practicable and lawful, access will be limited to what is reasonably necessary, performed by authorised personnel and logged.

4.4 Definitive permission matrix

Descriptions of L1, L2 and L3 access in this Agreement are summaries only. The definitive permission matrix made available through the portal or documentation identifies the actions permitted at each access level. Seemi will not materially expand an access level in a way that increases security risk without reasonable notice, except where an urgent change is required to correct a security issue or comply with law.

The Customer is responsible for reviewing the permission matrix, assigning the least level of access reasonably required, and regularly reviewing Authorised User access.

5. Services and shared responsibility

5.1 Services available

Seemi may provide:

• Hosting of Docker-containerised applications.
• Deployment of supported open-source or preconfigured applications.
• Hosting of Customer-provided container images made available through registries or credentials accessible to Seemi service accounts.
• Persistent storage and data volumes.
• S3-compatible object storage.
• Automated backup, snapshot, point-in-time recovery and restoration features where identified for a SKU.
• Image update, deployment, deletion, migration and other platform automation.
• Optional Cloudflare proxying, caching and DDoS-related features.
• Support and managed-service features stated for the applicable SKU.

5.2 Customer-controlled operations

Unless a SKU expressly states otherwise, deployment, update, backup, restore, scaling, stopping and deletion actions are initiated by the Customer through the portal. Automation by Seemi does not transfer responsibility for the Customer’s application or data to Seemi.

5.3 Seemi responsibilities

Subject to the applicable SKU, Seemi is responsible for:

• Operating the Seemi Cloud control plane and orchestration systems.
• Administering infrastructure nodes used by Seemi.
• Applying reasonable platform access controls and tenant isolation.
• Operating platform-level monitoring and maintenance.
• Applying host and platform updates within Seemi’s operational control.
• Running purchased or included backup processes as described for the SKU.
• Maintaining billing and usage records.
• Responding to support, abuse and security matters according to this Agreement.

5.4 Customer responsibilities

The Customer is responsible for:

• Selecting a suitable SKU and Data Centre Region.
• The legality, security, accuracy and operation of Customer Content.
• Container images, application code, dependencies and licences.
• Application and database configuration.
• Secrets, tokens, certificates, credentials and user access.
• Application-level authentication and authorisation.
• Exposed application functionality and network traffic.
• Testing backups and restores and retaining independent copies of critical data.
• Determining regulatory, data-residency and localisation requirements.
• Obtaining all permissions, notices, consents and lawful bases required for Customer Content.
• Applying application-level updates unless expressly included in the SKU.

5.5 Ports and network use

Customers may use only ports and exposure methods supported by the applicable Seemi container and platform configuration. Seemi does not generally prohibit outbound traffic by port, but all traffic and activity must comply with this Agreement and applicable law.

5.6 Resource limits

CPU, memory, disk, network, request, storage, retention and other limits are stated for each SKU or within the portal. Seemi may enforce these limits technically. The Customer must not circumvent or impair shared infrastructure.

5.7 Restricted and regulated data

The Services are designed for general-purpose lawful workloads unless a SKU or written agreement expressly states otherwise. The Customer must not use the Services for Restricted Data where applicable law, a regulator, an industry standard or the Customer’s own contractual obligations require controls, certifications, localisation, contractual terms or approvals that the selected SKU does not expressly provide.

Without Seemi’s prior written approval, the Customer must not use the Services to store or process:

• Protected or regulated health information requiring healthcare-specific hosting commitments.
• Government-classified information or information subject to government-only hosting requirements.
• Biometric templates used for unique identification at material scale.
• Data whose storage or remote access outside a specified jurisdiction is prohibited.
• Workloads whose failure could reasonably result in death, serious personal injury or material physical or environmental damage.

Approval to host Restricted Data may require an eligible SKU, additional Security Measures, a separate written agreement and additional charges. Seemi’s acceptance of a workload does not constitute legal or regulatory advice or confirmation that the Customer’s use is compliant.

6. Component ordering, pricing and changes

6.1 Ordering Components

A separate signed Order Form is not normally required. Before provisioning, the portal will display or make available the material commercial terms, including where applicable:

• SKU and service description.
• CPU, memory, storage and other specifications.
• Data Centre Region.
• Billing unit and current price.
• Currency.
• Backup inclusion or options.
• Applicable discount, promotion or free period.
• Estimated cost through the pricing calculator.

Creating, resizing, restoring, duplicating or otherwise activating a Component constitutes an order under this Agreement and acceptance of the displayed terms by the Customer.

6.2 Usage records

Seemi may retain an electronic record of the SKU, specifications, price, currency, region, discount, timestamp, Authorised User and action associated with a Component. Portal usage and statement records form evidence of consumption, subject to correction of demonstrated errors.

6.3 Billing granularity

Unless a SKU states otherwise:

• Usage is measured with daily billing as the minimum billing granularity.
• A stopped but undeleted Component remains chargeable because resources, storage, configuration or reserved capacity may remain allocated.
• Billing for a Component stops after the Component is successfully deleted, except for usage already incurred, separately retained data, backups, storage, reserved commitments or other surviving resources.

6.4 Pricing changes

Seemi may change prices prospectively. For an existing paid Component, Seemi will normally provide at least 30 days’ notice of a material price increase unless the change results from tax, law, currency, urgent supplier pricing, security requirements or circumstances outside Seemi’s reasonable control. The Customer may delete the affected Component before the new price takes effect.

6.5 SKU changes and discontinuation

Seemi may modify or discontinue a SKU. Seemi will normally provide reasonable notice and, where practicable, offer a replacement or migration path. Urgent changes may be made without advance notice where required for security, law, supplier availability or platform stability.

7. Billing, invoicing and payment

7.1 Currency and taxes

The default invoice currency is AED unless another currency is expressly supported. Prices exclude taxes unless stated otherwise.

Seemi is not currently registered for UAE VAT because it has not reached the applicable registration threshold. If Seemi becomes VAT registered or another tax becomes applicable, Seemi may add legally required taxes to invoices from the applicable date.

7.2 Statements and billed lines

Customers may view usage and billed lines in their statement, normally through the previous day. Customers may raise a billing query or dispute before the monthly invoice is issued.

7.3 Monthly invoices

Unless tenant-specific terms state otherwise:

• Usage is invoiced monthly in arrears.
• The invoice is normally issued on the first day of the month.
• Payment is due by the fifth calendar day of that month.
• Tenant-specific payment periods may be extended by written agreement.
• Undisputed amounts remain payable by the due date.

7.4 Invoice disputes

A Customer should submit a formal invoice dispute within 15 days after the invoice date and identify the disputed line, reason and supporting information. Seemi may investigate a later-reported billing error, and mandatory consumer rights are not lost solely because that period expired.

7.5 Corrections and credit notes

Seemi may correct billing records as follows:

• Uninvoiced errors may be corrected directly in the statement.
• Invoiced overcharges may be corrected by credit note, statement adjustment, account credit or refund.
• Underbilling caused by a genuine metering or administrative error may be corrected in a later statement or invoice, subject to applicable law and reasonable notice.

7.6 Payment methods

Seemi uses Stripe-hosted payment interfaces. Customers may save or delete payment methods through supported flows. Where authorised, Seemi may attempt off-session collection of amounts due.

Seemi does not store full payment-card data. Stripe provides Seemi with limited payment identifiers, card brand, expiry information, status, billing metadata and transaction records.

7.7 Failed and late payment

If payment is not received when due, Seemi may:

• Retry an authorised payment method.
• Send reminders.
• Restrict creation or modification of Components.
• Suspend access to Components, Resource Groups or the tenant.
• Retain amounts owed and recover reasonable collection costs where lawful.
• Terminate Services and delete data under Section 20.

Where reasonably practicable, Seemi will provide notice before non-urgent suspension.

8. Refunds, credits and promotions

8.1 Billing corrections

Seemi may issue a credit or refund where:

• Seemi billed an incorrect amount.
• A duplicate or erroneous charge occurred.
• A billed Service was unavailable for qualifying periods.
• Seemi determines that exceptional circumstances justify an adjustment.
• Applicable law requires it.

8.2 Method of correction

Seemi will normally correct errors through a future statement adjustment or account credit. If the Customer reasonably requests a refund, or law requires one, Seemi may return an eligible amount to the original payment method where technically possible.

8.3 Credits

Unless law requires otherwise:

• Credits are applied to future Seemi Cloud charges.
• Credits have no cash value and are non-transferable between tenants.
• Credits may be allocated to the affected tenant only.
• Promotional and Free SKU credits are non-refundable.
• Seemi may apply a reasonable expiry period disclosed when the credit is issued.

8.4 Discounts and promotions

Discounts may apply to particular SKUs, regions, periods or customers. Unless stated otherwise, a discount ends automatically at the end of its stated period and normal pricing then applies.

Part B: Acceptable use, safety and legal process

9. Acceptable Use Policy

9.1 General requirement

The Customer must ensure that its use is lawful in:

• The UAE.
• The Customer’s jurisdiction.
• The Data Centre Region and any relevant processing jurisdiction.
• Jurisdictions in which the Customer offers its application or services.

Where these rules differ, the Customer must comply with all applicable requirements.

9.2 Prohibited activity

The Customer must not use Seemi Cloud to create, host, transmit, facilitate or promote:

• Malware, ransomware, botnets, credential theft or malicious code.
• Phishing, fraud, deception, impersonation or unauthorised financial activity.
• Unauthorised access, hacking, scanning, interception or disruption.
• Spam or abusive bulk communications.
• Child exploitation or abuse material.
• Terrorism, violent extremist activity, trafficking or unlawful fundraising.
• Illegal marketplaces or unlawful controlled goods or services.
• Content that unlawfully infringes copyright, trademarks, privacy, confidentiality or other rights.
• Unlawful disclosure or processing of personal data.
• Sanctions evasion, money laundering or prohibited transactions.
• Attacks or activity intended to exhaust or disrupt Seemi, supplier or third-party infrastructure.
• Deliberate circumvention of technical limits or security controls.
• Any other content or activity prohibited by applicable law.

9.3 Lawful workloads

Seemi does not intend to prohibit a workload solely because it is resource-intensive or unconventional. such workloads are permitted only where:

• The applicable SKU can support them.
• They are lawful in every relevant jurisdiction.
• They do not violate third-party rights or supplier rules.
• They do not threaten platform security, stability or reputation.
• Any necessary prior approval has been obtained.

9.4 Penetration testing and security research

Penetration testing, scanning or security evaluation requires prior written alignment with Seemi. Approved testing must:

• Be limited to authorised systems and scope.
• Avoid production Customer Content unless specifically authorised.
• Avoid service disruption or data access.
• Follow agreed timing, source addresses and notification procedures.

Seemi may support constructive testing on designated test systems.

9.5 Resource controls

Seemi may rate limit, isolate, throttle or restrict a Component where usage materially threatens security, shared capacity, network reputation, supplier relationships or other customers.

9.6 Restricted container capabilities

Unless expressly enabled by the applicable SKU or approved by Seemi in writing, the Customer must not deploy or attempt to deploy containers using:

• Privileged container mode.
• Host network, host process ID or host inter-process communication namespaces.
• Direct access to a container-runtime or Docker socket.
• Host-path mounts outside paths specifically assigned to the Component.
• Kernel-module loading or modification of the host kernel.
• Nested virtualisation.
• Circumvention of CPU, memory, storage, network or security limits.
• Public proxy, exit-node, anonymisation-relay, cryptomining, mass-scanning or similar high-abuse functionality.

Seemi may block, isolate or remove an unsupported capability where reasonably necessary to protect the platform, suppliers, other customers or third parties.

10. Abuse reports and takedown process

10.1 Reporting

Abuse, infringement and takedown requests must be sent to cloud.legal@seemi.net and should include:

• The complainant’s legal name and contact information.
• Authority to act, if represented by another person.
• The exact hostname, URL, IP address, bucket, Component or other identifier.
• A clear description of the alleged violation.
• The applicable legal or rights basis.
• Supporting evidence.
• A good-faith declaration that the report is accurate.
• Any urgency, safety or evidence-preservation considerations.

Anonymous or incomplete reports may be reviewed but may receive lower priority unless they indicate serious or imminent harm.

10.2 Human review

Seemi will use human review for material abuse and takedown decisions. Seemi may:

• Validate the identity and authority of the complainant.
• Review available technical and account information.
• Seek clarification or additional evidence.
• Notify the Customer and request a response.
• Restrict public access through forward authentication.
• Isolate, stop or suspend the affected Component.
• Preserve relevant records.
• Reject unsupported, unauthentic or overbroad requests.

10.3 Urgent intervention

Seemi may act without prior notice where it reasonably believes there is:

• An imminent threat to people, systems or data.
• Clearly unlawful or seriously harmful activity.
• Active malware, phishing, fraud or attack traffic.
• A binding legal direction.
• A serious violation of supplier requirements.
• A material risk to Seemi or shared infrastructure.

Where feasible, Seemi will target the affected Component rather than the entire tenant.

10.4 Customer response and appeal

For non-urgent cases, Seemi may provide the Customer with a reasonable opportunity to respond, normally up to five business days unless the issue requires faster action. A Customer may submit evidence, remediation details or a counter-notice to cloud.legal@seemi.net.

10.5 No automatic deletion or disclosure

A takedown allegation alone does not automatically authorise deletion or disclosure of Customer Content. Seemi may restrict availability while evaluating the matter. Deletion or disclosure to an external party will occur only after appropriate human, technical and legal evaluation and where authorised by the Customer, required to operate the Service, or required by valid legal process.

11. Government, law-enforcement and legal requests

11.1 Submission and review

Authorities should send requests to cloud.legal@seemi.net. Seemi will seek to verify:

• The requesting authority and representative.
• Jurisdiction and legal basis.
• Authenticity and validity.
• Scope and specificity.
• Whether the request is binding on Seemi.
• Whether notification is legally permitted.

11.2 UAE legal process

Seemi will comply with binding obligations under UAE law and valid directions of competent UAE authorities. Seemi may seek legal advice, clarification, narrowing or review where a request appears unclear, excessive or defective.

11.3 Foreign requests

A foreign request that is not directly binding on Seemi may be evaluated for credible abuse or immediate safety concerns. Where allegations are not independently supported and the request is not binding, Seemi may require the requesting authority to use applicable formal legal channels capable of producing a valid request enforceable in the UAE.

11.4 Data disclosure

Where disclosure is legally required, Seemi will seek to:

• Disclose only data within the valid scope.
• Use human approval.
• Maintain a record of the decision.
• Notify the Customer unless prohibited by law or likely to create serious harm.
• Preserve confidentiality and security during transfer.

Seemi does not promise that a court order is the only valid form of legal authority.

11.5 Preservation

Seemi may preserve identified data for a reasonable period where required by valid legal process or reasonably necessary to protect rights, investigate fraud, resolve a dispute or prevent deletion while legal validity is assessed.

12. Restricted jurisdictions and sanctioned parties

Seemi may refuse, restrict or terminate Services where providing them would expose Seemi, its bank, payment processor or supplier to sanctions, export controls, prohibited-party restrictions or material legal risk.

Restrictions may include countries or territories subject to applicable UAE or United Nations measures and any restriction binding on Seemi’s financial or infrastructure providers. The applicable restrictions may change and may be broader or narrower than a country-wide prohibition.

The Customer represents that it is not using the Services for or on behalf of a prohibited person, entity, transaction or destination.

Part C: Privacy and data processing

13. Privacy notice for Seemi account data

13.1 Scope and Seemi’s role

This Section applies to Personal Data for which Seemi determines the purposes and means of processing, including account, billing, authentication, support, security, abuse-prevention, legal and business-administration information. For that processing, Seemi acts as an independent controller or equivalent responsible business under Applicable Data Protection Law.

Customer Personal Data processed by Seemi on the Customer’s behalf is governed by Section 14.

13.2 Information collected

Seemi may collect and process:

• Legal name, organisation name, registration details and authority information.
• Email addresses, billing address and tax information.
• Tenant, Resource Group, Component and Authorised User identifiers.
• Microsoft or Google identity identifiers and authentication events.
• IP addresses, browser, device, login and audit information.
• Usage, metering, performance, network and security metadata.
• Support, billing, abuse and legal communications.
• Stripe payment references and transaction metadata, but not full payment-card numbers handled through Stripe-hosted interfaces.
• Customer Content accessed during authorised support, restoration, security, abuse or legal review.

13.3 Purposes and legal grounds

Seemi may process account and operational Personal Data to:

• Create and administer Tenants and Authorised Users.
• Authenticate users and enforce permissions.
• Provision, meter, bill, maintain and support the Services.
• Process payments, credits and refunds.
• Maintain platform security and availability.
• Prevent, detect and investigate fraud, abuse and security incidents.
• Send essential operational, billing, contractual, security and legal notices.
• Maintain legally required financial, tax, corporate and transaction records.
• Establish, exercise or defend legal claims.
• Comply with applicable law and valid legal process.
• Improve reliability, capacity planning and service operation using information limited to what is reasonably necessary for those purposes.

Where required by Applicable Data Protection Law, Seemi will identify and rely on an appropriate legal ground, which may include performance of a contract, compliance with a legal obligation, consent, protection of legal rights, or a legitimate or legally recognised operational interest that is not overridden by the rights of the affected individual.

Optional promotional communications will be distinguished from essential service communications. An individual may opt out of optional promotional communications using the method provided in the communication or by contacting Seemi.

13.4 No sale or unrelated advertising use

Seemi does not sell account Personal Data. Seemi does not use account Personal Data for third-party behavioural advertising, data-broker activities or unrelated third-party marketing.

Seemi may market its own Services to business contacts where permitted by law, subject to applicable notice, consent and opt-out requirements. Seemi will not use UAE Consumer data for promotional or marketing purposes where prohibited by applicable UAE consumer law.

13.5 Data minimisation and accuracy

Seemi will seek to limit Personal Data to what is reasonably required for the stated purposes. Customers and Authorised Users must keep their account and contact information accurate and current.

13.6 Individual rights and requests

Privacy requests may be sent to cloud.legal@seemi.net. Subject to Applicable Data Protection Law, an individual may request access, correction, deletion, restriction, objection, portability, withdrawal of consent, review of certain automated decisions, or any other available right.

Seemi may verify the identity and authority of the requester before acting. Seemi may decline or limit a request where permitted or required by law and will provide an explanation where legally required.

A request concerning Customer Personal Data should ordinarily be directed to the relevant Customer, which determines how that data is used. Seemi will provide assistance as described in Section 14.

13.7 Retention

Seemi will retain Personal Data only for as long as reasonably necessary for the relevant purpose, including:

• Active account and service administration.
• Billing, tax, accounting and transaction-record obligations.
• Security, fraud and abuse prevention.
• Dispute resolution and applicable legal limitation periods.
• Backup rotation and technical deletion cycles.
• Compliance with valid preservation or legal obligations.

An account-deletion request does not require deletion of information that Seemi must retain by law or reasonably requires to prevent fraud, prove transactions, establish legal rights or protect platform security. Retained information will remain protected and its use limited to the applicable retention purpose.

13.8 International processing

Seemi and its providers may process limited account, support, security and operational information outside the region selected for Customer Content. Customer Content is ordinarily stored in the selected or disclosed region, subject to enabled backups, replication, support access, migration, legal requirements and disclosed Subprocessors.

Where Applicable Data Protection Law requires a transfer mechanism, Seemi will use the applicable contractual or legally recognised safeguard described in Section 14 or the relevant regional privacy schedule.

13.9 Privacy contact and data-protection officer

Privacy questions and requests may be sent to cloud.legal@seemi.net. Seemi will appoint a data-protection officer where required by Applicable Data Protection Law and will publish the relevant contact details.

14. Data Processing Agreement

14.1 Scope and roles

This Section forms a binding Data Processing Addendum between the Customer and Seemi and applies when Seemi processes Customer Personal Data on behalf of the Customer.

For Customer Personal Data:

• The Customer acts as controller or as a processor acting on another controller’s instructions.
• Seemi acts as processor or Subprocessor on the Customer’s behalf.
• Each party will comply with the obligations applicable to its role under Applicable Data Protection Law.

For Seemi’s own account administration, billing, fraud prevention, security, legal compliance and business records, Seemi may act as an independent controller as described in Section 13.

Where the GDPR applies, this Section is intended to satisfy the processor-contract requirements of Article 28 GDPR. Equivalent terms will be interpreted to satisfy corresponding requirements under other Applicable Data Protection Law.

14.2 Documented instructions

The Customer instructs Seemi to process Customer Personal Data only as reasonably necessary to:

• Provide, secure, maintain, meter and support the Services.
• Host, transmit, store, back up, restore and delete Customer Content.
• Perform Customer-requested deployment, migration, support and administrative actions.
• Prevent, detect and investigate fraud, abuse and security incidents.
• Comply with the Agreement and the Customer’s documented use of Service controls.
• Comply with applicable law or valid legal process.

The Agreement, the Customer’s configuration and use of the Services, support requests, and other written instructions accepted by Seemi constitute documented instructions.

Seemi will not process Customer Personal Data for an independent purpose except where required by applicable law. If legally permitted, Seemi will inform the Customer before carrying out legally required processing.

If Seemi reasonably believes that an instruction infringes Applicable Data Protection Law, Seemi will inform the Customer without undue delay unless prohibited by law. Seemi may suspend the affected processing until the parties resolve the concern.

14.3 Processing details

• Subject matter: Hosting, transmission, storage, backup, recovery, security, support and deletion of Customer Content.
• Duration: The lifetime of the affected Tenant, Component or Service, plus applicable backup-expiry, export, retention and lawful-preservation periods.
• Nature of processing: Collection, recording, organisation, storage, retrieval, transmission, access, encryption, backup, restoration, restriction, migration, deletion and destruction.
• Purposes: Supplying, securing, maintaining, supporting and terminating the Services according to the Customer’s documented instructions.
• Categories of data subjects: Customer personnel, contractors, users, consumers, visitors, suppliers and other individuals whose Personal Data the Customer submits to the Services.
• Types of Personal Data: Identity, contact, account, technical, employment, transaction, communication, application, content and other data selected and controlled by the Customer.
• Sensitive data: Seemi does not require the Customer to submit sensitive or Restricted Data. If the Customer submits such data, the Customer is responsible for ensuring that the selected SKU, region, safeguards, notices, permissions and legal grounds are appropriate.
• Customer rights and obligations: The Customer determines the purposes and essential means of processing, issues lawful instructions, responds to data-subject requests, provides required notices, selects an appropriate region and SKU, configures access and retention, and meets its obligations as controller or processor.

14.4 Customer obligations

The Customer represents and warrants that:

• It has a lawful basis, authority and documented instructions for Customer Personal Data.
• It has provided required privacy notices and obtained any required permissions or consents.
• Its instructions comply with Applicable Data Protection Law.
• It will not instruct Seemi to process Personal Data in a manner that violates applicable law.
• It will not use the Services where a law, regulator or contract requires controls, certifications, localisation or terms that the selected SKU does not expressly provide.
• It will appropriately configure authentication, permissions, encryption, network access, backup and retention.
• If the Customer acts as a processor, its instructions and appointment of Seemi as a Subprocessor are authorised by the relevant controller.

14.5 Confidentiality and authorised access

Seemi will limit access to Customer Personal Data to authorised personnel and contractors who require access for an authorised purpose. Persons authorised to access Customer Personal Data will be subject to contractual or legal confidentiality obligations.

Access may occur only as reasonably necessary for service provision, support, maintenance, restoration, security, abuse investigation, migration or legal compliance. Where practicable, production access will be approved, time-limited and logged.

14.6 Security Measures

Seemi will implement and maintain reasonable technical and organisational measures appropriate to the nature of the Services and the risk to Customer Personal Data. These measures will be described in the applicable Technical and Organisational Measures Schedule and may include:

• Identity and role-based access controls.
• Multifactor authentication for privileged Seemi administrative access where supported.
• Restrictions and logging for production administrative access.
• Tenant and Resource Group authorisation controls.
• Encryption for supported internet-facing connections in transit.
• Provider-side or backup encryption where described for the applicable SKU.
• Host, platform and orchestration hardening and patching within Seemi’s operational control.
• Vulnerability-management and incident-response processes.
• Operational monitoring and security logging.
• Backup, restoration and business-continuity capabilities described for the applicable SKU.
• Personnel confidentiality and access-revocation processes.
• Periodic assessment of material Security Measures.

Internet-facing TLS may terminate at a reverse proxy or load balancer. Traffic within a host or trusted internal service boundary may not always use TLS. Customers requiring application-layer or end-to-end encryption must implement and manage it within their applications unless the applicable SKU expressly provides it.

Seemi may update Security Measures to reflect technical development, provided that Seemi does not materially reduce the overall security of the affected Service during a subscription period without a legitimate security, legal, supplier or operational reason.

14.7 Personal Data Breaches

Seemi will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. Seemi may provide information in phases as its investigation progresses.

To the extent known and legally permitted, notification may include:

• The nature of the Personal Data Breach.
• The affected systems, data categories and approximate scope.
• Known or reasonably anticipated consequences.
• Measures taken or proposed to contain, investigate and remediate the incident.
• A contact point for follow-up.

Seemi will take reasonable steps to contain, investigate and mitigate the Personal Data Breach and will provide reasonable cooperation required by Applicable Data Protection Law. Notification does not constitute an admission of fault or liability.

The Customer is responsible for determining whether notification to a regulator, data subject or other party is required from the Customer and for making that notification, unless applicable law directly requires Seemi to do so.

14.8 Data-subject requests

If Seemi receives a request relating primarily to Customer Personal Data, Seemi may direct the requester to the Customer unless prohibited by law. Taking into account the nature of processing, Seemi will provide reasonable assistance through available Service functionality and appropriate technical or organisational measures to help the Customer respond to requests under Applicable Data Protection Law.

If assistance requires material bespoke work beyond standard Service functionality, Seemi may charge reasonable fees where permitted by law and agreed in advance.

14.9 Compliance, impact assessments and regulatory cooperation

Taking into account the nature of processing and information available to Seemi, Seemi will provide reasonable assistance with:

• Security-of-processing obligations.
• Personal Data Breach assessment and notification.
• Data-protection impact assessments.
• Prior consultation with a competent supervisory authority.
• Information reasonably necessary to demonstrate Seemi’s compliance with this Section.

Seemi will cooperate with a competent data-protection authority where required by applicable law.

14.10 Audits

Seemi may satisfy routine compliance requests using current policies, questionnaires, architecture descriptions, Security Measure summaries, available independent reports and relevant supplier documentation.

Where those materials are proven insufficient to demonstrate compliance with a mandatory obligation, the Customer may request an additional audit. An additional audit must:

• Be reasonably necessary and proportionate to the relevant risk.
• Normally occur no more than once in a 12-month period, unless required by law or following a material Personal Data Breach.
• Be conducted on reasonable prior written notice during normal working hours.
• Use an independent qualified auditor subject to confidentiality obligations.
• Avoid access to other customers’ information, security-sensitive systems and supplier-confidential information.
• Minimise disruption to Seemi and its providers.
• Be conducted remotely where remote review can reasonably satisfy the audit objective.

The Customer will bear reasonable audit costs unless the audit identifies a material breach by Seemi of this Section or Applicable Data Protection Law, or mandatory law requires otherwise.

Direct access to shared infrastructure, source code, vulnerability details, credentials, data-centre premises or systems controlled by a third-party provider is not required where alternative evidence reasonably demonstrates compliance or access would create a material security or confidentiality risk.

14.11 Subprocessors

The Customer grants Seemi general written authorisation to engage the Subprocessors listed in Section 15 or in Seemi’s published Subprocessor schedule.

Seemi will:

• Use a written agreement requiring each Subprocessor to protect Customer Personal Data using obligations materially equivalent to those applicable to Seemi for the Subprocessor’s processing.
• Limit the Subprocessor’s processing to the services it performs for Seemi and the Customer.
• Remain responsible to the Customer for the Subprocessor’s performance of its applicable data-protection obligations, subject to the liability provisions of the Agreement.
• Maintain an updated Subprocessor schedule identifying the provider, purpose and relevant processing location or region.
• Provide notice of a material new or replacement Subprocessor where required by Applicable Data Protection Law.

A Customer may object to a material new Subprocessor on reasonable, substantiated data-protection grounds by notifying cloud.legal@seemi.net within the objection period stated in the notice. Seemi will consider reasonable alternatives. If no commercially reasonable alternative is available, either party may discontinue the affected Service before the Subprocessor begins processing Customer Personal Data. Discontinuation does not relieve the Customer of charges already incurred.

14.12 Return, export and deletion

During an active Service, the Customer may retrieve or export Customer Content using available Service functionality.

Upon termination of the relevant Service and at the Customer’s choice, Seemi will delete or make available for return Customer Personal Data where technically feasible, subject to:

• The Customer submitting its instruction before the applicable deletion deadline.
• Available export functionality and reasonable technical limitations.
• Payment of agreed charges for material bespoke export work.
• Legal-retention and preservation obligations.

After the applicable export or retention period, Seemi will delete or render inaccessible Customer Personal Data in active systems according to its ordinary deletion process. Residual copies may remain in access-restricted backups until expiry or overwrite through ordinary backup cycles. During that period, Seemi will not use residual data for another purpose and will continue to protect it under this Section.

14.13 International transfers

The Customer authorises Seemi and its Subprocessors to process Customer Personal Data in the regions and locations identified in the Agreement, the portal, the applicable SKU and the Subprocessor schedule.

Where a transfer of Customer Personal Data requires a transfer mechanism under Applicable Data Protection Law, the parties will use the applicable mechanism identified in a regional privacy schedule, including where appropriate:

• An adequacy decision or recognised destination.
• The European Commission’s then-applicable Standard Contractual Clauses.
• The applicable United Kingdom international data-transfer addendum or agreement.
• Another legally recognised safeguard.

Seemi will provide reasonable information regarding relevant data flows and Security Measures to support the Customer’s transfer assessment. The Customer remains responsible for determining whether its use, selected region, instructions and data categories are lawful for the Customer.

If a required transfer mechanism becomes invalid or unavailable, the parties will cooperate in good faith to implement a lawful alternative. Seemi may suspend an affected transfer or Service if continued processing would violate applicable law and no reasonable alternative is available.

14.14 No sale, advertising, profiling or AI training

Seemi does not sell Customer Content or Customer Personal Data.

Seemi does not use or disclose Customer Content or Customer Personal Data for:

• Behavioural or targeted advertising.
• Data-broker activities.
• Marketing unrelated products or services to data subjects identified in Customer Content.
• Creating advertising profiles.
• Providing services to another customer using the Customer’s identifiable data.
• Training, fine-tuning, grounding, evaluating or improving any general-purpose or third-party artificial-intelligence or machine-learning model.

The restriction on artificial-intelligence and machine-learning use applies to private container images, private source code, databases, files, objects and other private workload information included in Customer Content.

Seemi may use aggregated or de-identified operational information to secure, operate, measure and improve the Services only where the information cannot reasonably identify the Customer, an Authorised User, a data subject or the content of a Customer workload. Seemi will not attempt to re-identify that information.

Seemi may use automated systems to provide Customer-requested Service functionality, malware detection, abuse prevention, security monitoring, troubleshooting or operational support, provided that such processing remains limited to supplying and protecting the Services and is not used for general-purpose model training.

14.15 United States service-provider and processor restrictions

Where Seemi processes Personal Data subject to an applicable United States state privacy law on behalf of the Customer, Seemi will act as a service provider, contractor or processor to the extent those terms apply.

Seemi will not:

• Sell or share Customer Personal Data for cross-context behavioural advertising.
• Retain, use or disclose Customer Personal Data outside the direct business relationship with the Customer except as permitted by the Agreement and applicable law.
• Combine Customer Personal Data with Personal Data received from or collected on behalf of another person, except where permitted by applicable law and reasonably necessary to provide or secure the Services.

Seemi will process Customer Personal Data only for the specific business purposes described in this Section, provide the level of privacy protection required of its applicable role, notify the Customer if Seemi determines it can no longer meet an applicable obligation, and permit reasonable steps by the Customer to verify and remediate Seemi’s use of Customer Personal Data as required by applicable law.

14.16 Conflict

If this Section conflicts with another part of the Agreement concerning the processing of Customer Personal Data, this Section prevails for that subject matter, unless a signed tenant-specific amendment or an applicable mandatory-law schedule provides greater protection.

15. Subprocessors and infrastructure providers

15.1 General authorisation and Subprocessor transparency

The Customer authorises Seemi to use the Subprocessors and infrastructure providers identified in this Section and in Seemi’s then-current online Subprocessor schedule.

The Subprocessor schedule will identify, as applicable:

• The provider’s legal name.
• The service or processing purpose.
• The categories of information involved.
• The principal processing location or applicable region.
• Whether the provider may store Customer Content or only limited account, support, security or operational information.

Seemi may replace or add providers where reasonably necessary. For a material new or replacement Subprocessor that will process Customer Personal Data, Seemi will normally provide at least 15 days’ prior notice where practicable and where required by Applicable Data Protection Law.

A Customer may raise a substantiated data-protection objection under Section 14.11. Seemi will consider reasonable alternatives but is not required to redesign the Services or use a provider that does not meet Seemi’s technical, security, legal or commercial requirements.

15.2 Leaseweb compute providers

Seemi uses regional Leaseweb entities to provide compute, network, data-centre, connectivity, DDoS-protection and related infrastructure services.

The applicable provider depends on the Data Centre Region selected for the Component:

The applicable Leaseweb entity may process Customer Content stored or transmitted through the relevant infrastructure, including container images, application and database data, persistent-volume data, IP addresses, traffic metadata, infrastructure identifiers, operational logs, security information and diagnostic information required to provide and protect the Services.

Customer workload content is ordinarily hosted in the selected Data Centre Region. Limited account, support, security, network and diagnostic information may be processed from other locations where reasonably necessary to provide support, maintain security, respond to incidents or comply with applicable law.

Seemi may add further Leaseweb regions or replace a regional Leaseweb entity. Before a material new Leaseweb entity begins processing Customer Personal Data, Seemi will update its Subprocessor schedule and provide any notice required by Section 14.11 and Applicable Data Protection Law.

15.3 IDrive e2 S3-compatible object storage

Provider: IDrive Inc.
Service: IDrive e2 S3-compatible object storage.
Purpose: Customer object storage, container and volume backups, database backups, snapshots, restoration data and related storage, security and operational metadata.

The following storage regions may be made available through Seemi:

Not every storage region is necessarily available for every Service. Available regions are displayed during provisioning or identified in the applicable SKU or Service documentation.

For a directly provisioned storage account, the Customer selects an available storage location during provisioning. Object data is ordinarily stored in the selected storage region.

For managed backups, Seemi normally uses the following storage mapping unless a different location is disclosed during provisioning or in the applicable SKU:

IDrive Inc. may process Customer objects, files, backups, snapshots, object metadata, bucket and storage-account identifiers, IP addresses, connection metadata, access and security logs, usage measurements and diagnostic information required to provide and protect the storage service.

Limited account, support, authentication, security, diagnostic and billing information may be processed outside the selected storage region. Authorised remote access may occur where reasonably necessary for support, maintenance, restoration, security, incident response or compliance with applicable law.

Cross-region replication is not enabled unless requested or configured by the Customer, expressly included in the applicable SKU with the destination disclosed, reasonably required for a Customer-requested migration or restoration, urgently required to protect service continuity, or required by applicable law.

Where storage, remote access or associated processing constitutes an international transfer under Applicable Data Protection Law, the transfer is governed by Section 14.13 and any applicable regional transfer schedule.

15.4 Other providers

Seemi will identify the applicable contracting provider entity and principal processing location in its published Subprocessor schedule when that provider processes Customer Personal Data.

15.5 Core platform and operational-data region

Seemi’s core platform database, control-plane records, billing records and operational information are primarily hosted on Leaseweb infrastructure in Singapore unless otherwise disclosed.

Depending on the Service and Customer configuration, core platform and operational information may include:

• Tenant, Resource Group and Component identifiers.
• User and permission records.
• Provisioning state and infrastructure identifiers.
• Usage and billing measurements.
• Authentication, audit, security and support records.
• Logs, diagnostic information reasonably necessary to operate or support the Services.

Seemi will not intentionally copy the substantive contents of Customer databases, objects, private container images or application files into platform analytics except where reasonably necessary for Customer-requested support, security investigation, restoration, migration or legal compliance.

The selected workload or storage region controls the ordinary location of Customer workload content, subject to disclosed backup regions, enabled replication, authorised remote access, migration, valid legal requirements and the Subprocessor schedule.

15.6 Subprocessor use restrictions

Seemi will contractually restrict Subprocessors from using Customer Content or Customer Personal Data for the Subprocessor’s own advertising, data-broker activities, unrelated product development or general-purpose artificial-intelligence model training.

A Subprocessor may process Customer Content only to provide its contracted services to Seemi, comply with applicable law, or protect the security and integrity of its services, subject to applicable contractual and legal restrictions.

Part D: Backups, availability and support

16. Backups, recovery and data durability

16.1 SKU-specific coverage

Backup and recovery coverage differs by SKU. Before relying on a backup feature, the Customer must review:

• Whether backup is included or separately purchased.
• Covered paths, volumes, databases and exclusions.
• Backup frequency and retention.
• Backup storage region.
• Encryption method.
• Whether backup is filesystem-level or application-consistent.
• Whether point-in-time recovery is available.
• Restore procedure, likely recovery point and charges.

Only features expressly identified in the applicable SKU, portal or written order are included.

16.2 Backup methods

Seemi may use:

• Encrypted Restic snapshots for eligible container files and volumes.
• SKU-specific backup tooling identified in the SKU documentation, i.e pgBackRest for eligible PostgreSQL Services, xbcloud for MySQL.
• Encrypted S3-compatible buckets for backup storage.

Where supported, the portal allows Customers to view eligible snapshots and initiate restoration. Portal visibility does not by itself confirm that a snapshot is application-consistent or suitable for a particular recovery objective.

16.3 No absolute backup guarantee

Backups reduce risk but do not eliminate it. Unless an applicable SKU expressly provides a specific commitment, Seemi does not guarantee that every backup will:

• Complete successfully.
• Include every file, object or transaction.
• Be application-consistent.
• Be unaffected by corruption, malware or Customer error.
• Remain recoverable after multiple independent failures.
• Meet a particular recovery point or recovery time objective.

This clause does not exclude Seemi’s obligation to exercise reasonable care in operating a purchased backup feature or any liability that cannot lawfully be excluded.

16.4 Customer backup duties

The Customer must:

• Maintain independent copies of critical data appropriate to its risk.
• Regularly test restoration.
• Use application-aware backup methods for transactional applications where required.
• Monitor backup status and respond to reported failures.
• Protect backup credentials and encryption keys under its control.
• Avoid treating one backup system, region or provider as the sole copy of irreplaceable data.

16.5 Region and encryption

Seemi normally stores backups in the same region or the nearest disclosed suitable region. Any region mismatch, including use of Frankfurt storage for Amsterdam compute backups, will be disclosed in the applicable SKU, portal or service documentation. by default backups are stored in a single region unless Seemi & customer explicitly agree on cross-region replication for specific buckets.

Restic snapshots are normally encrypted before or during storage as described for the applicable SKU. Database-specific backups may use client-side encryption, provider-side bucket encryption or both. The applicable SKU will identify whether encryption keys are managed by Seemi, the Customer or the storage provider.

16.6 Restore and migration

Restoration may require downtime, a replacement Component, network transfer and configuration changes. Seemi may migrate a container by creating or using an available backup, stopping the original instance, restoring it to another host, and re-establishing supported connectivity and configuration.

Transactions or changes occurring after the latest usable backup may be lost. The Customer is responsible for validating the restored application and data before resuming normal operation.

16.7 Backup deletion and expiry

Deleting a Component does not necessarily delete its separately retained backups immediately upon undeployment. Backup retention and billing continue according to the applicable SKU until the hold period expires and customer performs a full delete of the resource.

Expired or deleted backups may remain temporarily in access-restricted provider systems until overwritten or removed through ordinary technical deletion cycles. During that period, they will remain subject to the confidentiality and data-processing restrictions in this Agreement.

16A. S3-compatible object storage service terms

16A.1 Compatibility

“S3-compatible” means that the Service supports identified application programming interfaces or behaviours commonly associated with Amazon S3. It does not mean that every Amazon S3 API, feature, storage class, performance characteristic, availability commitment or management function is supported.

Supported functionality and known limitations will be described in the applicable SKU or documentation. The Customer must test compatibility with its applications before relying on the Service for production use.

16A.2 Storage region

The Customer may select from storage regions made available during provisioning. Object data is ordinarily stored in the selected region, subject to disclosed provider operations, enabled replication, authorised support access, legal requirements and Subprocessors.

The location of account, billing, authentication, diagnostic and security metadata may differ from the selected object-storage region as described in Sections 13 and 15.

16A.3 Credentials and access

The Customer is responsible for:

• Protecting storage access keys and credentials.
• Using separate credentials where appropriate.
• Rotating or revoking exposed or unnecessary credentials.
• Configuring bucket and object permissions.
• Reviewing public-access settings.
• Restricting application and user access according to least privilege.

Seemi may revoke or rotate credentials where reasonably necessary to respond to a security incident, legal requirement or credible risk. Where practicable, Seemi will notify the Customer.

16A.4 Public access

Where public bucket or object access is supported, enabling that access is a Customer instruction to make the relevant information publicly accessible. The Customer is responsible for ensuring that public access is intentional, lawful and appropriately limited.

Seemi may restrict public access where reasonably necessary to respond to abuse, a Personal Data Breach, a security incident, a valid legal request or a material violation of this Agreement.

16A.5 Encryption

The applicable SKU or documentation will identify whether the Service uses:

• Provider-side encryption.
• Seemi-managed encryption.
• Customer-managed encryption.
• Client-side encryption.

Unless expressly stated otherwise, Customer-managed or client-side encryption is the Customer’s responsibility. Loss of a Customer-controlled encryption key may make data permanently inaccessible, and Seemi may be unable to recover it.

16A.6 Versioning, lifecycle and object lock

Versioning, lifecycle expiry, legal hold and object-lock functionality are available only where expressly supported by the applicable SKU.

Where the Customer enables lifecycle expiry, version deletion or another automated deletion rule, operation of that rule constitutes a documented Customer instruction. Deletion may be irreversible.

The Customer must not rely on object immutability, retention lock or legal hold unless the applicable SKU expressly confirms the relevant capability and configuration.

16A.7 Deletion

Deleting an object, object version, bucket or storage account may be irreversible. Versioned objects, incomplete multipart uploads, retained backups or objects protected by an applicable retention control may require separate deletion or may remain billable.

After logical deletion, residual copies may remain temporarily in access-restricted provider systems until removed through ordinary technical deletion cycles or applicable retention expiry.

16A.8 Data integrity

Where supported, the Customer should use available checksums, object metadata and application-level validation to confirm integrity after upload, download, transfer or restoration. Seemi does not guarantee detection of every form of application-level corruption.

16A.9 Availability and durability

An availability or durability commitment applies only where expressly stated in the applicable object-storage SKU or SLA. The general Component Availability SLA does not automatically apply to storage API operations, storage-provider durability, the management portal and Customer applications unless expressly stated.

16A.10 Requests, transfer and charges

Storage pricing may include separate charges or allowances for:

• Stored capacity.
• API operations or requests.
• Data transfer or egress.
• Replication.
• Versioned or retained objects.
• Backup and restore operations.
• Minimum billing units or provider pass-through charges.

The portal or applicable SKU will disclose the charging model before provisioning. Estimated costs may differ from final charges where actual usage differs from the estimate.

16A.11 Independent copies

Object storage, replication, versioning and object lock do not replace an independent backup strategy. The Customer must maintain additional copies of critical or irreplaceable data appropriate to its risk.

17. Availability target and service credits

17.1 Target

For eligible Paid SKUs, Seemi targets 99.5% monthly availability. This is a service target and becomes a contractual credit commitment only where the SKU expressly states that it includes the Seemi Availability SLA.

Free SKUs have no availability SLA.

17.2 Availability calculation

For an eligible Component:

Monthly Availability Percentage = (Total minutes in the month minus eligible unavailable minutes) divided by total minutes in the month, multiplied by 100.

Seemi’s platform, infrastructure and monitoring records will be used for calculation, subject to correction of demonstrated errors.

17.3 Eligible unavailability

Unavailable minutes normally require the eligible Component to be inaccessible due primarily to a failure within Seemi’s reasonable control.

17.4 Exclusions

Availability calculations exclude, to the extent permitted by law:

• Scheduled maintenance notified in accordance with the Agreement.
• Emergency maintenance reasonably necessary to address an urgent security, legal or stability risk.
• Customer-requested migration, restoration, update or reconfiguration.
• Failure caused by Customer Content, application code, a container image, database configuration or the Customer’s unsupported configuration.
• Failure of a Customer-controlled identity provider, domain, DNS configuration, credential or encryption key.
• Lawful suspension or restriction under this Agreement.
• Resource exhaustion caused by Customer activity exceeding the applicable SKU limits.
• Internet conditions outside Seemi’s network and reasonable control.
• DDoS attacks, malicious traffic or cyber incidents not caused or materially worsened by Seemi’s failure to exercise reasonable care.
• A third-party provider failure outside Seemi’s reasonable control, provided that the failure was not caused or materially worsened by Seemi’s architecture, configuration or failure to take commercially reasonable mitigation and recovery measures.
• Force majeure events.
• Preview, beta, Free, trial, development or evaluation Services.

An exclusion applies only to the period and impact reasonably attributable to the excluded event. Seemi will not exclude unavailability to the extent it was caused or materially prolonged by Seemi’s failure to exercise reasonable care within its operational control.

17.5 Service-Credit Schedule

For eligible Paid SKUs expressly covered by the Availability SLA, the following service-credit schedule applies unless the SKU specifies a different schedule:

The credit is calculated against the amount charged for the affected Component during the affected calendar month.

The maximum aggregate SLA credit for an affected Component is 100% of the amount charged for that Component during the affected calendar month.

Service credits:

• Apply only to the affected Component and calendar month.
• Do not apply to Components that remained available.
• Cannot exceed the amount actually charged for the affected Component.
• Do not compensate for lost revenue, lost profit, business interruption, consequential loss or losses relating to other Components.
• Remain subject to the exclusions stated in this Agreement.

17.6 Claim process

The Customer must submit an SLA claim to cloud.support@seemi.net, ordinarily within 15 days after the relevant monthly invoice, and identify:

• Tenant, Resource Group and Component.
• Date and approximate time of the event.
• Observed impact.
• Supporting logs or evidence reasonably available.

Seemi will investigate in good faith.

17.7 Remedy

Service credits are the normal and exclusive contractual remedy for failure to meet an express Availability SLA, where legally permitted. Credits apply to future charges. This does not exclude mandatory consumer or statutory rights that cannot lawfully be limited.

18. Maintenance and support

18.1 Maintenance

Seemi may perform scheduled and emergency maintenance. Seemi will seek to provide reasonable advance notice for planned material downtime. Emergency maintenance may occur without prior notice.

Seemi may use container migration or supplier live-migration capabilities to reduce downtime, but interruption and restoration from the latest available backup may still occur.

18.2 Standard support

Standard support is provided during published UAE working hours, excluding UAE public holidays, through cloud.support@seemi.net or supported portal channels.

For paid non-enterprise SKUs, Seemi targets an initial response by the next UAE working day. This is a response target, not a resolution guarantee.

18.3 Free SKU support

Free SKU support is not guaranteed and depends on workload, severity and available capacity.

18.4 Support boundaries

Unless a SKU expressly includes it, support does not include:

• Debugging Customer application code.
• Rewriting container images.
• Administering third-party applications.
• Correcting unsupported custom configurations.
• Providing legal, tax, regulatory or data-residency advice.
• Recovering data not present in an available backup.

Seemi may offer chargeable professional assistance for customer-caused or out-of-scope work.

18.5 Security vulnerabilities and container images

Unless the applicable SKU expressly includes managed image maintenance, the Customer is responsible for vulnerabilities, malware, unsupported packages, licence obligations and configuration within Customer-provided container images and applications.

Seemi may scan images or running Components for malware, known vulnerabilities, exposed secrets or prohibited configurations. Unless expressly included in the applicable SKU:

• Scanning is not guaranteed to occur.
• Scan results may be incomplete or delayed.
• Seemi does not undertake to remediate Customer images.
• Allowing deployment does not mean that an image is secure, supported or compliant.

Seemi may block, isolate, stop or require remediation of a Component that presents a material security or abuse risk.

18.6 Container registries and deployment credentials

Where the Customer deploys an image from a registry:

• The Customer authorises Seemi to retrieve, temporarily cache and deploy the image as necessary to provide the Service.
• The Customer is responsible for maintaining lawful access to the image and any required licence.
• The Customer must protect and rotate registry credentials under its control.
• Seemi may store, transmit encrypted registry credentials or access tokens using supported secret-management mechanisms where required for deployment or updates.
• Registry unavailability, rate limits, deleted tags or changed mutable tags may prevent deployment or restoration.

Part E: Intellectual property, confidentiality and risk allocation

19. Ownership and intellectual property

19.1 Customer Content

As between the parties, the Customer retains all ownership and intellectual-property rights in Customer Content. No ownership right in Customer Content transfers to Seemi or its providers.

The Customer grants Seemi and its providers a limited, non-exclusive, non-transferable except to authorised providers, worldwide right to host, copy, transmit, cache, process, scan for security, back up, restore, migrate, restrict and delete Customer Content only as reasonably necessary to:

• Provide and secure the Services.
• Follow the Customer’s documented instructions.
• Prevent or investigate fraud, abuse or security incidents.
• Comply with applicable law or valid legal process.

This permission ends when the relevant Customer Content is deleted from active systems and applicable backup cycles expire, except to the extent continued retention is legally required.

Seemi and its providers must not use Customer Content for purposes prohibited by Section 14.14.

19.2 Seemi technology

Seemi retains all rights in the Seemi Cloud platform, portal, orchestration, templates, configurations, designs, documentation, trademarks and proprietary software, excluding Customer Content and third-party open-source software.

19.3 Open-source and third-party software

Open-source and third-party software remains subject to its own licence terms. Seemi does not grant rights beyond those licences and does not warrant that third-party software is error-free, secure, maintained or suitable for the Customer’s purpose.

19.4 Feedback

The Customer may provide feedback. Seemi may use non-confidential feedback to improve its Services without payment or ownership of Customer Content.

19.5 Publicity

Seemi will not use a Customer’s name or logo for public marketing without permission, except to identify the Customer where reasonably necessary for service operation, billing, legal compliance or support.

19.6 No publicity based on workload content

Seemi will not identify, describe or publicly reference the Customer’s workloads, architecture, usage volumes, security incidents or Customer Content for marketing, case studies, benchmarking or publicity without the Customer’s prior permission.

This restriction does not prevent Seemi from:

• Providing confidential information to its professional advisers, auditors, insurers and providers where reasonably necessary and subject to appropriate confidentiality.
• Making disclosures required by applicable law or valid legal process.
• Publishing aggregated or de-identified operational information that does not reasonably identify the Customer, an Authorised User, a data subject or the content of a Customer workload.

20. Suspension, termination, export and deletion

20.1 Customer termination

The Customer may delete Components and close a tenant through available portal or support processes, subject to outstanding charges, commitments and technical completion of deletion.

20.2 Seemi suspension

Seemi may restrict or suspend a user, Component, Resource Group or tenant for:

• Non-payment.
• Security risk.
• Actual or suspected unlawful activity.
• A material or repeated breach of this Agreement.
• False or unverifiable customer information.
• A credible abuse or legal request.
• Supplier or payment-provider restrictions.
• Protection of shared infrastructure.

20.3 Cure period

For an ordinary remediable breach, Seemi will normally allow up to five business days to cure. No cure period is required for urgent, illegal, dangerous, repeated or non-remediable conduct.

20.4 Termination by Seemi

Seemi may terminate an affected Service or tenant where:

• A serious or repeated breach occurs.
• Payment remains overdue.
• Continued service creates unacceptable legal, sanctions, fraud, security or supplier risk.
• A Customer fails to provide requested verification.
• A required provider discontinues service and no reasonable alternative exists.
• Seemi discontinues the Service after reasonable notice where practicable.

20.5 Non-payment deletion

If outstanding amounts are not paid, Seemi may delete Components and Customer Content at any time after 30 days of continued non-payment, subject to any notice required by law. The Customer must not treat this period as guaranteed storage or a restoration commitment.

20.6 Data export

The Customer should export Customer Content before deleting a Component or closing a Tenant. During an active Service, the Customer may export data using available Service functionality.

For a non-urgent termination initiated by Seemi, Seemi will, where technically feasible and legally permitted, provide a limited opportunity to export Customer Content before permanent deletion. Seemi may restrict active compute, public network access or administrative actions during that period where reasonably necessary for security, non-payment, abuse prevention or legal compliance.

A post-termination export window is not guaranteed where:

• The Customer deleted the data or Component.
• Immediate suspension or deletion is required by law or to address an urgent risk.
• The data is unavailable because of corruption or failure not caused by Seemi’s lack of reasonable care.
• Continued storage or access would expose Seemi or another party to material legal or security risk.

Seemi may charge reasonable fees for material bespoke export work agreed in advance.

20.7 Backup expiry and retained records

Deleted Customer Content may remain temporarily in encrypted or access-restricted backups until overwritten, expired or removed through ordinary retention cycles. During that period:

• The data will remain protected under the confidentiality, security and processing restrictions in this Agreement.
• Seemi will not restore the data except for disaster recovery, legal compliance, security investigation or a Customer-authorised recovery where available.
• If restored for platform disaster recovery, Seemi will reapply the applicable deletion instruction as reasonably practicable.

Seemi may retain logs, billing, acceptance, fraud, security, abuse and legal records where required by law or reasonably necessary to establish rights, prove transactions, investigate incidents or protect platform integrity.

21. Confidentiality

21.1 Confidential Information

“Confidential Information” means non-public business, technical, security, commercial or operational information disclosed by one party to the other in connection with the Agreement, including Customer Content, credentials, security information, pricing not generally published, architecture and support communications.

21.2 Duties

Each receiving party will:

• Protect the disclosing party’s Confidential Information using at least reasonable care and no less than the care it uses for its own information of similar sensitivity.
• Use Confidential Information only to perform or exercise rights under the Agreement.
• Disclose Confidential Information only to personnel, contractors, providers and professional advisers who have a need to know and are subject to appropriate confidentiality obligations.
• Notify the disclosing party without undue delay of a known unauthorised disclosure where legally permitted.

21.3 Exclusions

Confidentiality obligations do not apply to information that the receiving party can demonstrate:

• Is public without breach of the Agreement.
• Was lawfully known without restriction before disclosure.
• Was independently developed without use of the Confidential Information.
• Was lawfully received from another source without a duty of confidentiality.
• Was approved for release by the disclosing party.

21.4 Compelled disclosure

Where legally permitted, a party compelled to disclose Confidential Information will provide reasonable prior notice, seek appropriate protection where practicable, and disclose only the information legally required.

21.5 Duration

These confidentiality obligations continue during the Agreement and for five years after termination. Obligations relating to Customer Content, Personal Data, credentials, trade secrets and security-sensitive information continue for as long as the information remains confidential or applicable law requires protection.

22. Warranties and disclaimers

22.1 Customer warranties

The Customer represents and warrants that:

• It has authority to enter into this Agreement.
• Registration and billing information is accurate.
• Customer Content and use are lawful.
• It owns or has rights to use Customer Content.
• It has obtained required privacy notices, consents and permissions.
• Its use will not violate third-party rights or this Agreement.

22.2 Service basis

To the maximum extent permitted by law, Services are provided on an “as available” basis. Except for an express SKU commitment, Seemi does not warrant that:

• The Services will be uninterrupted, error-free or immune from attack.
• Every backup will complete or restore successfully.
• Customer applications or third-party images will operate correctly.
• A Service is suitable for regulated, safety-critical or high-availability use.
• Open-source or third-party software will be maintained or vulnerability-free.

22.3 Customer evaluation

The Customer must assess whether the selected Service, region, backup and security configuration is suitable for its workload. Seemi does not provide legal or regulatory advice.

22.4 Free SKUs

Free SKUs:

• Are intended for development, testing or evaluation.
• Have no SLA or guaranteed support.
• May be limited, changed, suspended or withdrawn.
• Carry no assurance of availability, durability, backup or restoration.
• Must not be used as the sole location for important data or computing workloads.

23. Limitation of liability

23.1 Excluded losses

To the maximum extent permitted by law, neither party is liable to the other for indirect, incidental, special, exemplary, punitive or consequential loss, or for loss of profit, revenue, opportunity, goodwill or anticipated savings.

Seemi is not liable for loss of data or use to the extent caused by the Customer’s failure to maintain independent backups appropriate to its risk, but this does not exclude liability to the extent directly caused by Seemi’s breach of an express backup commitment or failure to exercise reasonable care in operating a purchased backup feature.

23.2 Excluded causes

To the maximum extent permitted by law, Seemi is not liable for loss to the extent caused by:

• Customer Content, application code, container images or Customer configuration.
• Customer users, credentials, access decisions or identity providers.
• Customer failure to maintain independent backups appropriate to its risk.
• Unsupported software or third-party applications selected by the Customer.
• A third-party or internet failure outside Seemi’s reasonable control that was not caused or materially worsened by Seemi’s architecture, configuration or failure to take commercially reasonable mitigation measures.
• A cyberattack, malicious traffic or force majeure event not caused or materially worsened by Seemi’s failure to exercise reasonable care.
• Lawful suspension, takedown, termination or compliance action performed in accordance with the Agreement.

23.3 General liability cap

To the maximum extent permitted by law, each party’s total aggregate liability arising from or relating to a Tenant, the Services and the Agreement, across all events and legal theories, will not exceed the total Service charges paid or payable by that Tenant during the 3 months immediately preceding the event giving rise to the first claim.

For a Paid SKU active for less than 3 months, the cap will be the charges paid or payable during the active period. For a Free SKU or Tenant with no paid charges, Seemi’s liability is excluded to the maximum extent permitted by law.

23.4 Enhanced cap

To the maximum extent permitted by law, Seemi’s aggregate liability arising from breach of confidentiality, breach of Section 14, or a Personal Data Breach caused by Seemi’s failure to comply with its contractual Security Measures will not exceed two times the general cap in Section 23.3.

23.5 Matters not limited

Nothing in the Agreement excludes or limits:

• Liability for fraud or fraudulent misrepresentation.
• Liability for wilful misconduct.
• A Customer’s obligation to pay valid charges.
• Liability that cannot lawfully be excluded or limited.
• Mandatory Consumer rights and remedies.

23.6 SLA credits

For an express Availability SLA failure, service credits under Section 17 are the Customer’s exclusive contractual remedy where legally permitted. This does not limit another remedy for a separate breach, wilful misconduct, or liability that cannot lawfully be limited.

23.7 Claim notification and mitigation

A party must notify the other promptly after becoming aware of a potential claim and take reasonable steps to reduce avoidable loss. Failure to provide prompt notice reduces liability only to the extent the delay materially prejudices the other party and does not remove a mandatory right that cannot lawfully be waived.

23.8 Enterprise variations

Seemi may offer separately priced enterprise terms, higher liability caps, bespoke support, security commitments or additional insurance-backed commitments through a written agreement.

24. Customer indemnity

24.1 Scope

To the maximum extent permitted by law, the Customer will defend and indemnify Seemi, its officers, employees and contractors against a third-party claim, regulatory action, penalty, reasonable legal cost and remediation expense to the extent arising from:

• Customer Content infringing a third party’s intellectual-property right.
• Illegal or prohibited use of the Services by the Customer or an Authorised User.
• The Customer’s material violation of Applicable Data Protection Law.
• A Customer-provided container image, code or application.
• The Customer’s material breach of Sections 3, 9, 12, 14, 19 or 22.

24.2 Exclusions

The Customer is not required to indemnify Seemi to the extent a claim was caused by:

• Seemi’s unauthorised modification or use of Customer Content.
• Seemi’s failure to follow the Customer’s lawful documented instructions.
• Seemi’s breach of the Agreement or applicable law.
• Seemi’s negligence, wilful misconduct or fraud.

24.3 Procedure

Seemi will:

• Provide prompt notice of an indemnified claim where lawful.
• Provide reasonable cooperation at the Customer’s expense.
• Allow the Customer to control the defence and settlement, subject to Seemi’s right to participate using its own counsel at its own expense.

The Customer must not settle a claim in a manner that admits fault by Seemi, imposes a non-monetary obligation on Seemi, or fails to provide an unconditional release of Seemi without Seemi’s prior written consent, not to be unreasonably withheld.

Seemi may assume control of the defence where the claim creates a material conflict of interest, seeks injunctive relief against Seemi, or presents a material risk to Seemi’s platform, licence or reputation.

24.4 Regulatory authority

This indemnity allocates financial responsibility between the parties. It does not prevent an authority or third party from investigating or bringing proceedings against either party where applicable law permits.

25. Force majeure

Neither party is liable for delay or failure caused by events beyond its reasonable control, including natural disaster, war, civil disorder, epidemic, government action, utility failure, widespread internet disruption, supplier outage, labour disruption, cyberattack or data-centre emergency, provided the affected party uses reasonable efforts to reduce impact.

Payment obligations for Services already supplied are not excused.

Part F: Consumer terms and legal provisions

26. Consumer protections

26.1 Mandatory rights preserved

If the Customer is a Consumer, nothing in this Agreement removes rights or remedies that cannot lawfully be excluded under UAE law or other mandatory law applicable to the transaction.

26.2 Clear information

Seemi will make material service specifications, pricing, billing units, region, payment terms and applicable limitations available before provisioning. Customers should review them before creating a Component.

26.3 Arabic information and invoices

For UAE Consumers, Seemi will make legally required consumer information and invoicing available in Arabic, and may also provide English. This English Agreement is the primary contractual version between the parties to the extent legally permitted. Mandatory Arabic requirements, official Arabic legislation and requirements of UAE authorities remain unaffected.

26.4 Complaints

Consumers may submit complaints to cloud.support@seemi.net. Privacy, legal or abuse complaints may be submitted to cloud.legal@seemi.net. Seemi will seek to review complaints fairly and within a reasonable time.

26.5 Refunds and compensation

Credits are the normal remedy for qualifying availability failures, but Seemi may provide a refund, credit note or other remedy where required by applicable consumer law.

26.6 UAE Consumer schedule and mandatory disclosures

For a UAE Consumer, any applicable UAE Consumer Schedule, Arabic pre-contract information form part of the Agreement and prevail over conflicting general terms to the extent required by mandatory law.

Before a UAE Consumer provisions a paid Component, Seemi will make available the material information required by applicable law, which may include:

• Seemi’s licensed identity and contact information.
• The Service description and material specifications.
• The total price or pricing method.
• Billing frequency and payment terms.
• Applicable renewal, cancellation, refund and suspension conditions.
• Material data-location, backup and service limitations.
• Available complaint channels.

Where immediate provisioning affects a mandatory cancellation or withdrawal right, Seemi will obtain any acknowledgement or request required by applicable law before provisioning.

Nothing in the Agreement requires a Consumer to waive a right or remedy that cannot lawfully be waived.

26.7 Consumer liability and remedy override

Sections concerning disclaimers, exclusive remedies, liability limits, indemnities, suspension, deletion, governing law and jurisdiction apply to a Consumer only to the extent permitted by mandatory law.

Where mandatory Consumer law requires repair, re-performance, refund, compensation or another remedy, the mandatory remedy prevails over a conflicting credit-only or exclusive-remedy provision.

27. Changes to this Agreement

Seemi may update this Agreement for legal, security, operational, supplier or service reasons.

• Material changes will normally receive at least 30 days’ notice.
• Urgent legal, security or supplier-driven changes may take effect sooner.
• Material changes may require renewed affirmative acceptance.
• Non-material clarifications may be notified through the portal, website or email.
• If the Customer does not accept a material change, it may stop using and delete affected Services before the effective date, subject to charges already incurred.

The version accepted for each tenant will be recorded.

28. Notices

Seemi may provide operational and contractual notices through:

• The registered tenant email.
• Portal notifications.
• Publication within the Services.
• The contact addresses in this Agreement.

The Customer must keep contact details current. Formal legal notices to Seemi must be sent to cloud.legal@seemi.net and, where legally required, to Seemi’s registered office.

29. Governing law and disputes

29.1 Governing law

This Agreement is governed by the federal laws of the United Arab Emirates and laws applicable in the Emirate of Ajman, without excluding mandatory rights that apply to a Consumer and cannot lawfully be displaced.

29.2 Good-faith resolution

Before commencing proceedings, the parties should attempt in good faith to resolve the dispute through written escalation for at least 15 days, unless urgent relief is required.

29.3 Courts

Subject to mandatory consumer jurisdiction and other non-excludable law, the courts competent in Ajman, United Arab Emirates, will have jurisdiction.

29.4 Language

The Agreement is prepared in English. English prevails over a convenience translation between the parties to the extent legally permitted. This does not override mandatory Arabic-language requirements, and official Arabic law prevails for interpretation by UAE authorities and courts where applicable.

29.5 Regional mandatory rights

The governing-law and jurisdiction provisions do not deprive a Consumer or data subject of a mandatory protection, complaint right, regulatory remedy or jurisdiction that applicable law does not permit the parties to exclude.

Where Applicable Data Protection Law grants a person the right to complain to a competent data-protection authority, nothing in the Agreement restricts that right.

30. General provisions

30.1 Entire agreement

This Agreement, its schedules, the accepted SKU and pricing record, and any tenant-specific written terms form the entire agreement for the Services.

30.2 Priority

If documents conflict, the following order applies unless mandatory law requires otherwise:

1. A tenant-specific written amendment signed or expressly approved by Seemi and the Customer.
2. An applicable mandatory-law or regional privacy schedule, including executed Standard Contractual Clauses, for its stated subject matter.
3. The Data Processing Addendum in Section 14 for processing Customer Personal Data.
4. The applicable UAE Consumer Schedule for a UAE Consumer transaction.
5. The applicable SKU-specific service description, Service Schedule or SLA.
6. This Agreement.
7. General portal documentation.

A later document prevails only for its stated subject matter. A commercial order or SKU description does not reduce a data-protection obligation unless it expressly identifies the provision being amended and the amendment is legally permitted.

30.3 Assignment

The Customer may not assign this Agreement without Seemi’s written consent. Seemi may assign it as part of a merger, restructuring, financing, sale of business or transfer to an affiliate, subject to applicable law and continued protection of Customer rights.

30.4 Severability

If a provision is invalid or unenforceable, it will be limited to the minimum extent necessary and the remaining provisions continue in effect.

30.5 No waiver

Failure to enforce a provision is not a waiver.

30.6 No partnership

This Agreement does not create a partnership, employment, agency, fiduciary or joint-venture relationship.

30.7 Survival

Payment, ownership, confidentiality, data retention, liability, indemnity, dispute and other provisions intended by their nature to survive will continue after termination.

Schedule 1: Technical and Organisational Measures

1. Scope

This Schedule describes baseline Security Measures for the Seemi Cloud platform. Specific capabilities may vary by SKU, region and provider. A control applies only where relevant to the affected Service and implemented as described in the applicable SKU or documentation.

2. Identity and access management

Seemi will maintain measures designed to:

• Restrict production access to authorised personnel with a legitimate operational need.
• Use named administrative identities where technically supported.
• Apply role-based or least-privilege access principles.
• Use multifactor authentication for privileged Seemi administrative access where supported.
• Revoke access when personnel no longer require it.
• Review privileged access periodically.
• Protect stored service credentials and secrets using supported secret-management mechanisms.

The Customer remains responsible for Authorised User permissions, identity-provider security, application accounts and credentials under its control.

3. Tenant and workload isolation

Seemi will use platform, orchestration, network and access-control mechanisms designed to separate Tenants and restrict unauthorised access between Customer workloads.

The Customer must not attempt to bypass isolation controls. Internet-accessible applications remain the Customer’s responsibility unless the applicable SKU expressly provides a managed security control.

4. Encryption and transmission security

Seemi will:

• Support encryption for internet-facing administrative and portal connections in transit.
• Use TLS for supported public Service endpoints where described for the SKU.
• Use backup or provider-side encryption where expressly stated for the SKU.
• Protect encryption keys and credentials under Seemi’s control using access restrictions appropriate to their sensitivity.

TLS may terminate at a proxy or load balancer. Internal host or trusted-service traffic may not always be encrypted. The Customer must implement application-level or end-to-end encryption where required by its risk or legal obligations.

5. Logging and monitoring

Seemi will maintain operational and security logging appropriate to the Service, which may include:

• Authentication and administrative events.
• Provisioning and Component lifecycle actions.
• Platform health and security events.
• Backup status and restoration actions where supported.
• Network and abuse indicators reasonably required for platform protection.

Log scope and retention vary by system and SKU. Customer application logs may contain Customer Content and remain subject to the Agreement.

6. Vulnerability and patch management

Seemi will maintain processes designed to:

• Identify material vulnerabilities within the host, control plane and platform software under Seemi’s control.
• Prioritise remediation according to risk and operational impact.
• Apply security updates within reasonable operational windows.
• Perform emergency remediation where an urgent threat justifies accelerated action.

The Customer is responsible for vulnerabilities in its own images, code, dependencies and unsupported configurations unless an applicable managed SKU expressly states otherwise.

7. Secure operations and change management

Seemi will maintain reasonable operational procedures for material platform changes, including testing or review appropriate to the risk, controlled deployment and recovery or rollback planning where practicable.

Emergency changes may follow an accelerated process where required to address a material security, legal or availability risk.

8. Incident response

Seemi will maintain an incident-response process designed to:

• Receive and assess security alerts.
• Contain and investigate material incidents.
• Preserve relevant evidence where appropriate.
• Remediate identified risks.
• Notify affected Customers as required by the Agreement and applicable law.
• Review material incidents for corrective actions.

9. Availability, backup and recovery

For Services with included or purchased backup features, Seemi will operate the applicable backup process, retention and restoration functionality described in the SKU.

Seemi will maintain platform recovery procedures appropriate to the Service. Backup and recovery commitments remain subject to Sections 16 and 17 and do not replace the Customer’s duty to maintain independent copies of critical data.

10. Personnel security and confidentiality

Seemi will require personnel with access to Confidential Information or Customer Personal Data to comply with appropriate confidentiality and security obligations. Access will be limited according to role and revoked when no longer required.

11. Supplier and Subprocessor management

Seemi will perform reasonable risk-based assessment of material providers that process Customer Personal Data or operate critical infrastructure. Seemi will use written agreements addressing relevant confidentiality, security and data-protection obligations.

12. Data deletion and media handling

Seemi will use logical deletion and provider disposal processes appropriate to the relevant storage technology. Deleted information may remain in access-restricted backups until ordinary expiry or overwrite.

Where Seemi controls physical media disposal, Seemi will use a process reasonably designed to prevent unauthorised recovery. Where a provider controls media, the provider’s applicable secure-disposal process applies.

13. Testing and review

Seemi will periodically review material Security Measures and may use internal assessment, automated testing, vulnerability scanning, recovery testing, independent review or supplier assurance documents as appropriate to the Service and risk.

14. Customer security responsibilities

The Customer is responsible for:

• Selecting an appropriate SKU and region.
• Managing Authorised Users and application accounts.
• Securing its identity provider and recovery methods.
• Protecting credentials, secrets and encryption keys under its control.
• Securing application code, images, dependencies and configurations.
• Configuring network exposure and public storage access.
• Maintaining and testing independent backups.
• Monitoring its applications and responding to vulnerabilities.
• Implementing additional controls required by its legal, contractual or industry obligations.

Schedule 2: European International Data Transfer Terms

1. Application

This Schedule applies where Customer Personal Data protected by the GDPR or UK GDPR is transferred to Seemi or a Subprocessor in a country that requires an international-transfer safeguard.

2. European Union and European Economic Area transfers

Where required, the then-applicable European Commission Standard Contractual Clauses are incorporated into the Agreement by reference using the module appropriate to the parties’ roles.

Unless otherwise specified in an executed order or addendum:

• The Customer is the data exporter.
• Seemi is the data importer.
• The optional docking clause applies.
• General written authorisation for Subprocessors applies, subject to Section 14.11.
• The competent supervisory authority and governing-law selections will be completed according to the Customer’s applicable establishment and the requirements of the Standard Contractual Clauses.
• Annex I is completed using the party, processing and transfer information in the Agreement and the Customer’s order.
• Annex II is completed by Schedule 1 and applicable SKU-specific Security Measures.
• Annex III is completed by the applicable Subprocessor schedule.

If completion of a mandatory selection or annex requires Customer-specific information, the Customer will provide that information upon request.

3. United Kingdom transfers

Where required for a transfer protected by the UK GDPR, the parties will incorporate the then-applicable United Kingdom international data-transfer addendum or international data-transfer agreement. The Agreement, Schedule 1 and the Subprocessor schedule will provide the corresponding commercial, processing and security information unless additional information is legally required.

4. Transfer assessments

Each party will provide information reasonably available to it and reasonably required for a transfer assessment. Seemi may provide standardised information regarding:

• Data flows and processing locations.
• Security Measures.
• Subprocessors.
• Government-request handling.
• Technical and organisational safeguards.

The Customer is responsible for assessing its own instructions, data categories, purposes and selected regions.

5. Government-access requests

Where Seemi receives a government or law-enforcement request for Customer Personal Data, Seemi will act in accordance with Section 11 and, where applicable, the incorporated transfer mechanism.

Where legally permitted, Seemi will:

• Verify the authority, legal basis and scope of the request.
• Seek clarification or narrowing where the request appears unclear, excessive or defective.
• Disclose only information within the valid scope.
• Notify the Customer.
• Document the request and response.

6. Supplementary measures

Depending on the Service and risk, supplementary measures may include encryption in transit, backup encryption, access restrictions, logging, data minimisation, pseudonymisation controlled by the Customer, and Customer-managed or client-side encryption where supported.

The Customer is responsible for implementing Customer-controlled supplementary measures required by its transfer assessment.

7. Conflict

If an incorporated mandatory transfer mechanism conflicts with the Agreement, the mandatory transfer mechanism prevails for the affected transfer.

Schedule 3: UAE Consumer Terms

1. Application

This Schedule applies where the Customer is a Consumer protected by mandatory UAE consumer law. It supplements the Agreement and prevails over a conflicting term to the extent required by mandatory law.

2. Pre-contract information

Before a paid Service is provisioned, Seemi will make available the material Service description, price or pricing method, billing unit, payment terms, region, material limits, backup position, renewal or recurring-charge information, and available cancellation or complaint process.

3. Arabic information

Seemi will provide Arabic consumer information where required by applicable law. Seemi may provide English alongside Arabic. Official Arabic legislation and mandatory Arabic requirements remain unaffected.

4. Immediate provisioning

Where a paid digital Service is provisioned immediately at the Consumer’s request, Seemi may request an express acknowledgement of immediate performance and any legally required acknowledgement concerning cancellation or withdrawal rights.

5. Complaints

A Consumer may submit a complaint to cloud.support@seemi.net. Privacy and legal complaints may be sent to cloud.legal@seemi.net.

Seemi will review the complaint fairly and provide a response within a reasonable period. This does not restrict the Consumer’s right to complain to a competent UAE authority.

6. Remedies

Where mandatory law requires repair, re-performance, refund, compensation or another remedy, that remedy applies notwithstanding a conflicting credit-only, disclaimer or exclusive-remedy term.

7. No waiver

A Consumer is not required to waive a statutory right that cannot lawfully be waived. Any limitation, exclusion, indemnity, governing-law or jurisdiction clause applies only to the extent permitted by mandatory law.