--- title: 'Seemi Cloud Services Agreement' description: 'Terms governing access to and use of Seemi Cloud services.' version: '1.3' effectiveDate: '5 November 2026' lastUpdated: '5 November 2026' language: 'en' --- # Seemi Cloud Services Agreement **Version:** 1.3 **Effective date:** 5 November 2026 **Last updated:** 5 November 2026 ## Agreement summary This Seemi Cloud Services Agreement, including all schedules incorporated into it, governs every Seemi Cloud tenant and every service, resource group, component, storage account, backup, feature and support service used through that tenant. The Agreement is intended for: - Businesses, organisations and public-sector entities. - Sole traders, freelancers and independent professionals. - Individual developers and other adult consumers. - Customers located in the UAE and other supported countries. Each tenant requires separate acceptance. By creating a tenant, the accepting person confirms that they are at least 18 years old, have supplied accurate information, and either contract personally or have authority to bind the named organisation. Mandatory consumer and statutory rights remain unaffected where they cannot lawfully be excluded. **Important: please read Parts D and E carefully.** In particular: - Seemi's total liability is limited to the Service charges the Customer actually paid in the 3 months before the event giving rise to a claim (Section 23). - Service credits are the only remedy for downtime or unavailability, and Seemi is not liable for lost revenue, profit or business opportunity (Sections 17 and 23). - The Customer is responsible for keeping independent copies of important data, for the credentials, network exposure and devices it controls, and for approving restorations from backup (Sections 5, 16 and 23). - Referral Partners are additionally bound by Part G. --- # Part A: Core service terms ## 1. Parties and contact information ### 1.1 Seemi The Services are provided by: **Seemi Technology Group - F.Z.C** Licence number: **47760** Registered office: **B.C. 1302265, Ajman Free Zone C1 Building, Ajman Free Zone, Ajman, United Arab Emirates** Makani / postal code: **4442612247** Website: **https://seemi.net** Seemi Cloud website: **https://cloud.seemi.net** Cloud portal: **https://cloudportal.seemi.net** “Seemi Cloud” is a product and service of Seemi Technology Group - F.Z.C. In this Agreement, “Seemi,” “we,” “us” and “our” refer to Seemi Technology Group - F.Z.C. ### 1.2 Contact channels - Customer support and billing: **cloud.support@seemi.net** - Legal, privacy, abuse and government requests: **cloud.legal@seemi.net** - Formal notices to Seemi: **cloud.legal@seemi.net**, with a copy to the registered office where physical delivery is required by law. ### 1.3 Customer “Customer,” “you” and “your” mean the individual or legal entity identified during tenant creation. If an individual creates a tenant for an organisation, the organisation is the Customer and the individual represents that they have authority to bind it. ## 2. Definitions - **Agreement:** This document, its schedules, the applicable SKU description, pricing displayed before provisioning, and any written tenant-specific terms approved by Seemi. - **Applicable Data Protection Law:** Any privacy, data-protection or data-security law applicable to Seemi's processing of Personal Data under the Agreement, including, where applicable, the UAE Personal Data Protection Law, the GDPR, the UK GDPR and applicable United States state privacy laws. - **Authorised User:** A person invited or permitted by the Customer to access a Tenant, Resource Group or Component. - **Component:** A billable or non-billable deployed resource, including a container, application, database, data volume, storage account, bucket, backup or related service. - **Consumer:** An individual obtaining Services for personal purposes, and any other person treated as a consumer under mandatory applicable law. - **Customer Content:** All applications, container images, source code, databases, files, objects, secrets, configurations, logs, prompts, outputs or other information supplied, stored, transmitted or generated by or for the Customer through the Services. Customer Content does not include Account Data independently collected and controlled by Seemi for account administration, billing, fraud prevention, security or legal compliance. - **Customer Personal Data:** Personal Data contained in Customer Content and processed by Seemi on behalf of the Customer. - **Data Centre Region:** The geographic location selected or assigned for a Component, storage service or backup. - **Data Protection Addendum or DPA:** The data-processing terms in Part C and any applicable privacy or international-transfer schedule incorporated into the Agreement. - **Free SKU:** A no-charge Service identified as free, trial, testing, development or evaluation use. - **GDPR:** Regulation (EU) 2016/679, including its implementation under applicable European Union or European Economic Area law. - **L1, L2 and L3:** Seemi Cloud access levels. The definitive permissions associated with each access level are described in the then-current permission matrix made available through the portal or documentation. - **Personal Data:** Information relating to an identified or identifiable natural person, and any equivalent term such as personal information under Applicable Data Protection Law. - **Personal Data Breach:** A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise processed. - **Paid SKU:** A Service for which usage or recurring charges apply. - **Private Network:** The optional Seemi-operated private network described in Section 5.8 that connects eligible Components and the devices of permitted Authorised Users. - **Processing:** Any operation performed on Personal Data, whether or not by automated means, including collection, access, storage, transmission, retrieval, use, disclosure, restriction, deletion or destruction. “Process,” “processed” and “processing” have corresponding meanings. - **Published Information:** Service descriptions, specifications, pricing, promotions, program terms and other information published by Seemi on https://cloud.seemi.net or displayed in the portal at https://cloudportal.seemi.net, as updated from time to time. - **Referral Partner:** A person or entity approved by Seemi to participate in the Referral Program under Part G. - **Referral Program:** The Seemi Cloud referral program described in Part G. - **Resource Group:** A logical grouping of Components within a Tenant and an access-control boundary. - **Restricted Data:** Data subject to specific legal, regulatory, contractual or industry requirements beyond the standard controls expressly included in the selected SKU, including regulated health data, payment-card data, biometric identifiers, government-classified data and data subject to mandatory localisation requirements. - **Security Measures:** The technical and organisational measures described in Section 14 and the applicable Technical and Organisational Measures Schedule. - **Service:** Any Seemi Cloud functionality made available under this Agreement. - **SKU:** A published package or billing unit with stated specifications, limits, features and pricing. - **Subprocessor:** A third party engaged by Seemi to process Customer Personal Data on behalf of the Customer. - **Tenant:** A separately accepted, administered and invoiced Seemi Cloud account boundary. - **UAE Personal Data Protection Law:** UAE Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data, as amended or replaced. - **UK GDPR:** The GDPR as incorporated into the law of the United Kingdom, as amended or replaced. ## 3. Eligibility and customer information ### 3.1 Eligibility A Customer may create and use a tenant only if: - The accepting individual is at least 18 years old and has legal capacity to contract. - The Customer is not subject to applicable sanctions or restrictions that prevent Seemi, its bank, payment processor or infrastructure provider from supplying the Services. - The Customer is located in a country or territory supported by Seemi. - The Customer provides accurate, complete and non-misleading registration, identity, organisation, contact and billing information. - The Customer accepts this Agreement separately for each tenant. ### 3.2 Business customers A person accepting for an organisation represents that: - The organisation legally exists or is a valid sole trade or professional undertaking. - The person has authority to bind the organisation. - The organisation’s legal name, registration country, registration or licence number, registered address and tax information are accurate. ### 3.3 Individual customers An individual acting personally must: - Use their own legal identity and accurate contact and billing details. - Confirm they are at least 18 years old. - Not create or administer a tenant for a child. - Comply with all laws applicable to their use of the Services. ### 3.4 Verification Seemi relies on customer-supplied information but may request identity, business, payment, beneficial-ownership, authority or source-of-funds documentation where reasonably required for legal compliance, fraud prevention, payment risk, abuse investigation or security. Seemi may reject, restrict, suspend or terminate a tenant if information is false, incomplete, outdated, unverifiable or reasonably suspected to be misleading. Self-certification does not remove Seemi’s obligations under mandatory law. ### 3.5 Multiple tenants A Customer may create multiple tenants. Each tenant: - Requires separate acceptance of the Agreement. - Is separately administered and invoiced. - Has its own users, Resource Groups, Components, usage and billing records. - May have tenant-specific payment or commercial terms approved by Seemi. ### 3.6 Customer and Agency Use; Resale Restrictions Customers may use Seemi Cloud to host and operate websites, applications and other lawful workloads for themselves or for their clients. Developers, consultants and agencies may administer Components for clients, provided that: - The Customer remains responsible for all charges, users, Customer Content and compliance associated with the tenant in-line with this agreement. - The Customer has authority from its client to host and administer the relevant workload and data. - The Customer does not represent that the underlying Seemi Cloud infrastructure is owned or operated by the Customer. - The Customer does not grant its client direct contractual rights against Seemi. Without Seemi’s prior written approval, the Customer must not: - Resell, sublicense or white-label Seemi Cloud infrastructure, storage, SKUs, credits or tenant access as a standalone cloud or hosting service. - Create Components primarily for onward resale of raw compute or storage capacity. - Present itself as an authorised Seemi Cloud reseller, distributor or partner, except that an approved Referral Partner may describe itself as a "Seemi Cloud referral partner" in accordance with Part G. - Transfer promotional, free or service credits to another customer or tenant. A Customer wishing to operate as a reseller or managed hosting provider may request approval through **cloud.support@seemi.net**. Seemi may require separate reseller terms, verification procedures, support responsibilities, minimum commitments or revised pricing. Ordinary use by a developer, consultant or agency to build, host and manage a client’s application is not prohibited resale where the Customer remains fully responsible under this Agreement. ## 4. Accounts, authentication and access control ### 4.1 Authentication Seemi Cloud uses supported third-party single sign-on services, presently including Microsoft and Google. Password-based login is not provided by Seemi. The Customer remains responsible for: - Protecting its identity-provider accounts and recovery methods. - Configuring strong authentication and multifactor authentication where available. - Removing access promptly when a user no longer requires it. - Reviewing tenant and Resource Group permissions. ### 4.2 Customer-appointed users The Customer may nominate Authorised Users and grant L1, L2 or L3 rights at supported levels of the Tenant, Resource Group and Component hierarchy. The Customer is responsible for all authorised actions taken through its tenant, including actions by invited users. A user with L3 rights over a Resource Group may be able to create, modify, stop, restore or delete billable Components within that Resource Group. Such actions bind the Customer. ### 4.3 Emergency and support access Seemi may disable access, restrict a user, apply forward authentication, isolate a Component, or obtain administrative access to a resource where reasonably necessary to: - Provide requested support. - Protect the platform, the Customer, other customers or third parties. - Investigate suspected fraud, security incidents or Agreement violations. - Respond to a credible abuse report. - Comply with law or a valid direction from a competent authority. - Restore, migrate, maintain or troubleshoot infrastructure. Where practicable and lawful, access will be limited to what is reasonably necessary, performed by authorised personnel and logged. ### 4.4 Definitive permission matrix Descriptions of L1, L2 and L3 access in this Agreement are summaries only. The definitive permission matrix made available through the portal or documentation identifies the actions permitted at each access level. Seemi will not materially expand an access level in a way that increases security risk without reasonable notice, except where an urgent change is required to correct a security issue or comply with law. The Customer is responsible for reviewing the permission matrix, assigning the least level of access reasonably required, and regularly reviewing Authorised User access. ## 5. Services and shared responsibility ### 5.1 Services available Seemi may provide: - Hosting of Docker-containerised applications. - Deployment of supported open-source or preconfigured applications. - Hosting of Customer-provided container images made available through registries or credentials accessible to Seemi service accounts. - Persistent storage and data volumes. - S3-compatible object storage. - Automated backup, snapshot, point-in-time recovery and restoration features where identified for a SKU. - Image update, deployment, deletion, migration and other platform automation. - Optional Cloudflare proxying, caching and DDoS-related features. - Optional private networking for eligible Components, as described in Section 5.8. - Browser-based terminal access to eligible Components. - Migration of Components between infrastructure servers, as described in Section 16.6. - Support and managed-service features stated for the applicable SKU. ### 5.2 Customer-controlled operations Unless a SKU expressly states otherwise, deployment, update, backup, restore, scaling, stopping and deletion actions are initiated by the Customer through the portal. Automation by Seemi does not transfer responsibility for the Customer’s application or data to Seemi. ### 5.3 Seemi responsibilities Subject to the applicable SKU, Seemi is responsible for: - Operating the Seemi Cloud control plane and orchestration systems. - Administering infrastructure nodes used by Seemi. - Applying reasonable platform access controls and tenant isolation. - Operating platform-level monitoring and maintenance. - Applying host and platform updates within Seemi’s operational control. - Running purchased or included backup processes as described for the SKU. - Maintaining billing and usage records. - Responding to support, abuse and security matters according to this Agreement. ### 5.4 Customer responsibilities The Customer is responsible for: - Selecting a suitable SKU and Data Centre Region. - The legality, security, accuracy and operation of Customer Content. - Container images, application code, dependencies and licences. - Application and database configuration. - Secrets, tokens, certificates, credentials and user access. - Application-level authentication and authorisation. - Exposed application functionality and network traffic. - Testing backups and restores and retaining independent copies of critical data. - Determining regulatory, data-residency and localisation requirements. - Obtaining all permissions, notices, consents and lawful bases required for Customer Content. - Applying application-level updates unless expressly included in the SKU. - Choosing, for each Component, whether to enable public network access, private networking, IP allowlists or forward authentication, and the consequences of that choice. - Credentials and privileges issued to or created by the Customer, including database superuser and administrator credentials, and every action taken with them. - Commands, scripts and changes executed through browser terminal, command-line or administrative access. - The devices, operating systems and VPN client software used by Authorised Users to access the Private Network or the portal. - Keeping Authorised User access levels current, and promptly removing access that is no longer required. Actions performed using the Customer's credentials, through Authorised User accounts or devices, or through network access the Customer has enabled, are treated as actions of the Customer for the purposes of this Agreement. ### 5.5 Ports and network use Customers may use only ports and exposure methods supported by the applicable Seemi container and platform configuration. Seemi does not generally prohibit outbound traffic by port, but all traffic and activity must comply with this Agreement and applicable law. ### 5.6 Resource limits CPU, memory, disk, network, request, storage, retention and other limits are stated for each SKU or within the portal. Seemi may enforce these limits technically. The Customer must not circumvent or impair shared infrastructure. ### 5.7 Restricted and regulated data The Services are designed for general-purpose lawful workloads unless a SKU or written agreement expressly states otherwise. The Customer must not use the Services for Restricted Data where applicable law, a regulator, an industry standard or the Customer's own contractual obligations require controls, certifications, localisation, contractual terms or approvals that the selected SKU does not expressly provide. Without Seemi's prior written approval, the Customer must not use the Services to store or process: - Protected or regulated health information requiring healthcare-specific hosting commitments. - Government-classified information or information subject to government-only hosting requirements. - Biometric templates used for unique identification at material scale. - Data whose storage or remote access outside a specified jurisdiction is prohibited. - Workloads whose failure could reasonably result in death, serious personal injury or material physical or environmental damage. Approval to host Restricted Data may require an eligible SKU, additional Security Measures, a separate written agreement and additional charges. Seemi's acceptance of a workload does not constitute legal or regulatory advice or confirmation that the Customer's use is compliant. ### 5.8 Private networking **Availability.** Private networking is an optional, per-Component setting. It is available on eligible Paid SKUs without additional charge unless Published Information states otherwise. Availability on Free SKUs is not guaranteed. Public network access and private networking are separate settings, and either may be enabled or disabled by the Customer at any time. **How it works.** Components with private networking enabled join a Seemi-operated Private Network built on the open-source NetBird and WireGuard technologies. Network coordination is operated from the Amsterdam region, and relay servers may operate in each Data Centre Region. Private Network traffic is encrypted in transit. A Component with private networking enabled can exchange traffic with other Components in the same Resource Group that also have private networking enabled, across Data Centre Regions. **Who can connect.** Authorised Users with L1 or higher access to the relevant Resource Group or Tenant may connect to the Private Network from their devices using a NetBird client and Microsoft or Google sign-in. Access follows the Customer's portal permissions. The Customer decides who holds those permissions and is responsible for removing access that is no longer required. **Customer responsibilities.** The Customer must: - Secure the devices, operating systems, accounts and sign-in methods used to connect to the Private Network. - Not share Private Network access, sign-in sessions or devices with persons who are not permitted Authorised Users. - Disconnect and reconnect the client after a Component is deployed or redeployed, where required to refresh private routes. - Follow published client guidance, including disabling battery optimisation for the client on mobile devices where sign-in is affected. - Treat NetBird client software as third-party software supplied by its developers under their own licence terms. **Limits.** Private networking reduces network exposure but does not guarantee protection against every compromise. A device, account or credential that the Customer or its Authorised Users allow onto the Private Network can reach the Components available to that user. Seemi is not responsible for access obtained through Customer-authorised users, devices or credentials, subject to Section 23.5 (matters not limited). **Changes.** Seemi may change the Private Network design, relay locations, supported clients and connection requirements for operational, security or legal reasons. Other network topologies may be offered to enterprise Customers under a separate written agreement. ## 6. Component ordering, pricing and changes ### 6.1 Ordering Components A separate signed Order Form is not normally required. Before provisioning, the portal will display or make available the material commercial terms, including where applicable: - SKU and service description. - CPU, memory, storage and other specifications. - Data Centre Region. - Billing unit and current price. - Currency. - Backup inclusion or options. - Applicable discount, promotion or free period. - Estimated cost through the pricing calculator. Creating, resizing, restoring, duplicating or otherwise activating a Component constitutes an order under this Agreement and acceptance of the displayed terms by the Customer. ### 6.2 Usage records Seemi may retain an electronic record of the SKU, specifications, price, currency, region, discount, timestamp, Authorised User and action associated with a Component. Portal usage and statement records form evidence of consumption, subject to correction of demonstrated errors. ### 6.3 Billing granularity Unless a SKU states otherwise: - Usage is measured with daily billing as the minimum billing granularity. - A stopped but undeleted Component remains chargeable because resources, storage, configuration or reserved capacity may remain allocated. - Billing for a Component stops after the Component is successfully deleted, except for usage already incurred, separately retained data, backups, storage, reserved commitments or other surviving resources. ### 6.4 Pricing changes Seemi may change prices prospectively. For an existing paid Component, Seemi will normally provide at least 30 days’ notice of a material price increase unless the change results from tax, law, currency, urgent supplier pricing, security requirements or circumstances outside Seemi’s reasonable control. The Customer may delete the affected Component before the new price takes effect. ### 6.5 SKU changes and discontinuation Seemi may modify or discontinue a SKU. Seemi will normally provide reasonable notice and, where practicable, offer a replacement or migration path. Urgent changes may be made without advance notice where required for security, law, supplier availability or platform stability. ## 7. Billing, invoicing and payment ### 7.1 Currency and taxes The default invoice currency is AED unless another currency is expressly supported. Prices exclude taxes unless stated otherwise. Seemi is not currently registered for UAE VAT because it has not reached the applicable registration threshold. If Seemi becomes VAT registered or another tax becomes applicable, Seemi may add legally required taxes to invoices from the applicable date. ### 7.2 Statements and billed lines Customers may view usage and billed lines in their statement, normally through the previous day. Customers may raise a billing query or dispute before the monthly invoice is issued. ### 7.3 Monthly invoices Unless tenant-specific terms state otherwise: - Usage is invoiced monthly in arrears. - The invoice is normally issued on the first day of the month. - Payment is due by the fifth calendar day of that month. - Tenant-specific payment periods may be extended by written agreement. - Undisputed amounts remain payable by the due date. ### 7.4 Invoice disputes A Customer should submit a formal invoice dispute within 15 days after the invoice date and identify the disputed line, reason and supporting information. Seemi may investigate a later-reported billing error, and mandatory consumer rights are not lost solely because that period expired. ### 7.5 Corrections and credit notes Seemi may correct billing records as follows: - Uninvoiced errors may be corrected directly in the statement. - Invoiced overcharges may be corrected by credit note, statement adjustment, account credit or refund. - Underbilling caused by a genuine metering or administrative error may be corrected in a later statement or invoice, subject to applicable law and reasonable notice. ### 7.6 Payment methods Seemi uses Stripe-hosted payment interfaces. Customers may save or delete payment methods through supported flows. Where authorised, Seemi may attempt off-session collection of amounts due. Seemi does not store full payment-card data. Stripe provides Seemi with limited payment identifiers, card brand, expiry information, status, billing metadata and transaction records. ### 7.7 Failed and late payment If payment is not received when due, Seemi may: - Retry an authorised payment method. - Send reminders. - Restrict creation or modification of Components. - Suspend access to Components, Resource Groups or the tenant. - Retain amounts owed and recover reasonable collection costs where lawful. - Terminate Services and delete data under Section 20. Where reasonably practicable, Seemi will provide notice before non-urgent suspension. ## 8. Refunds, credits and promotions ### 8.1 Billing corrections Seemi may issue a credit or refund where: - Seemi billed an incorrect amount. - A duplicate or erroneous charge occurred. - A billed Service was unavailable for qualifying periods. - Seemi determines that exceptional circumstances justify an adjustment. - Applicable law requires it. ### 8.2 Method of correction Seemi will normally correct errors through a future statement adjustment or account credit. If the Customer reasonably requests a refund, or law requires one, Seemi may return an eligible amount to the original payment method where technically possible. ### 8.3 Credits Unless law requires otherwise: - Credits are applied to future Seemi Cloud charges. - Credits have no cash value and are non-transferable between tenants. - Credits may be allocated to the affected tenant only. - Promotional and Free SKU credits are non-refundable. - Seemi may apply a reasonable expiry period disclosed when the credit is issued. ### 8.4 Discounts and promotions Discounts may apply to particular SKUs, regions, periods or customers. Unless stated otherwise, a discount ends automatically at the end of its stated period and normal pricing then applies. --- # Part B: Acceptable use, safety and legal process ## 9. Acceptable Use Policy ### 9.1 Compliance with law The Customer must ensure that its use of the Services and its Customer Content comply with the laws that apply to the Customer and to that use. Where laws differ between countries, the Customer is responsible for determining which laws apply to it and how to comply with them. The prohibitions in Section 9.2 apply in all cases. ### 9.1A How Seemi handles content Seemi is content-neutral. It does not proactively review Customer Content against the content standards of any particular country, and it does not act on lawful opinions, beliefs or forms of expression merely because Seemi or others disagree with them. Seemi may act on specific content or activity only where: - It receives a complaint, legal request or order that Seemi is required to act on. - The content or activity falls within Section 9.2. - Continuing to host the content or activity would create a clear and serious legal, security or reputational risk for Seemi, its providers or the platform. Except where urgent action is legally required, Seemi will follow the review and notice process in Section 10 and will limit any action to the content or activity concerned wherever reasonably possible. ### 9.2 Prohibited activity The Customer must not use Seemi Cloud to create, host, transmit, facilitate or promote: - Malware, ransomware, botnets, credential theft or malicious code. - Phishing, fraud, deception, impersonation or unauthorised financial activity. - Unauthorised access, hacking, scanning, interception or disruption. - Spam or abusive bulk communications. - Child exploitation or abuse material. - Terrorism, violent extremist activity, trafficking or unlawful fundraising. - Illegal marketplaces or unlawful controlled goods or services. - Content that unlawfully infringes copyright, trademarks, privacy, confidentiality or other rights. - Unlawful disclosure or processing of personal data. - Sanctions evasion, money laundering or prohibited transactions. - Attacks or activity intended to exhaust or disrupt Seemi, supplier or third-party infrastructure. - Deliberate circumvention of technical limits or security controls. - Any other content or activity that is unlawful under Section 9.1. ### 9.3 Lawful workloads Seemi does not intend to prohibit a workload solely because it is resource-intensive or unconventional. such workloads are permitted only where: - The applicable SKU can support them. - They are lawful under Section 9.1. - They do not violate third-party rights or supplier rules. - They do not threaten platform security, stability or reputation. - Any necessary prior approval has been obtained. ### 9.4 Penetration testing and security research Penetration testing, scanning or security evaluation requires prior written alignment with Seemi. Approved testing must: - Be limited to authorised systems and scope. - Avoid production Customer Content unless specifically authorised. - Avoid service disruption or data access. - Follow agreed timing, source addresses and notification procedures. Seemi may support constructive testing on designated test systems. ### 9.5 Resource controls Seemi may rate limit, isolate, throttle or restrict a Component where usage materially threatens security, shared capacity, network reputation, supplier relationships or other customers. ### 9.6 Restricted container capabilities Unless expressly enabled by the applicable SKU or approved by Seemi in writing, the Customer must not deploy or attempt to deploy containers using: - Privileged container mode. - Host network, host process ID or host inter-process communication namespaces. - Direct access to a container-runtime or Docker socket. - Host-path mounts outside paths specifically assigned to the Component. - Kernel-module loading or modification of the host kernel. - Nested virtualisation. - Circumvention of CPU, memory, storage, network or security limits. - Public proxy, exit-node, anonymisation-relay, cryptomining, mass-scanning or similar high-abuse functionality. Seemi may block, isolate or remove an unsupported capability where reasonably necessary to protect the platform, suppliers, other customers or third parties. ## 10. Abuse reports and takedown process ### 10.1 Reporting Abuse, infringement and takedown requests must be sent to **cloud.legal@seemi.net** and should include: - The complainant’s legal name and contact information. - Authority to act, if represented by another person. - The exact hostname, URL, IP address, bucket, Component or other identifier. - A clear description of the alleged violation. - The applicable legal or rights basis. - Supporting evidence. - A good-faith declaration that the report is accurate. - Any urgency, safety or evidence-preservation considerations. Anonymous or incomplete reports may be reviewed but may receive lower priority unless they indicate serious or imminent harm. ### 10.2 Human review Seemi will use human review for material abuse and takedown decisions. Seemi may: - Validate the identity and authority of the complainant. - Review available technical and account information. - Seek clarification or additional evidence. - Notify the Customer and request a response. - Restrict public access through forward authentication. - Isolate, stop or suspend the affected Component. - Preserve relevant records. - Reject unsupported, unauthentic or overbroad requests. ### 10.3 Urgent intervention Seemi may act without prior notice where it reasonably believes there is: - An imminent threat to people, systems or data. - Clearly unlawful or seriously harmful activity. - Active malware, phishing, fraud or attack traffic. - A binding legal direction. - A serious violation of supplier requirements. - A material risk to Seemi or shared infrastructure. Where feasible, Seemi will target the affected Component rather than the entire tenant. ### 10.4 Customer response and appeal For non-urgent cases, Seemi may provide the Customer with a reasonable opportunity to respond, normally up to five business days unless the issue requires faster action. A Customer may submit evidence, remediation details or a counter-notice to **cloud.legal@seemi.net**. ### 10.5 No automatic deletion or disclosure A takedown allegation alone does not automatically authorise deletion or disclosure of Customer Content. Seemi may restrict availability while evaluating the matter. Deletion or disclosure to an external party will occur only after appropriate human, technical and legal evaluation and where authorised by the Customer, required to operate the Service, or required by valid legal process. ## 11. Government, law-enforcement and legal requests ### 11.1 Submission and review Authorities should send requests to **cloud.legal@seemi.net**. Seemi will seek to verify: - The requesting authority and representative. - Jurisdiction and legal basis. - Authenticity and validity. - Scope and specificity. - Whether the request is binding on Seemi. - Whether notification is legally permitted. ### 11.2 UAE legal process Seemi will comply with binding obligations under UAE law and valid directions of competent UAE authorities. Seemi may seek legal advice, clarification, narrowing or review where a request appears unclear, excessive or defective. ### 11.3 Foreign requests A foreign request that is not directly binding on Seemi may be evaluated for credible abuse or immediate safety concerns. Where allegations are not independently supported and the request is not binding, Seemi may require the requesting authority to use applicable formal legal channels capable of producing a valid request enforceable in the UAE. ### 11.4 Data disclosure Where disclosure is legally required, Seemi will seek to: - Disclose only data within the valid scope. - Use human approval. - Maintain a record of the decision. - Notify the Customer unless prohibited by law or likely to create serious harm. - Preserve confidentiality and security during transfer. Seemi does not promise that a court order is the only valid form of legal authority. ### 11.5 Preservation Seemi may preserve identified data for a reasonable period where required by valid legal process or reasonably necessary to protect rights, investigate fraud, resolve a dispute or prevent deletion while legal validity is assessed. ## 12. Restricted jurisdictions and sanctioned parties Seemi may refuse, restrict or terminate Services where providing them would expose Seemi, its bank, payment processor or supplier to sanctions, export controls, prohibited-party restrictions or material legal risk. Restrictions may include countries or territories subject to applicable UAE or United Nations measures and any restriction binding on Seemi’s financial or infrastructure providers. The applicable restrictions may change and may be broader or narrower than a country-wide prohibition. The Customer represents that it is not using the Services for or on behalf of a prohibited person, entity, transaction or destination. --- # Part C: Privacy and data processing ## 13. Privacy notice for Seemi account data ### 13.1 Scope and Seemi's role This Section applies to Personal Data for which Seemi determines the purposes and means of processing, including account, billing, authentication, support, security, abuse-prevention, legal and business-administration information. For that processing, Seemi acts as an independent controller or equivalent responsible business under Applicable Data Protection Law. Customer Personal Data processed by Seemi on the Customer's behalf is governed by Section 14. ### 13.2 Information collected Seemi may collect and process: - Legal name, organisation name, registration details and authority information. - Email addresses, billing address and tax information. - Tenant, Resource Group, Component and Authorised User identifiers. - Microsoft or Google identity identifiers and authentication events. - IP addresses, browser, device, login and audit information. - Usage, metering, performance, network and security metadata. - Support, billing, abuse and legal communications. - Stripe payment references and transaction metadata, but not full payment-card numbers handled through Stripe-hosted interfaces. - Customer Content accessed during authorised support, restoration, security, abuse or legal review. - Private Network connection information, such as device names, private network addresses, connection times and sign-in identity. - For Referral Partners: application details, promotional channels, referral codes, attribution and commission records, payout method details, and the identity, sanctions and tax information required to make payouts. ### 13.3 Purposes and legal grounds Seemi may process account and operational Personal Data to: - Create and administer Tenants and Authorised Users. - Authenticate users and enforce permissions. - Provision, meter, bill, maintain and support the Services. - Process payments, credits and refunds. - Maintain platform security and availability. - Prevent, detect and investigate fraud, abuse and security incidents. - Send essential operational, billing, contractual, security and legal notices. - Maintain legally required financial, tax, corporate and transaction records. - Establish, exercise or defend legal claims. - Comply with applicable law and valid legal process. - Improve reliability, capacity planning and service operation using information limited to what is reasonably necessary for those purposes. Where required by Applicable Data Protection Law, Seemi will identify and rely on an appropriate legal ground, which may include performance of a contract, compliance with a legal obligation, consent, protection of legal rights, or a legitimate or legally recognised operational interest that is not overridden by the rights of the affected individual. Optional promotional communications will be distinguished from essential service communications. An individual may opt out of optional promotional communications using the method provided in the communication or by contacting Seemi. ### 13.4 No sale or unrelated advertising use Seemi does not sell account Personal Data. Seemi does not use account Personal Data for third-party behavioural advertising, data-broker activities or unrelated third-party marketing. Seemi may market its own Services to business contacts where permitted by law, subject to applicable notice, consent and opt-out requirements. Seemi will not use UAE Consumer data for promotional or marketing purposes where prohibited by applicable UAE consumer law. ### 13.5 Data minimisation and accuracy Seemi will seek to limit Personal Data to what is reasonably required for the stated purposes. Customers and Authorised Users must keep their account and contact information accurate and current. ### 13.6 Individual rights and requests Privacy requests may be sent to **cloud.legal@seemi.net**. Subject to Applicable Data Protection Law, an individual may request access, correction, deletion, restriction, objection, portability, withdrawal of consent, review of certain automated decisions, or any other available right. Seemi may verify the identity and authority of the requester before acting. Seemi may decline or limit a request where permitted or required by law and will provide an explanation where legally required. A request concerning Customer Personal Data should ordinarily be directed to the relevant Customer, which determines how that data is used. Seemi will provide assistance as described in Section 14. ### 13.7 Retention Seemi will retain Personal Data only for as long as reasonably necessary for the relevant purpose, including: - Active account and service administration. - Billing, tax, accounting and transaction-record obligations. - Security, fraud and abuse prevention. - Dispute resolution and applicable legal limitation periods. - Backup rotation and technical deletion cycles. - Compliance with valid preservation or legal obligations. An account-deletion request does not require deletion of information that Seemi must retain by law or reasonably requires to prevent fraud, prove transactions, establish legal rights or protect platform security. Retained information will remain protected and its use limited to the applicable retention purpose. ### 13.8 International processing Seemi's core platform and Private Network coordination are hosted in the Amsterdam region, as described in Section 15.5. Seemi and its providers may process limited account, support, security and operational information outside the region selected for Customer Content. Customer Content is ordinarily stored in the selected or disclosed region, subject to enabled backups, replication, support access, migration, legal requirements and disclosed Subprocessors. Where Applicable Data Protection Law requires a transfer mechanism, Seemi will use the applicable contractual or legally recognised safeguard described in Section 14 or the relevant regional privacy schedule. ### 13.9 Privacy contact and data-protection officer Privacy questions and requests may be sent to **cloud.legal@seemi.net**. Seemi will appoint a data-protection officer where required by Applicable Data Protection Law and will publish the relevant contact details. ## 14. Data Processing Agreement ### 14.1 Scope and roles This Section forms a binding Data Processing Addendum between the Customer and Seemi and applies when Seemi processes Customer Personal Data on behalf of the Customer. For Customer Personal Data: - The Customer acts as controller or as a processor acting on another controller's instructions. - Seemi acts as processor or Subprocessor on the Customer's behalf. - Each party will comply with the obligations applicable to its role under Applicable Data Protection Law. For Seemi's own account administration, billing, fraud prevention, security, legal compliance and business records, Seemi may act as an independent controller as described in Section 13. Where the GDPR applies, this Section is intended to satisfy the processor-contract requirements of Article 28 GDPR. Equivalent terms will be interpreted to satisfy corresponding requirements under other Applicable Data Protection Law. ### 14.2 Documented instructions The Customer instructs Seemi to process Customer Personal Data only as reasonably necessary to: - Provide, secure, maintain, meter and support the Services. - Host, transmit, store, back up, restore and delete Customer Content. - Perform Customer-requested deployment, migration, support and administrative actions. - Prevent, detect and investigate fraud, abuse and security incidents. - Comply with the Agreement and the Customer's documented use of Service controls. - Comply with applicable law or valid legal process. The Agreement, the Customer's configuration and use of the Services, support requests, and other written instructions accepted by Seemi constitute documented instructions. Seemi will not process Customer Personal Data for an independent purpose except where required by applicable law. If legally permitted, Seemi will inform the Customer before carrying out legally required processing. If Seemi reasonably believes that an instruction infringes Applicable Data Protection Law, Seemi will inform the Customer without undue delay unless prohibited by law. Seemi may suspend the affected processing until the parties resolve the concern. ### 14.3 Processing details - **Subject matter:** Hosting, transmission, storage, backup, recovery, security, support and deletion of Customer Content. - **Duration:** The lifetime of the affected Tenant, Component or Service, plus applicable backup-expiry, export, retention and lawful-preservation periods. - **Nature of processing:** Collection, recording, organisation, storage, retrieval, transmission, access, encryption, backup, restoration, restriction, migration, deletion and destruction. - **Purposes:** Supplying, securing, maintaining, supporting and terminating the Services according to the Customer's documented instructions. - **Categories of data subjects:** Customer personnel, contractors, users, consumers, visitors, suppliers and other individuals whose Personal Data the Customer submits to the Services. - **Types of Personal Data:** Identity, contact, account, technical, employment, transaction, communication, application, content and other data selected and controlled by the Customer. - **Sensitive data:** Seemi does not require the Customer to submit sensitive or Restricted Data. If the Customer submits such data, the Customer is responsible for ensuring that the selected SKU, region, safeguards, notices, permissions and legal grounds are appropriate. - **Customer rights and obligations:** The Customer determines the purposes and essential means of processing, issues lawful instructions, responds to data-subject requests, provides required notices, selects an appropriate region and SKU, configures access and retention, and meets its obligations as controller or processor. ### 14.4 Customer obligations The Customer represents and warrants that: - It has a lawful basis, authority and documented instructions for Customer Personal Data. - It has provided required privacy notices and obtained any required permissions or consents. - Its instructions comply with Applicable Data Protection Law. - It will not instruct Seemi to process Personal Data in a manner that violates applicable law. - It will not use the Services where a law, regulator or contract requires controls, certifications, localisation or terms that the selected SKU does not expressly provide. - It will appropriately configure authentication, permissions, encryption, network access, backup and retention. - If the Customer acts as a processor, its instructions and appointment of Seemi as a Subprocessor are authorised by the relevant controller. ### 14.5 Confidentiality and authorised access Seemi will limit access to Customer Personal Data to authorised personnel and contractors who require access for an authorised purpose. Persons authorised to access Customer Personal Data will be subject to contractual or legal confidentiality obligations. Access may occur only as reasonably necessary for service provision, support, maintenance, restoration, security, abuse investigation, migration or legal compliance. Where practicable, production access will be approved, time-limited and logged. ### 14.6 Security Measures Seemi will implement and maintain reasonable technical and organisational measures appropriate to the nature of the Services and the risk to Customer Personal Data. These measures will be described in the applicable Technical and Organisational Measures Schedule and may include: - Identity and role-based access controls. - Multifactor authentication for privileged Seemi administrative access where supported. - Restrictions and logging for production administrative access. - Tenant and Resource Group authorisation controls. - Encryption for supported internet-facing connections in transit. - Provider-side or backup encryption where described for the applicable SKU. - Host, platform and orchestration hardening and patching within Seemi's operational control. - Vulnerability-management and incident-response processes. - Operational monitoring and security logging. - Backup, restoration and business-continuity capabilities described for the applicable SKU. - Personnel confidentiality and access-revocation processes. - Periodic assessment of material Security Measures. Internet-facing TLS may terminate at a reverse proxy or load balancer. Traffic within a host or trusted internal service boundary may not always use TLS. Customers requiring application-layer or end-to-end encryption must implement and manage it within their applications unless the applicable SKU expressly provides it. Seemi may update Security Measures to reflect technical development, provided that Seemi does not materially reduce the overall security of the affected Service during a subscription period without a legitimate security, legal, supplier or operational reason. ### 14.7 Personal Data Breaches Seemi will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. Seemi may provide information in phases as its investigation progresses. To the extent known and legally permitted, notification may include: - The nature of the Personal Data Breach. - The affected systems, data categories and approximate scope. - Known or reasonably anticipated consequences. - Measures taken or proposed to contain, investigate and remediate the incident. - A contact point for follow-up. Seemi will take reasonable steps to contain, investigate and mitigate the Personal Data Breach and will provide reasonable cooperation required by Applicable Data Protection Law. Notification does not constitute an admission of fault or liability. The Customer is responsible for determining whether notification to a regulator, data subject or other party is required from the Customer and for making that notification, unless applicable law directly requires Seemi to do so. ### 14.8 Data-subject requests If Seemi receives a request relating primarily to Customer Personal Data, Seemi may direct the requester to the Customer unless prohibited by law. Taking into account the nature of processing, Seemi will provide reasonable assistance through available Service functionality and appropriate technical or organisational measures to help the Customer respond to requests under Applicable Data Protection Law. If assistance requires material bespoke work beyond standard Service functionality, Seemi may charge reasonable fees where permitted by law and agreed in advance. ### 14.9 Compliance, impact assessments and regulatory cooperation Taking into account the nature of processing and information available to Seemi, Seemi will provide reasonable assistance with: - Security-of-processing obligations. - Personal Data Breach assessment and notification. - Data-protection impact assessments. - Prior consultation with a competent supervisory authority. - Information reasonably necessary to demonstrate Seemi's compliance with this Section. Seemi will cooperate with a competent data-protection authority where required by applicable law. ### 14.10 Audits Seemi may satisfy routine compliance requests using current policies, questionnaires, architecture descriptions, Security Measure summaries, available independent reports and relevant supplier documentation. Where those materials are proven insufficient to demonstrate compliance with a mandatory obligation, the Customer may request an additional audit. An additional audit must: - Be reasonably necessary and proportionate to the relevant risk. - Normally occur no more than once in a 12-month period, unless required by law or following a material Personal Data Breach. - Be conducted on reasonable prior written notice during normal working hours. - Use an independent qualified auditor subject to confidentiality obligations. - Avoid access to other customers' information, security-sensitive systems and supplier-confidential information. - Minimise disruption to Seemi and its providers. - Be conducted remotely where remote review can reasonably satisfy the audit objective. The Customer will bear reasonable audit costs unless the audit identifies a material breach by Seemi of this Section or Applicable Data Protection Law, or mandatory law requires otherwise. Direct access to shared infrastructure, source code, vulnerability details, credentials, data-centre premises or systems controlled by a third-party provider is not required where alternative evidence reasonably demonstrates compliance or access would create a material security or confidentiality risk. ### 14.11 Subprocessors The Customer grants Seemi general written authorisation to engage the Subprocessors listed in Section 15 or in Seemi's published Subprocessor schedule. Seemi will: - Use a written agreement requiring each Subprocessor to protect Customer Personal Data using obligations materially equivalent to those applicable to Seemi for the Subprocessor's processing. - Limit the Subprocessor's processing to the services it performs for Seemi and the Customer. - Remain responsible to the Customer for the Subprocessor's performance of its applicable data-protection obligations, subject to the liability provisions of the Agreement. - Maintain an updated Subprocessor schedule identifying the provider, purpose and relevant processing location or region. - Provide notice of a material new or replacement Subprocessor where required by Applicable Data Protection Law. A Customer may object to a material new Subprocessor on reasonable, substantiated data-protection grounds by notifying **cloud.legal@seemi.net** within the objection period stated in the notice. Seemi will consider reasonable alternatives. If no commercially reasonable alternative is available, either party may discontinue the affected Service before the Subprocessor begins processing Customer Personal Data. Discontinuation does not relieve the Customer of charges already incurred. ### 14.12 Return, export and deletion During an active Service, the Customer may retrieve or export Customer Content using available Service functionality. Upon termination of the relevant Service and at the Customer's choice, Seemi will delete or make available for return Customer Personal Data where technically feasible, subject to: - The Customer submitting its instruction before the applicable deletion deadline. - Available export functionality and reasonable technical limitations. - Payment of agreed charges for material bespoke export work. - Legal-retention and preservation obligations. After the applicable export or retention period, Seemi will delete or render inaccessible Customer Personal Data in active systems according to its ordinary deletion process. Residual copies may remain in access-restricted backups until expiry or overwrite through ordinary backup cycles. During that period, Seemi will not use residual data for another purpose and will continue to protect it under this Section. ### 14.13 International transfers The Customer authorises Seemi and its Subprocessors to process Customer Personal Data in the regions and locations identified in the Agreement, the portal, the applicable SKU and the Subprocessor schedule. Where a transfer of Customer Personal Data requires a transfer mechanism under Applicable Data Protection Law, the parties will use the applicable mechanism identified in a regional privacy schedule, including where appropriate: - An adequacy decision or recognised destination. - The European Commission's then-applicable Standard Contractual Clauses. - The applicable United Kingdom international data-transfer addendum or agreement. - Another legally recognised safeguard. Seemi will provide reasonable information regarding relevant data flows and Security Measures to support the Customer's transfer assessment. The Customer remains responsible for determining whether its use, selected region, instructions and data categories are lawful for the Customer. If a required transfer mechanism becomes invalid or unavailable, the parties will cooperate in good faith to implement a lawful alternative. Seemi may suspend an affected transfer or Service if continued processing would violate applicable law and no reasonable alternative is available. ### 14.14 No sale, advertising, profiling or AI training Seemi does not sell Customer Content or Customer Personal Data. Seemi does not use or disclose Customer Content or Customer Personal Data for: - Behavioural or targeted advertising. - Data-broker activities. - Marketing unrelated products or services to data subjects identified in Customer Content. - Creating advertising profiles. - Providing services to another customer using the Customer's identifiable data. - Training, fine-tuning, grounding, evaluating or improving any general-purpose or third-party artificial-intelligence or machine-learning model. The restriction on artificial-intelligence and machine-learning use applies to private container images, private source code, databases, files, objects and other private workload information included in Customer Content. Seemi may use aggregated or de-identified operational information to secure, operate, measure and improve the Services only where the information cannot reasonably identify the Customer, an Authorised User, a data subject or the content of a Customer workload. Seemi will not attempt to re-identify that information. Seemi may use automated systems to provide Customer-requested Service functionality, malware detection, abuse prevention, security monitoring, troubleshooting or operational support, provided that such processing remains limited to supplying and protecting the Services and is not used for general-purpose model training. ### 14.15 United States service-provider and processor restrictions Where Seemi processes Personal Data subject to an applicable United States state privacy law on behalf of the Customer, Seemi will act as a service provider, contractor or processor to the extent those terms apply. Seemi will not: - Sell or share Customer Personal Data for cross-context behavioural advertising. - Retain, use or disclose Customer Personal Data outside the direct business relationship with the Customer except as permitted by the Agreement and applicable law. - Combine Customer Personal Data with Personal Data received from or collected on behalf of another person, except where permitted by applicable law and reasonably necessary to provide or secure the Services. Seemi will process Customer Personal Data only for the specific business purposes described in this Section, provide the level of privacy protection required of its applicable role, notify the Customer if Seemi determines it can no longer meet an applicable obligation, and permit reasonable steps by the Customer to verify and remediate Seemi's use of Customer Personal Data as required by applicable law. ### 14.16 Conflict If this Section conflicts with another part of the Agreement concerning the processing of Customer Personal Data, this Section prevails for that subject matter, unless a signed tenant-specific amendment or an applicable mandatory-law schedule provides greater protection. ## 15. Subprocessors and infrastructure providers ### 15.1 General authorisation and Subprocessor transparency The Customer authorises Seemi to use the Subprocessors and infrastructure providers identified in this Section and in Seemi's then-current online Subprocessor schedule. The Subprocessor schedule will identify, as applicable: - The provider's legal name. - The service or processing purpose. - The categories of information involved. - The principal processing location or applicable region. - Whether the provider may store Customer Content or only limited account, support, security or operational information. Seemi may replace or add providers where reasonably necessary. For a material new or replacement Subprocessor that will process Customer Personal Data, Seemi will normally provide at least 15 days' prior notice where practicable and where required by Applicable Data Protection Law. A Customer may raise a substantiated data-protection objection under Section 14.11. Seemi will consider reasonable alternatives but is not required to redesign the Services or use a provider that does not meet Seemi's technical, security, legal or commercial requirements. ### 15.2 Leaseweb compute providers Seemi uses regional Leaseweb entities to provide compute, network, data-centre, connectivity, DDoS-protection and related infrastructure services. The applicable provider depends on the Data Centre Region selected for the Component: | Seemi region | Compute location | Leaseweb entity | Primary purpose | | ------------ | --------------------------------------------------------- | ---------------------------- | ------------------------------------------------------------------------------------------------ | | AMS | Amsterdam region, Netherlands | Leaseweb Netherlands B.V. | Compute, network, data-centre, connectivity, DDoS-protection and related infrastructure services | | WDC | Manassas, Virginia (Washington, D.C. area), United States | Leaseweb USA, Inc. | Compute, network, data-centre, connectivity, DDoS-protection and related infrastructure services | | LAX | Los Angeles, United States | Leaseweb USA, Inc. | Compute, network, data-centre, connectivity, DDoS-protection and related infrastructure services | | SIN | Singapore | Leaseweb Singapore Pte. Ltd. | Compute, network, data-centre, connectivity, DDoS-protection and related infrastructure services | Leaseweb Netherlands B.V. also hosts Seemi's core platform (control plane) and Private Network coordination in the Amsterdam region, as described in Section 15.5. Private Network relay servers may be hosted by the regional Leaseweb entity in each Data Centre Region. The applicable Leaseweb entity may process Customer Content stored or transmitted through the relevant infrastructure, including container images, application and database data, persistent-volume data, IP addresses, traffic metadata, infrastructure identifiers, operational logs, security information and diagnostic information required to provide and protect the Services. Customer workload content is ordinarily hosted in the selected Data Centre Region. Limited account, support, security, network and diagnostic information may be processed from other locations where reasonably necessary to provide support, maintain security, respond to incidents or comply with applicable law. Seemi may add further Leaseweb regions or replace a regional Leaseweb entity. Before a material new Leaseweb entity begins processing Customer Personal Data, Seemi will update its Subprocessor schedule and provide any notice required by Section 14.11 and Applicable Data Protection Law. --- ### 15.3 IDrive e2 S3-compatible object storage **Provider:** IDrive Inc. **Service:** IDrive e2 S3-compatible object storage. **Purpose:** Customer object storage, container and volume backups, database backups, snapshots, restoration data and related storage, security and operational metadata. The following storage regions may be made available through Seemi: | Storage location | Country | IDrive e2 region code | | ---------------- | -------------- | --------------------- | | Oregon | United States | `us-west-4` | | Los Angeles | United States | `us-west-2` | | Virginia | United States | `us-east-1` | | Dallas | United States | `us-central-1` | | Phoenix | United States | `us-southwest-1` | | Chicago | United States | `us-midwest-1` | | Miami | United States | `us-southeast-1` | | Ireland | Ireland | `eu-west-1` | | London | United Kingdom | `eu-west-3` | | Paris | France | `eu-west-4` | | Frankfurt | Germany | `eu-central-1` | | Milan | Italy | `eu-south-1` | | Singapore | Singapore | `ap-southeast-1` | | Tokyo | Japan | `ap-northeast-1` | Not every storage region is necessarily available for every Service. Available regions are displayed during provisioning or identified in the applicable SKU or Service documentation. For a directly provisioned storage account, the Customer selects an available storage location during provisioning. Object data is ordinarily stored in the selected storage region. For managed backups, Seemi normally uses the following storage mapping unless a different location is disclosed during provisioning or in the applicable SKU: | Seemi compute region | Normal backup-storage location | IDrive e2 region code | | -------------------- | ------------------------------ | --------------------- | | AMS | Frankfurt | `eu-central-1` | | WDC | Virginia | `us-east-1` | | LAX | Los Angeles | `us-west-2` | | SIN | Singapore | `ap-southeast-1` | Backups of Seemi's core platform records are stored in Frankfurt (`eu-central-1`). IDrive Inc. may process Customer objects, files, backups, snapshots, object metadata, bucket and storage-account identifiers, IP addresses, connection metadata, access and security logs, usage measurements and diagnostic information required to provide and protect the storage service. Limited account, support, authentication, security, diagnostic and billing information may be processed outside the selected storage region. Authorised remote access may occur where reasonably necessary for support, maintenance, restoration, security, incident response or compliance with applicable law. Cross-region replication is not enabled unless requested or configured by the Customer, expressly included in the applicable SKU with the destination disclosed, reasonably required for a Customer-requested migration or restoration, urgently required to protect service continuity, or required by applicable law. Where storage, remote access or associated processing constitutes an international transfer under Applicable Data Protection Law, the transfer is governed by Section 14.13 and any applicable regional transfer schedule. ### 15.4 Other providers | Provider | Purpose | Information involved | | ------------------- | ---------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ | | Stripe | Hosted payment collection, saved payment methods, off-session payment attempts, refunds and fraud controls | Billing identity, payment metadata, transaction status and payment information handled by Stripe | | Amazon Web Services | Transactional, operational and support email delivery | Recipient email address, message content and delivery metadata | | Microsoft | Single sign-on authentication | Identity, authentication and security metadata | | Google | Single sign-on authentication | Identity, authentication and security metadata | | Cloudflare | DNS, tunnelling, caching, access controls and DDoS-related protection | IP addresses, web traffic, request metadata and cached content where configured | | Tawk.to | Customer service chats/messages | IP addresses, Customer messages, Web access analytics. | Seemi will identify the applicable contracting provider entity and principal processing location in its published Subprocessor schedule when that provider processes Customer Personal Data. ### 15.5 Core platform and operational-data region Seemi's core platform (the "backplane"), including its database, control-plane records, configuration, billing records and operational information, is primarily hosted on Leaseweb infrastructure in the Amsterdam region unless otherwise disclosed. Backups of the core platform are stored in Frankfurt. The core platform holds metadata and configuration needed to operate the Services. Customer workload content, such as application data, databases, volumes and objects, is held in the Data Centre Region and storage region selected for each Component, not in the core platform. Private Network coordination servers are also hosted in the Amsterdam region. Relay servers may operate in each Data Centre Region to carry encrypted Private Network traffic between peers. Depending on the Service and Customer configuration, core platform and operational information may include: - Tenant, Resource Group and Component identifiers. - User and permission records. - Provisioning state and infrastructure identifiers. - Usage and billing measurements. - Authentication, audit, security and support records. - Logs, diagnostic information reasonably necessary to operate or support the Services. - Private Network peer information, such as device names, private network addresses, connection metadata and sign-in identity. - Referral Program records, such as referral codes, attribution, commission and payout records. Seemi will not intentionally copy the substantive contents of Customer databases, objects, private container images or application files into platform analytics except where reasonably necessary for Customer-requested support, security investigation, restoration, migration or legal compliance. The selected workload or storage region controls the ordinary location of Customer workload content, subject to disclosed backup regions, enabled replication, authorised remote access, migration, valid legal requirements and the Subprocessor schedule. ### 15.6 Subprocessor use restrictions Seemi will contractually restrict Subprocessors from using Customer Content or Customer Personal Data for the Subprocessor's own advertising, data-broker activities, unrelated product development or general-purpose artificial-intelligence model training. A Subprocessor may process Customer Content only to provide its contracted services to Seemi, comply with applicable law, or protect the security and integrity of its services, subject to applicable contractual and legal restrictions. --- # Part D: Backups, availability and support ## 16. Backups, recovery and data durability ### 16.1 SKU-specific coverage Backup and recovery coverage differs by SKU. Before relying on a backup feature, the Customer must review: - Whether backup is included or separately purchased. - Covered paths, volumes, databases and exclusions. - Backup frequency and retention. - Backup storage region. - Encryption method. - Whether backup is filesystem-level or application-consistent. - Whether point-in-time recovery is available. - Restore procedure, likely recovery point and charges. Only features expressly identified in the applicable SKU, portal or written order are included. ### 16.2 Backup methods Seemi may use: - Encrypted Restic snapshots for eligible container files and volumes. - SKU-specific backup tooling identified in the SKU documentation, i.e pgBackRest for eligible PostgreSQL Services, xbcloud for MySQL. - Encrypted S3-compatible buckets for backup storage. Where supported, the portal allows Customers to view eligible snapshots and initiate restoration. Portal visibility does not by itself confirm that a snapshot is application-consistent or suitable for a particular recovery objective. ### 16.3 No absolute backup guarantee Backups reduce risk but do not eliminate it. Unless an applicable SKU expressly provides a specific commitment, Seemi does not guarantee that every backup will: - Complete successfully. - Include every file, object or transaction. - Be application-consistent. - Be unaffected by corruption, malware or Customer error. - Remain recoverable after multiple independent failures. - Meet a particular recovery point or recovery time objective. This clause does not exclude Seemi's obligation to exercise reasonable care in operating a purchased backup feature or any liability that cannot lawfully be excluded. ### 16.4 Customer backup duties The Customer must: - Maintain independent copies of critical data appropriate to its risk. - Regularly test restoration. - Use application-aware backup methods for transactional applications where required. - Monitor backup status and respond to reported failures. - Protect backup credentials and encryption keys under its control. - Avoid treating one backup system, region or provider as the sole copy of irreplaceable data. ### 16.5 Region and encryption Seemi normally stores backups in a nominated S3-compatible storage location for each Data Centre Region, typically in a different datacentre from the server running the Component. The normal mappings are listed in Section 15.3; for example, Amsterdam backups are stored in Frankfurt and Washington DC backups in Virginia. Any other location will be disclosed in the applicable SKU, portal or service documentation. By default, backups are stored in a single storage location unless Seemi and the Customer expressly agree cross-region replication for specific buckets. Restic snapshots are normally encrypted before or during storage as described for the applicable SKU. Database-specific backups may use client-side encryption, provider-side bucket encryption or both. The applicable SKU will identify whether encryption keys are managed by Seemi, the Customer or the storage provider. ### 16.6 Server migration and restoration Seemi may move Components between infrastructure servers, normally within the same Data Centre Region, for maintenance, capacity, security or failure recovery. **Planned maintenance.** Seemi may migrate Components before planned server maintenance. A brief interruption should be expected while a Component moves. **Unplanned server failure.** If a server becomes unavailable: - Components without persistent binds, mounts or volumes may be redeployed automatically on another server, with an interruption while they restart. - Components with persistent data, including databases, are restored from the latest available backup on another server only after the Customer approves the restoration in the portal. The Customer may approve, delay or decline. Seemi is not responsible for unavailability or loss while approval is pending or after the Customer declines or delays. **Recovery point.** Restoration returns data to the latest usable backup or, where available for the SKU, a point-in-time recovery point. Transactions or changes made after that point may be lost. By approving a restoration, the Customer accepts the recovery point offered. Components without an available backup, including Free SKU Components on which the Customer has not run a manual backup, may not be recoverable. **After restoration.** Restoration may require a replacement Component, network transfer and configuration changes. The Customer is responsible for validating the restored application and data before resuming normal operation, and for reconnecting clients, including Private Network clients, where required. ### 16.7 Backup deletion and expiry Deleting a Component does not necessarily delete its separately retained backups immediately upon undeployment. Backup retention and billing continue according to the applicable SKU until the hold period expires and customer performs a full delete of the resource. Expired or deleted backups may remain temporarily in access-restricted provider systems until overwritten or removed through ordinary technical deletion cycles. During that period, they will remain subject to the confidentiality and data-processing restrictions in this Agreement. ### 16.8 Free SKU backups and storage charges Free SKUs do not include automated or scheduled backups. Where a Free SKU supports it, the Customer may run a manual backup from the portal. Seemi has no obligation to back up Free SKU Components, and the Customer is solely responsible for deciding when to run manual backups and for keeping independent copies. Storage used by Components and backups beyond the amount included in a SKU is charged at the published rates on any SKU, including Free SKUs. A Free SKU is free only within its stated allowance. When a Free SKU Component's SSD or backup storage exceeds that allowance, the excess is billed and invoiced like any other charge. Unpaid charges for a Free SKU are treated like any other unpaid charges. Under Sections 7.7 and 20, Seemi may stop the Component or make it inaccessible and, after continued non-payment, delete the Component and its Customer Content, including backups. The Customer is responsible for monitoring its storage use and keeping it within the allowance if it does not wish to be charged. ## 16A. S3-compatible object storage service terms ### 16A.1 Compatibility “S3-compatible” means that the Service supports identified application programming interfaces or behaviours commonly associated with Amazon S3. It does not mean that every Amazon S3 API, feature, storage class, performance characteristic, availability commitment or management function is supported. Supported functionality and known limitations will be described in the applicable SKU or documentation. The Customer must test compatibility with its applications before relying on the Service for production use. ### 16A.2 Storage region The Customer may select from storage regions made available during provisioning. Object data is ordinarily stored in the selected region, subject to disclosed provider operations, enabled replication, authorised support access, legal requirements and Subprocessors. The location of account, billing, authentication, diagnostic and security metadata may differ from the selected object-storage region as described in Sections 13 and 15. ### 16A.3 Credentials and access The Customer is responsible for: - Protecting storage access keys and credentials. - Using separate credentials where appropriate. - Rotating or revoking exposed or unnecessary credentials. - Configuring bucket and object permissions. - Reviewing public-access settings. - Restricting application and user access according to least privilege. Seemi may revoke or rotate credentials where reasonably necessary to respond to a security incident, legal requirement or credible risk. Where practicable, Seemi will notify the Customer. ### 16A.4 Public access Where public bucket or object access is supported, enabling that access is a Customer instruction to make the relevant information publicly accessible. The Customer is responsible for ensuring that public access is intentional, lawful and appropriately limited. Seemi may restrict public access where reasonably necessary to respond to abuse, a Personal Data Breach, a security incident, a valid legal request or a material violation of this Agreement. ### 16A.5 Encryption The applicable SKU or documentation will identify whether the Service uses: - Provider-side encryption. - Seemi-managed encryption. - Customer-managed encryption. - Client-side encryption. Unless expressly stated otherwise, Customer-managed or client-side encryption is the Customer's responsibility. Loss of a Customer-controlled encryption key may make data permanently inaccessible, and Seemi may be unable to recover it. ### 16A.6 Versioning, lifecycle and object lock Versioning, lifecycle expiry, legal hold and object-lock functionality are available only where expressly supported by the applicable SKU. Where the Customer enables lifecycle expiry, version deletion or another automated deletion rule, operation of that rule constitutes a documented Customer instruction. Deletion may be irreversible. The Customer must not rely on object immutability, retention lock or legal hold unless the applicable SKU expressly confirms the relevant capability and configuration. ### 16A.7 Deletion Deleting an object, object version, bucket or storage account may be irreversible. Versioned objects, incomplete multipart uploads, retained backups or objects protected by an applicable retention control may require separate deletion or may remain billable. After logical deletion, residual copies may remain temporarily in access-restricted provider systems until removed through ordinary technical deletion cycles or applicable retention expiry. ### 16A.8 Data integrity Where supported, the Customer should use available checksums, object metadata and application-level validation to confirm integrity after upload, download, transfer or restoration. Seemi does not guarantee detection of every form of application-level corruption. ### 16A.9 Availability and durability An availability or durability commitment applies only where expressly stated in the applicable object-storage SKU or SLA. The general Component Availability SLA does not automatically apply to storage API operations, storage-provider durability, the management portal and Customer applications unless expressly stated. ### 16A.10 Requests, transfer and charges Storage pricing may include separate charges or allowances for: - Stored capacity. - API operations or requests. - Data transfer or egress. - Replication. - Versioned or retained objects. - Backup and restore operations. - Minimum billing units or provider pass-through charges. The portal or applicable SKU will disclose the charging model before provisioning. Estimated costs may differ from final charges where actual usage differs from the estimate. ### 16A.11 Independent copies Object storage, replication, versioning and object lock do not replace an independent backup strategy. The Customer must maintain additional copies of critical or irreplaceable data appropriate to its risk. ## 17. Availability target and service credits ### 17.1 Target For eligible Paid SKUs, Seemi targets **99.5% monthly availability**. This is a service target and becomes a contractual credit commitment only where the SKU expressly states that it includes the Seemi Availability SLA. Free SKUs have no availability SLA. ### 17.2 Availability calculation For an eligible Component: **Monthly Availability Percentage = (Total minutes in the month minus eligible unavailable minutes) divided by total minutes in the month, multiplied by 100.** Seemi’s platform, infrastructure and monitoring records will be used for calculation, subject to correction of demonstrated errors. ### 17.3 Eligible unavailability Unavailable minutes normally require the eligible Component to be inaccessible due primarily to a failure within Seemi’s reasonable control. ### 17.4 Exclusions Availability calculations exclude, to the extent permitted by law: - Scheduled maintenance notified in accordance with the Agreement. - Emergency maintenance reasonably necessary to address an urgent security, legal or stability risk. - Customer-requested migration, restoration, update or reconfiguration. - Migration or restoration performed under Section 16.6, and any period during which a restoration awaits the Customer's approval or has been delayed or declined by the Customer. - Loss of Private Network connectivity that is resolved by reconnecting the client, or that results from Customer devices, client software or sign-in methods. - Failure caused by Customer Content, application code, a container image, database configuration or the Customer's unsupported configuration. - Failure of a Customer-controlled identity provider, domain, DNS configuration, credential or encryption key. - Lawful suspension or restriction under this Agreement. - Resource exhaustion caused by Customer activity exceeding the applicable SKU limits. - Internet conditions outside Seemi's network and reasonable control. - DDoS attacks, malicious traffic or cyber incidents not caused or materially worsened by Seemi's failure to exercise reasonable care. - A third-party provider failure outside Seemi's reasonable control, provided that the failure was not caused or materially worsened by Seemi's architecture, configuration or failure to take commercially reasonable mitigation and recovery measures. - Force majeure events. - Preview, beta, Free, trial, development or evaluation Services. An exclusion applies only to the period and impact reasonably attributable to the excluded event. Seemi will not exclude unavailability to the extent it was caused or materially prolonged by Seemi's failure to exercise reasonable care within its operational control. ### 17.5 Service-Credit Schedule For eligible Paid SKUs expressly covered by the Availability SLA, the following service-credit schedule applies unless the SKU specifies a different schedule: | Monthly availability | Service credit | | -------------------- | -------------: | | 99.5% or above | No credit | | 99.0% to below 99.5% | 5% | | 95.0% to below 99.0% | 10% | | 90.0% to below 95.0% | 25% | | 75.0% to below 90.0% | 50% | | Below 75.0% | 100% | The credit is calculated against the amount charged for the affected Component during the affected calendar month. The maximum aggregate SLA credit for an affected Component is 100% of the amount charged for that Component during the affected calendar month. Service credits: - Apply only to the affected Component and calendar month. - Do not apply to Components that remained available. - Cannot exceed the amount actually charged for the affected Component. - Do not compensate for lost revenue, lost profit, business interruption, consequential loss or losses relating to other Components. - Remain subject to the exclusions stated in this Agreement. ### 17.6 Claim process The Customer must submit an SLA claim to **cloud.support@seemi.net**, ordinarily within 15 days after the relevant monthly invoice, and identify: - Tenant, Resource Group and Component. - Date and approximate time of the event. - Observed impact. - Supporting logs or evidence reasonably available. Seemi will investigate in good faith. ### 17.7 Remedy To the maximum extent permitted by law, service credits under this Section 17 are the Customer's sole and exclusive remedy for any unavailability, interruption, downtime or performance degradation of the Services, whether or not a Component is covered by an express Availability SLA. Where a Component is not covered by an express Availability SLA, no remedy is available for unavailability except as required by law. Service credits: - Apply only against future charges for the same Tenant and have no cash value. - Are not available while the Tenant has overdue undisputed charges. - Lapse if the Tenant is terminated, except where mandatory law requires otherwise. - Count towards the liability cap in Section 23.4. This does not exclude mandatory consumer or statutory rights that cannot lawfully be limited. ## 18. Maintenance and support ### 18.1 Maintenance Seemi may perform scheduled and emergency maintenance. Seemi will seek to provide reasonable advance notice for planned material downtime. Emergency maintenance may occur without prior notice. Seemi may use container migration or supplier live-migration capabilities to reduce downtime, but interruption and restoration from the latest available backup may still occur. ### 18.2 Standard support Standard support is provided during published UAE working hours, excluding UAE public holidays, through **cloud.support@seemi.net** or supported portal channels. For paid non-enterprise SKUs, Seemi targets an initial response by the next UAE working day. This is a response target, not a resolution guarantee. ### 18.3 Free SKU support Free SKU support is not guaranteed and depends on workload, severity and available capacity. ### 18.4 Support boundaries Unless a SKU expressly includes it, support does not include: - Debugging Customer application code. - Rewriting container images. - Administering third-party applications. - Correcting unsupported custom configurations. - Providing legal, tax, regulatory or data-residency advice. - Recovering data not present in an available backup. Seemi may offer chargeable professional assistance for customer-caused or out-of-scope work. ### 18.5 Security vulnerabilities and container images Unless the applicable SKU expressly includes managed image maintenance, the Customer is responsible for vulnerabilities, malware, unsupported packages, licence obligations and configuration within Customer-provided container images and applications. Seemi may scan images or running Components for malware, known vulnerabilities, exposed secrets or prohibited configurations. Unless expressly included in the applicable SKU: - Scanning is not guaranteed to occur. - Scan results may be incomplete or delayed. - Seemi does not undertake to remediate Customer images. - Allowing deployment does not mean that an image is secure, supported or compliant. Seemi may block, isolate, stop or require remediation of a Component that presents a material security or abuse risk. ### 18.6 Container registries and deployment credentials Where the Customer deploys an image from a registry: - The Customer authorises Seemi to retrieve, temporarily cache and deploy the image as necessary to provide the Service. - The Customer is responsible for maintaining lawful access to the image and any required licence. - The Customer must protect and rotate registry credentials under its control. - Seemi may store, transmit encrypted registry credentials or access tokens using supported secret-management mechanisms where required for deployment or updates. - Registry unavailability, rate limits, deleted tags or changed mutable tags may prevent deployment or restoration. --- # Part E: Intellectual property, confidentiality and risk allocation ## 19. Ownership and intellectual property ### 19.1 Customer Content As between the parties, the Customer retains all ownership and intellectual-property rights in Customer Content. No ownership right in Customer Content transfers to Seemi or its providers. The Customer grants Seemi and its providers a limited, non-exclusive, non-transferable except to authorised providers, worldwide right to host, copy, transmit, cache, process, scan for security, back up, restore, migrate, restrict and delete Customer Content only as reasonably necessary to: - Provide and secure the Services. - Follow the Customer's documented instructions. - Prevent or investigate fraud, abuse or security incidents. - Comply with applicable law or valid legal process. This permission ends when the relevant Customer Content is deleted from active systems and applicable backup cycles expire, except to the extent continued retention is legally required. Seemi and its providers must not use Customer Content for purposes prohibited by Section 14.14. ### 19.2 Seemi technology Seemi retains all rights in the Seemi Cloud platform, portal, orchestration, templates, configurations, designs, documentation, trademarks and proprietary software, excluding Customer Content and third-party open-source software. ### 19.3 Open-source and third-party software Open-source and third-party software remains subject to its own licence terms. Seemi does not grant rights beyond those licences and does not warrant that third-party software is error-free, secure, maintained or suitable for the Customer’s purpose. ### 19.4 Feedback The Customer may provide feedback. Seemi may use non-confidential feedback to improve its Services without payment or ownership of Customer Content. ### 19.5 Publicity Seemi will not use a Customer’s name or logo for public marketing without permission, except to identify the Customer where reasonably necessary for service operation, billing, legal compliance or support. ### 19.6 No publicity based on workload content Seemi will not identify, describe or publicly reference the Customer's workloads, architecture, usage volumes, security incidents or Customer Content for marketing, case studies, benchmarking or publicity without the Customer's prior permission. This restriction does not prevent Seemi from: - Providing confidential information to its professional advisers, auditors, insurers and providers where reasonably necessary and subject to appropriate confidentiality. - Making disclosures required by applicable law or valid legal process. - Publishing aggregated or de-identified operational information that does not reasonably identify the Customer, an Authorised User, a data subject or the content of a Customer workload. ## 20. Suspension, termination, export and deletion ### 20.1 Customer termination The Customer may delete Components and close a tenant through available portal or support processes, subject to outstanding charges, commitments and technical completion of deletion. ### 20.2 Seemi suspension Seemi may restrict or suspend a user, Component, Resource Group or tenant for: - Non-payment. - Security risk. - Actual or suspected unlawful activity. - A material or repeated breach of this Agreement. - False or unverifiable customer information. - A credible abuse or legal request. - Supplier or payment-provider restrictions. - Protection of shared infrastructure. ### 20.3 Cure period For an ordinary remediable breach, Seemi will normally allow up to five business days to cure. No cure period is required for urgent, illegal, dangerous, repeated or non-remediable conduct. ### 20.4 Termination by Seemi Seemi may terminate an affected Service or tenant where: - A serious or repeated breach occurs. - Payment remains overdue. - Continued service creates unacceptable legal, sanctions, fraud, security or supplier risk. - A Customer fails to provide requested verification. - A required provider discontinues service and no reasonable alternative exists. - Seemi discontinues the Service after reasonable notice where practicable. ### 20.5 Non-payment deletion If outstanding amounts are not paid, including charges for storage beyond a Free SKU allowance, Seemi may delete Components and Customer Content, including their backups, at any time after **30 days of continued non-payment**, subject to any notice required by law. The Customer must not treat this period as guaranteed storage or a restoration commitment. ### 20.6 Data export The Customer should export Customer Content before deleting a Component or closing a Tenant. During an active Service, the Customer may export data using available Service functionality. For a non-urgent termination initiated by Seemi, Seemi will, where technically feasible and legally permitted, provide a limited opportunity to export Customer Content before permanent deletion. Seemi may restrict active compute, public network access or administrative actions during that period where reasonably necessary for security, non-payment, abuse prevention or legal compliance. A post-termination export window is not guaranteed where: - The Customer deleted the data or Component. - Immediate suspension or deletion is required by law or to address an urgent risk. - The data is unavailable because of corruption or failure not caused by Seemi's lack of reasonable care. - Continued storage or access would expose Seemi or another party to material legal or security risk. Seemi may charge reasonable fees for material bespoke export work agreed in advance. ### 20.7 Backup expiry and retained records Deleted Customer Content may remain temporarily in encrypted or access-restricted backups until overwritten, expired or removed through ordinary retention cycles. During that period: - The data will remain protected under the confidentiality, security and processing restrictions in this Agreement. - Seemi will not restore the data except for disaster recovery, legal compliance, security investigation or a Customer-authorised recovery where available. - If restored for platform disaster recovery, Seemi will reapply the applicable deletion instruction as reasonably practicable. Seemi may retain logs, billing, acceptance, fraud, security, abuse and legal records where required by law or reasonably necessary to establish rights, prove transactions, investigate incidents or protect platform integrity. ## 21. Confidentiality ### 21.1 Confidential Information “Confidential Information” means non-public business, technical, security, commercial or operational information disclosed by one party to the other in connection with the Agreement, including Customer Content, credentials, security information, pricing not generally published, architecture and support communications. ### 21.2 Duties Each receiving party will: - Protect the disclosing party's Confidential Information using at least reasonable care and no less than the care it uses for its own information of similar sensitivity. - Use Confidential Information only to perform or exercise rights under the Agreement. - Disclose Confidential Information only to personnel, contractors, providers and professional advisers who have a need to know and are subject to appropriate confidentiality obligations. - Notify the disclosing party without undue delay of a known unauthorised disclosure where legally permitted. ### 21.3 Exclusions Confidentiality obligations do not apply to information that the receiving party can demonstrate: - Is public without breach of the Agreement. - Was lawfully known without restriction before disclosure. - Was independently developed without use of the Confidential Information. - Was lawfully received from another source without a duty of confidentiality. - Was approved for release by the disclosing party. ### 21.4 Compelled disclosure Where legally permitted, a party compelled to disclose Confidential Information will provide reasonable prior notice, seek appropriate protection where practicable, and disclose only the information legally required. ### 21.5 Duration These confidentiality obligations continue during the Agreement and for five years after termination. Obligations relating to Customer Content, Personal Data, credentials, trade secrets and security-sensitive information continue for as long as the information remains confidential or applicable law requires protection. ## 22. Warranties and disclaimers ### 22.1 Customer warranties The Customer represents and warrants that: - It has authority to enter into this Agreement. - Registration and billing information is accurate. - Customer Content and use are lawful. - It owns or has rights to use Customer Content. - It has obtained required privacy notices, consents and permissions. - Its use will not violate third-party rights or this Agreement. ### 22.2 Service basis To the maximum extent permitted by law, Services are provided on an “as available” basis. Except for an express SKU commitment, Seemi does not warrant that: - The Services will be uninterrupted, error-free or immune from attack. - Private networking, IP allowlists, forward authentication or other security features will prevent every unauthorised access. - Migration or restoration will complete within a particular time or without data loss. - Every backup will complete or restore successfully. - Customer applications or third-party images will operate correctly. - A Service is suitable for regulated, safety-critical or high-availability use. - Open-source or third-party software will be maintained or vulnerability-free. ### 22.3 Customer evaluation The Customer must assess whether the selected Service, region, backup and security configuration is suitable for its workload. Seemi does not provide legal or regulatory advice. ### 22.4 Free SKUs Free SKUs: - Are intended for development, testing or evaluation. - Have no SLA or guaranteed support. - May be limited, changed, suspended or withdrawn. - Carry no assurance of availability, durability, backup or restoration. - Must not be used as the sole location for important data or computing workloads. - Are free only within their stated allowance; storage beyond it is chargeable under Section 16.8, and unpaid charges may lead to suspension and deletion under Sections 7.7 and 20. ## 23. Limitation of liability This Section allocates risk between the parties and is reflected in Seemi's prices. It applies to the maximum extent permitted by law. ### 23.1 Excluded losses Neither party is liable to the other for indirect, incidental, special, exemplary, punitive or consequential loss, or for loss of profit, revenue, business, contracts, opportunity, goodwill, reputation or anticipated savings, whether direct or indirect. Without limiting the previous paragraph, Seemi is not liable for: - Business interruption or loss of revenue caused by downtime, unavailability, migration or restoration. - The cost of substitute services or of re-creating data. - Claims made against the Customer by its own customers, users or other third parties. - Fines, penalties or sanctions imposed on the Customer by any authority, and the Customer's costs of notifying individuals or authorities. ### 23.2 Data loss and corruption Seemi's sole obligation for loss or corruption of Customer Content is to use reasonable efforts to restore it from the most recent available backup that Seemi maintains for the affected Component, where a backup feature was included, purchased or manually run. Seemi is not liable for: - Data created or changed after the latest usable backup or recovery point. - Data on Components without an available backup, including Free SKU Components without a manual backup. - Loss that would have been avoided had the Customer maintained independent copies appropriate to its risk, as required by Section 16.4. - Loss arising from a restoration the Customer approved, delayed or declined. ### 23.3 Excluded causes Seemi is not liable for loss to the extent caused by: - Customer Content, application code, container images or Customer configuration. - Customer users, credentials, access decisions or identity providers, including database superuser and administrator credentials. - Public network access, open ports or exposure settings enabled by the Customer, including a Component made reachable from the internet. - Devices, operating systems, VPN client software or sign-in methods used by the Customer or its Authorised Users, including access through the Private Network by a user or device the Customer permitted. - Commands or changes executed through browser terminal, command-line or administrative access. - Customer failure to maintain independent backups appropriate to its risk. - Unsupported software or third-party applications selected by the Customer, and vulnerabilities in open-source or third-party software for which no fix was reasonably available or deployable. - A third-party or internet failure outside Seemi's reasonable control that was not caused or materially worsened by Seemi's architecture, configuration or failure to take commercially reasonable mitigation measures. - A cyberattack, malicious traffic or force majeure event not caused or materially worsened by Seemi's failure to implement the Security Measures. - Lawful suspension, takedown, termination or compliance action performed in accordance with the Agreement. ### 23.4 Liability cap Each party's total aggregate liability arising from or relating to a Tenant, the Services and the Agreement, for all claims, events and legal theories combined (including contract, negligence and statutory duty), will not exceed the Service charges, excluding taxes, **actually paid** by the Customer to Seemi for that Tenant during the 3 months immediately preceding the event giving rise to the first claim. This single cap applies to every type of claim, including downtime and unavailability, data loss or corruption, unauthorised access to or theft of Customer Content, Personal Data Breaches, breach of confidentiality and breach of Section 14. There is no separate or higher cap for any category of claim. For a Tenant that has paid charges for less than 3 months, the cap is the charges actually paid during that period. For a Free SKU, or a Tenant that has paid no charges, Seemi's liability is excluded to the maximum extent permitted by law. Service credits issued under Section 17 count towards the cap. ### 23.5 Matters not limited Nothing in the Agreement excludes or limits: - Liability for fraud or fraudulent misrepresentation. - Liability for wilful misconduct. - A Customer's obligation to pay valid charges. - The Customer's indemnity obligations under Section 24. - Liability that cannot lawfully be excluded or limited. - Mandatory Consumer rights and remedies. ### 23.6 SLA credits Service credits under Section 17 are the Customer's sole and exclusive remedy for unavailability, as stated in Section 17.7. This does not limit another remedy for a separate breach, wilful misconduct, or liability that cannot lawfully be limited. ### 23.7 Claim notification, evidence and mitigation A party must notify the other in writing promptly after becoming aware of a potential claim, describe the claim and the loss alleged, and take reasonable steps to reduce avoidable loss. A claim must be supported by reasonably available evidence. Seemi's platform, infrastructure, backup and monitoring records will be used to establish events, subject to correction of demonstrated errors. Failure to provide prompt notice reduces liability only to the extent the delay materially prejudices the other party and does not remove a mandatory right that cannot lawfully be waived. ### 23.8 Enterprise variations Seemi may offer separately priced enterprise terms, higher liability caps, bespoke support, security commitments or additional insurance-backed commitments through a written agreement signed by Seemi. No other statement, quote, document or communication increases Seemi's liability. ### 23.9 Basis of the bargain The Customer acknowledges that: - Seemi's prices are set on the basis of the exclusions and limitations in this Agreement, and Seemi would not provide the Services at those prices without them. - The Customer has had the opportunity to review this Agreement, to choose the SKU, backup, network-exposure and security settings appropriate to its risk, and to request enterprise terms. - The exclusions and limitations are reasonable given the nature of the Services, the shared-responsibility model in Section 5 and the controls available to the Customer. ## 24. Customer indemnity ### 24.1 Scope To the maximum extent permitted by law, the Customer will defend and indemnify Seemi, its officers, employees and contractors against a third-party claim, regulatory action, penalty, reasonable legal cost and remediation expense to the extent arising from: - Customer Content infringing a third party's intellectual-property right. - Illegal or prohibited use of the Services by the Customer or an Authorised User. - The Customer's material violation of Applicable Data Protection Law. - A Customer-provided container image, code or application. - The Customer's material breach of Sections 3, 5.4, 5.8, 9, 12, 14, 19 or 22. - Claims by the Customer's own customers, end users or other third parties arising from services the Customer provides using Seemi Cloud, except to the extent caused by Seemi's breach of this Agreement. - Use of the Customer's credentials, Authorised User accounts or devices, or network access enabled by the Customer. ### 24.2 Exclusions The Customer is not required to indemnify Seemi to the extent a claim was caused by: - Seemi's unauthorised modification or use of Customer Content. - Seemi's failure to follow the Customer's lawful documented instructions. - Seemi's breach of the Agreement or applicable law. - Seemi's negligence, wilful misconduct or fraud. ### 24.3 Procedure Seemi will: - Provide prompt notice of an indemnified claim where lawful. - Provide reasonable cooperation at the Customer's expense. - Allow the Customer to control the defence and settlement, subject to Seemi's right to participate using its own counsel at its own expense. The Customer must not settle a claim in a manner that admits fault by Seemi, imposes a non-monetary obligation on Seemi, or fails to provide an unconditional release of Seemi without Seemi's prior written consent, not to be unreasonably withheld. Seemi may assume control of the defence where the claim creates a material conflict of interest, seeks injunctive relief against Seemi, or presents a material risk to Seemi's platform, licence or reputation. ### 24.4 Regulatory authority This indemnity allocates financial responsibility between the parties. It does not prevent an authority or third party from investigating or bringing proceedings against either party where applicable law permits. ## 25. Force majeure Neither party is liable for delay or failure caused by events beyond its reasonable control, including natural disaster, war, civil disorder, terrorism, epidemic, government action, sanctions, utility or power failure, widespread internet disruption, failure of upstream network, data-centre or storage providers, labour disruption, cyberattacks including attacks by organised or state-sponsored actors, previously unknown (zero-day) vulnerabilities in widely used software, or data-centre emergency, provided the affected party uses reasonable efforts to reduce impact. Payment obligations for Services already supplied are not excused. --- # Part F: Consumer terms and legal provisions ## 26. Consumer protections ### 26.1 Mandatory rights preserved If the Customer is a Consumer, nothing in this Agreement removes rights or remedies that cannot lawfully be excluded under UAE law or other mandatory law applicable to the transaction. ### 26.2 Clear information Seemi will make material service specifications, pricing, billing units, region, payment terms and applicable limitations available before provisioning. Customers should review them before creating a Component. ### 26.3 Arabic information and invoices For UAE Consumers, Seemi will make legally required consumer information and invoicing available in Arabic, and may also provide English. This English Agreement is the primary contractual version between the parties to the extent legally permitted. Mandatory Arabic requirements, official Arabic legislation and requirements of UAE authorities remain unaffected. ### 26.4 Complaints Consumers may submit complaints to **cloud.support@seemi.net**. Privacy, legal or abuse complaints may be submitted to **cloud.legal@seemi.net**. Seemi will seek to review complaints fairly and within a reasonable time. ### 26.5 Refunds and compensation Credits are the normal remedy for qualifying availability failures, but Seemi may provide a refund, credit note or other remedy where required by applicable consumer law. ### 26.6 UAE Consumer schedule and mandatory disclosures For a UAE Consumer, any applicable UAE Consumer Schedule, Arabic pre-contract information form part of the Agreement and prevail over conflicting general terms to the extent required by mandatory law. Before a UAE Consumer provisions a paid Component, Seemi will make available the material information required by applicable law, which may include: - Seemi's licensed identity and contact information. - The Service description and material specifications. - The total price or pricing method. - Billing frequency and payment terms. - Applicable renewal, cancellation, refund and suspension conditions. - Material data-location, backup and service limitations. - Available complaint channels. Where immediate provisioning affects a mandatory cancellation or withdrawal right, Seemi will obtain any acknowledgement or request required by applicable law before provisioning. Nothing in the Agreement requires a Consumer to waive a right or remedy that cannot lawfully be waived. ### 26.7 Consumer liability and remedy override Sections concerning disclaimers, exclusive remedies, liability limits, indemnities, suspension, deletion, governing law and jurisdiction apply to a Consumer only to the extent permitted by mandatory law. Where mandatory Consumer law requires repair, re-performance, refund, compensation or another remedy, the mandatory remedy prevails over a conflicting credit-only or exclusive-remedy provision. ## 27. Changes to this Agreement Seemi may update this Agreement for legal, security, operational, supplier or service reasons. - Material changes will normally receive at least 30 days’ notice. - Urgent legal, security or supplier-driven changes may take effect sooner. - Material changes may require renewed affirmative acceptance. - Non-material clarifications may be notified through the portal, website or email. - If the Customer does not accept a material change, it may stop using and delete affected Services before the effective date, subject to charges already incurred. The version accepted for each tenant will be recorded. ## 28. Notices Seemi may provide operational and contractual notices through: - The registered tenant email. - Portal notifications. - Publication within the Services. - The contact addresses in this Agreement. The Customer must keep contact details current. Formal legal notices to Seemi must be sent to **cloud.legal@seemi.net** and, where legally required, to Seemi’s registered office. ## 29. Governing law and disputes ### 29.1 Governing law This Agreement is governed by the federal laws of the United Arab Emirates and laws applicable in the Emirate of Ajman, without excluding mandatory rights that apply to a Consumer and cannot lawfully be displaced. ### 29.2 Good-faith resolution Before commencing proceedings, the parties should attempt in good faith to resolve the dispute through written escalation for at least 15 days, unless urgent relief is required. ### 29.3 Courts Subject to mandatory consumer jurisdiction and other non-excludable law, the courts competent in Ajman, United Arab Emirates, will have jurisdiction. ### 29.4 Language The Agreement is prepared in English. English prevails over a convenience translation between the parties to the extent legally permitted. This does not override mandatory Arabic-language requirements, and official Arabic law prevails for interpretation by UAE authorities and courts where applicable. ### 29.5 Regional mandatory rights The governing-law and jurisdiction provisions do not deprive a Consumer or data subject of a mandatory protection, complaint right, regulatory remedy or jurisdiction that applicable law does not permit the parties to exclude. Where Applicable Data Protection Law grants a person the right to complain to a competent data-protection authority, nothing in the Agreement restricts that right. ## 30. General provisions ### 30.1 Entire agreement This Agreement, its schedules, the accepted SKU and pricing record, and any tenant-specific written terms form the entire agreement for the Services. Statements made by third parties, including Referral Partners, resellers, consultants, reviewers or other promoters, are not made on Seemi's behalf, do not form part of the Agreement and do not bind Seemi. The Customer should rely only on this Agreement and Published Information. A commitment beyond Published Information binds Seemi only if confirmed in writing by Seemi support (cloud.support@seemi.net) or in a tenant-specific written amendment. ### 30.2 Priority If documents conflict, the following order applies unless mandatory law requires otherwise: 1. A tenant-specific written amendment signed or expressly approved by Seemi and the Customer. 2. An applicable mandatory-law or regional privacy schedule, including executed Standard Contractual Clauses, for its stated subject matter. 3. The Data Processing Addendum in Section 14 for processing Customer Personal Data. 4. The applicable UAE Consumer Schedule for a UAE Consumer transaction. 5. The applicable SKU-specific service description, Service Schedule or SLA. 6. This Agreement. 7. General portal documentation. A later document prevails only for its stated subject matter. A commercial order or SKU description does not reduce a data-protection obligation unless it expressly identifies the provision being amended and the amendment is legally permitted. ### 30.3 Assignment The Customer may not assign this Agreement without Seemi’s written consent. Seemi may assign it as part of a merger, restructuring, financing, sale of business or transfer to an affiliate, subject to applicable law and continued protection of Customer rights. ### 30.4 Severability If a provision is invalid or unenforceable, it will be limited to the minimum extent necessary and the remaining provisions continue in effect. ### 30.5 No waiver Failure to enforce a provision is not a waiver. ### 30.6 No partnership This Agreement does not create a partnership, employment, agency, fiduciary or joint-venture relationship. ### 30.7 Survival Payment, ownership, confidentiality, data retention, liability, indemnity, dispute, Referral Program conduct and other provisions intended by their nature to survive will continue after termination. --- # Part G: Referral Program ## 31. Referral Program terms ### 31.1 Application and acceptance This Part G applies to every Referral Partner in addition to the rest of this Agreement. To join the Referral Program, an applicant must hold a Seemi Cloud portal account and submit the referral application form in the portal at https://cloudportal.seemi.net/referrals. Seemi reviews each application and may approve or decline it at its sole discretion, without giving reasons. Seemi may request identity, business, tax or other information before or after approval. A person becomes a Referral Partner only when Seemi approves the application and issues a referral code. ### 31.2 Referral codes and attribution A referral code identifies the Referral Partner. Codes may be shared as part of a link to a page on https://cloud.seemi.net or https://cloudportal.seemi.net, or entered by a customer when creating a Tenant. A referral is attributed to a Tenant only if a valid, active code is associated with the Tenant when the Tenant is created, through a referral link captured on the creating user's account or through entry during Tenant creation. Seemi's records determine attribution. Seemi is not required to apply a code retroactively, to resolve competing claims between Referral Partners, or to recognise a referral that its systems did not record. A Tenant can be attributed to only one referral code. Seemi may revoke, suspend or replace any code. A revoked or suspended code is not valid for new Tenants. ### 31.3 Commission For each attributed Tenant, the Referral Partner earns a commission of **10% of Net Revenue** received by Seemi for Services supplied to that Tenant during the **6 months beginning on the date the Tenant is created**, unless different terms are stated in Published Information at the time the Tenant is created. "Net Revenue" means amounts actually received by Seemi from the Tenant, excluding taxes, and after deducting refunds, chargebacks, credit notes, service credits, discounts, promotional or free credits, and payment-processing reversals. Commission accrues to the Referral Partner's balance **45 days after Seemi receives the relevant Net Revenue**. Refunds, chargebacks or credits issued later reduce the balance, including after a payout; a negative balance is offset against future commission. No commission is payable on: - A Tenant owned or controlled by the Referral Partner, its affiliates, employees or related parties, or using the same payment method as the Referral Partner's own tenants. - Tenants or revenue obtained through a breach of this Part G or other fraudulent or abusive activity. - Revenue from a Tenant created before the code was associated with it. ### 31.4 Payouts Seemi pays commission from the available balance, in United States dollars, by wire transfer, prepaid card or Seemi Cloud credits, as offered in the portal. Bank transfer, card issuance and loading, currency conversion and similar costs are deducted from the payout. Minimum payout amounts are stated in Published Information. Before making a payout, Seemi may require identity verification, sanctions screening, tax information and payment details, and may delay or withhold payment until they are provided. Payouts are subject to Section 12 (Restricted jurisdictions and sanctioned parties). The Referral Partner is solely responsible for its own taxes, registrations and reporting on commission received. Referral Partners are never required to pay Seemi to join or participate in the Referral Program. ### 31.5 Conduct and accuracy of claims The Referral Partner must promote Seemi Cloud honestly and lawfully. It must not make, publish or imply any statement that is false, misleading, inaccurate, exaggerated or unsubstantiated about Seemi Cloud, including about: - Technical capabilities, features, performance, security, compliance, certifications, regions or availability. - Pricing, discounts, free tiers, credits or promotions. - Its own compensation, or any benefit, rebate or incentive offered to customers. - Its relationship with Seemi. All statements about Seemi Cloud must be consistent with this Agreement and Published Information. Published Information prevails over anything a Referral Partner says or publishes. A Referral Partner may make a statement beyond Published Information only if Seemi support (cloud.support@seemi.net) has expressly confirmed it in writing for that purpose. The Referral Partner must also: - Not send spam or unsolicited messages, or use deceptive, misleading or aggressive marketing. - Not bid on, or use in advertisements, domains, account names or social handles, the names "Seemi" or "Seemi Cloud" or confusingly similar terms, except as Seemi approves in writing. - Not impersonate Seemi, present itself as Seemi, or claim to be a reseller, distributor, agent or official partner. It may describe itself as a "Seemi Cloud referral partner". - Not offer customers payments, rebates or other incentives from its commission without Seemi's written approval. - Not use cookie stuffing, forced clicks, automated sign-ups, fake accounts or any method of creating artificial referrals. - Disclose its referral relationship and commission wherever applicable advertising, consumer-protection or platform rules require it. - Comply with all laws applicable to its marketing, including advertising, consumer-protection, anti-spam and data-protection laws. ### 31.6 No authority to bind Seemi A Referral Partner is an independent party. It has no authority to make any promise, commitment, warranty, price or contract on Seemi's behalf. Statements by a Referral Partner do not bind Seemi and do not form part of any customer's agreement with Seemi, as stated in Section 30.1. ### 31.7 Information received Seemi may show a Referral Partner limited information about attributed Tenants, such as Tenant identifiers, dates and commission amounts. The Referral Partner must keep this information confidential, use it only to track its commission, and not attempt to identify, contact or profile Seemi's customers using it. ### 31.8 Breach and termination If Seemi reasonably believes that a Referral Partner has breached this Part G or the Agreement, Seemi may, without liability: - Suspend or terminate the Referral Partner's participation and referral rights. - Revoke all of its referral codes. - Withhold commission while it investigates. - Cancel unpaid commission connected with the breach, and recover commission already paid that was obtained through the breach, including by set-off against any amount owed to the Referral Partner. Seemi may also change, suspend or end the Referral Program, or end a Referral Partner's participation for any reason, by giving notice. Unless participation ends because of a breach, commission properly accrued on Tenants attributed before the end date will still be paid under Section 31.4. ### 31.9 Changes to the Referral Program Seemi may change the Referral Program terms, including commission rates, periods, holding periods, payout methods and minimums, by updating this Part G or Published Information. Changes apply to Tenants created after the change takes effect, unless the change is required by law or is in the Referral Partner's favour. ### 31.10 Liability and indemnity To the maximum extent permitted by law, Seemi's total liability to a Referral Partner arising from or relating to the Referral Program is limited to commission properly accrued and not yet paid. Section 23 applies to the Referral Program in addition. The Referral Partner will indemnify Seemi, its officers, employees and contractors against claims, regulatory action, penalties, losses, reasonable legal costs and remediation expenses arising from its marketing, statements or breach of this Part G. --- # Schedule 1: Technical and Organisational Measures ## 1. Scope This Schedule describes baseline Security Measures for the Seemi Cloud platform. Specific capabilities may vary by SKU, region and provider. A control applies only where relevant to the affected Service and implemented as described in the applicable SKU or documentation. ## 2. Identity and access management Seemi will maintain measures designed to: - Restrict production access to authorised personnel with a legitimate operational need. - Use named administrative identities where technically supported. - Apply role-based or least-privilege access principles. - Use multifactor authentication for privileged Seemi administrative access where supported. - Revoke access when personnel no longer require it. - Review privileged access periodically. - Protect stored service credentials and secrets using supported secret-management mechanisms. The Customer remains responsible for Authorised User permissions, identity-provider security, application accounts and credentials under its control. ## 3. Tenant and workload isolation Seemi will use platform, orchestration, network and access-control mechanisms designed to separate Tenants and restrict unauthorised access between Customer workloads. The Customer must not attempt to bypass isolation controls. Internet-accessible applications remain the Customer's responsibility unless the applicable SKU expressly provides a managed security control. ## 4. Encryption and transmission security Seemi will: - Support encryption for internet-facing administrative and portal connections in transit. - Use TLS for supported public Service endpoints where described for the SKU. - Use backup or provider-side encryption where expressly stated for the SKU. - Protect encryption keys and credentials under Seemi's control using access restrictions appropriate to their sensitivity. TLS may terminate at a proxy or load balancer. Internal host or trusted-service traffic may not always be encrypted. The Customer must implement application-level or end-to-end encryption where required by its risk or legal obligations. ## 5. Logging and monitoring Seemi will maintain operational and security logging appropriate to the Service, which may include: - Authentication and administrative events. - Provisioning and Component lifecycle actions. - Platform health and security events. - Backup status and restoration actions where supported. - Network and abuse indicators reasonably required for platform protection. Log scope and retention vary by system and SKU. Customer application logs may contain Customer Content and remain subject to the Agreement. ## 6. Vulnerability and patch management Seemi will maintain processes designed to: - Identify material vulnerabilities within the host, control plane and platform software under Seemi's control. - Prioritise remediation according to risk and operational impact. - Apply security updates within reasonable operational windows. - Perform emergency remediation where an urgent threat justifies accelerated action. The Customer is responsible for vulnerabilities in its own images, code, dependencies and unsupported configurations unless an applicable managed SKU expressly states otherwise. ## 7. Secure operations and change management Seemi will maintain reasonable operational procedures for material platform changes, including testing or review appropriate to the risk, controlled deployment and recovery or rollback planning where practicable. Emergency changes may follow an accelerated process where required to address a material security, legal or availability risk. ## 8. Incident response Seemi will maintain an incident-response process designed to: - Receive and assess security alerts. - Contain and investigate material incidents. - Preserve relevant evidence where appropriate. - Remediate identified risks. - Notify affected Customers as required by the Agreement and applicable law. - Review material incidents for corrective actions. ## 9. Availability, backup and recovery For Services with included or purchased backup features, Seemi will operate the applicable backup process, retention and restoration functionality described in the SKU. Seemi will maintain platform recovery procedures appropriate to the Service, including backups of the core platform stored in a separate location (Frankfurt) and the ability to migrate Components between servers as described in Section 16.6. Backup and recovery commitments remain subject to Sections 16 and 17 and do not replace the Customer's duty to maintain independent copies of critical data. ## 10. Personnel security and confidentiality Seemi will require personnel with access to Confidential Information or Customer Personal Data to comply with appropriate confidentiality and security obligations. Access will be limited according to role and revoked when no longer required. ## 11. Supplier and Subprocessor management Seemi will perform reasonable risk-based assessment of material providers that process Customer Personal Data or operate critical infrastructure. Seemi will use written agreements addressing relevant confidentiality, security and data-protection obligations. ## 12. Data deletion and media handling Seemi will use logical deletion and provider disposal processes appropriate to the relevant storage technology. Deleted information may remain in access-restricted backups until ordinary expiry or overwrite. Where Seemi controls physical media disposal, Seemi will use a process reasonably designed to prevent unauthorised recovery. Where a provider controls media, the provider's applicable secure-disposal process applies. ## 13. Testing and review Seemi will periodically review material Security Measures and may use internal assessment, automated testing, vulnerability scanning, recovery testing, independent review or supplier assurance documents as appropriate to the Service and risk. ## 14. Customer security responsibilities The Customer is responsible for: - Selecting an appropriate SKU and region. - Managing Authorised Users and application accounts. - Securing its identity provider and recovery methods. - Protecting credentials, secrets and encryption keys under its control. - Securing application code, images, dependencies and configurations. - Configuring network exposure and public storage access, including public endpoints, IP allowlists, forward authentication and private networking for each Component. - Protecting database superuser and administrator credentials, and controlling who holds L1 or higher access. - Securing the devices and client software used by Authorised Users to connect to the Private Network. - Maintaining and testing independent backups. - Monitoring its applications and responding to vulnerabilities. - Implementing additional controls required by its legal, contractual or industry obligations. --- # Schedule 2: European International Data Transfer Terms ## 1. Application This Schedule applies where Customer Personal Data protected by the GDPR or UK GDPR is transferred to Seemi or a Subprocessor in a country that requires an international-transfer safeguard. ## 2. European Union and European Economic Area transfers Where required, the then-applicable European Commission Standard Contractual Clauses are incorporated into the Agreement by reference using the module appropriate to the parties' roles. Unless otherwise specified in an executed order or addendum: - The Customer is the data exporter. - Seemi is the data importer. - The optional docking clause applies. - General written authorisation for Subprocessors applies, subject to Section 14.11. - The competent supervisory authority and governing-law selections will be completed according to the Customer's applicable establishment and the requirements of the Standard Contractual Clauses. - Annex I is completed using the party, processing and transfer information in the Agreement and the Customer's order. - Annex II is completed by Schedule 1 and applicable SKU-specific Security Measures. - Annex III is completed by the applicable Subprocessor schedule. If completion of a mandatory selection or annex requires Customer-specific information, the Customer will provide that information upon request. ## 3. United Kingdom transfers Where required for a transfer protected by the UK GDPR, the parties will incorporate the then-applicable United Kingdom international data-transfer addendum or international data-transfer agreement. The Agreement, Schedule 1 and the Subprocessor schedule will provide the corresponding commercial, processing and security information unless additional information is legally required. ## 4. Transfer assessments Each party will provide information reasonably available to it and reasonably required for a transfer assessment. Seemi may provide standardised information regarding: - Data flows and processing locations. - Security Measures. - Subprocessors. - Government-request handling. - Technical and organisational safeguards. The Customer is responsible for assessing its own instructions, data categories, purposes and selected regions. ## 5. Government-access requests Where Seemi receives a government or law-enforcement request for Customer Personal Data, Seemi will act in accordance with Section 11 and, where applicable, the incorporated transfer mechanism. Where legally permitted, Seemi will: - Verify the authority, legal basis and scope of the request. - Seek clarification or narrowing where the request appears unclear, excessive or defective. - Disclose only information within the valid scope. - Notify the Customer. - Document the request and response. ## 6. Supplementary measures Depending on the Service and risk, supplementary measures may include encryption in transit, backup encryption, access restrictions, logging, data minimisation, pseudonymisation controlled by the Customer, and Customer-managed or client-side encryption where supported. The Customer is responsible for implementing Customer-controlled supplementary measures required by its transfer assessment. ## 7. Conflict If an incorporated mandatory transfer mechanism conflicts with the Agreement, the mandatory transfer mechanism prevails for the affected transfer. --- # Schedule 3: UAE Consumer Terms ## 1. Application This Schedule applies where the Customer is a Consumer protected by mandatory UAE consumer law. It supplements the Agreement and prevails over a conflicting term to the extent required by mandatory law. ## 2. Pre-contract information Before a paid Service is provisioned, Seemi will make available the material Service description, price or pricing method, billing unit, payment terms, region, material limits, backup position, renewal or recurring-charge information, and available cancellation or complaint process. ## 3. Arabic information Seemi will provide Arabic consumer information where required by applicable law. Seemi may provide English alongside Arabic. Official Arabic legislation and mandatory Arabic requirements remain unaffected. ## 4. Immediate provisioning Where a paid digital Service is provisioned immediately at the Consumer's request, Seemi may request an express acknowledgement of immediate performance and any legally required acknowledgement concerning cancellation or withdrawal rights. ## 5. Complaints A Consumer may submit a complaint to **cloud.support@seemi.net**. Privacy and legal complaints may be sent to **cloud.legal@seemi.net**. Seemi will review the complaint fairly and provide a response within a reasonable period. This does not restrict the Consumer's right to complain to a competent UAE authority. ## 6. Remedies Where mandatory law requires repair, re-performance, refund, compensation or another remedy, that remedy applies notwithstanding a conflicting credit-only, disclaimer or exclusive-remedy term. ## 7. No waiver A Consumer is not required to waive a statutory right that cannot lawfully be waived. Any limitation, exclusion, indemnity, governing-law or jurisdiction clause applies only to the extent permitted by mandatory law.