Last updated 28 Aug 2026
This Data Processing & Subprocessors Policy ("Policy") explains how Maaliya Accounting and Bookkeeping DWC-LLC ("Maaliya", "we", "us" or "our") handles Customer Data when providing its websites, software, applications, accounting and bookkeeping services, and related products and services (collectively, the "Services").
It describes our general data-processing framework, including the respective responsibilities of Maaliya and its customers, our use of service providers, security practices, international processing, data handling following termination and our approach to personal-data incidents.
This Policy should be read alongside Maaliya's Terms of Service and Privacy & Cookie Policy.
This public Policy describes our standard operating framework. Enterprise customers with additional contractual, regulatory or data-protection requirements may request a separately executed Data Processing Agreement ("DPA").
This Policy applies to Customer Data processed through:
"Customer Data" means information, documents, records and other content submitted, uploaded, generated, connected, transmitted or otherwise made available to Maaliya by or on behalf of a customer through the Services.
Customer Data may include personal data.
Maaliya's role depends on the context in which personal data is processed.
Where a customer provides personal data concerning its employees, directors, customers, suppliers, contractors or other individuals for processing through Maaliya, the customer generally acts as the controller and Maaliya acts as a processor or service provider on the customer's behalf.
The customer determines why the personal data is processed and is responsible for ensuring that:
Maaliya may separately act as a controller for personal data that we process for our own legitimate business purposes, including:
Personal data for which Maaliya acts as a controller is primarily governed by our Privacy & Cookie Policy.
When acting as a processor, Maaliya processes Customer Data according to the customer's instructions as reflected in:
Maaliya may process Customer Data as reasonably necessary to:
If Maaliya is legally required to process Customer Data other than according to a customer's instructions, we may do so to the extent required by applicable law.
Customers retain their rights in Customer Data.
Providing Customer Data to Maaliya does not transfer ownership of that data to Maaliya.
Customers grant Maaliya the rights necessary to host, copy, transmit, access and otherwise process Customer Data for the purposes described in the Terms of Service, this Policy and any applicable agreement.
Maaliya may generate and use aggregated, statistical or anonymised information derived from the Services where that information does not reasonably identify the customer, its organisation or an identifiable individual.
Such information may be used for purposes including analytics, research, benchmarking, security, product development, automation and improvement of the Services.
Access to identifiable Customer Data within Maaliya is restricted according to operational requirements and access controls.
Where human access to a customer's financial or accounting information is required as part of Maaliya's managed services, support or account administration, access is generally limited to the customer's assigned account manager or other personnel whose role directly requires access.
Personnel should not access Customer Data merely because they have technical access to a system.
Additional access may occur where reasonably necessary to:
Maaliya maintains internal access restrictions designed to reduce unnecessary access to Customer Data.
Maaliya maintains reasonable technical and organisational measures designed to protect Customer Data against unauthorised access, disclosure, alteration, destruction or loss.
Depending on the relevant system, these measures include:
Security measures may evolve as our Services, infrastructure and risks change.
No internet-based system can provide absolute security, and Maaliya does not represent that its Services are immune from every possible security incident.
Customers are also responsible for protecting their accounts, credentials, devices and authorised-user access.
Customers are responsible for:
Customers should not provide Maaliya with personal data that is unnecessary for the Services being used.
Maaliya relies on third-party infrastructure and service providers to operate portions of the Services.
Where a third-party provider processes personal data on Maaliya's behalf in connection with providing the Services, that provider may act as a subprocessor.
Our service-provider ecosystem may include:
| Provider | Primary Purpose | Processing / Operations |
|---|---|---|
| Supabase | Database, authentication and backend infrastructure | UAE and/or other applicable infrastructure locations |
| Render | Application and infrastructure hosting | Provider infrastructure locations |
| OpenAI | AI processing in limited or edge-case workflows | Provider infrastructure locations |
| Authentication, Gmail connectivity and related services | Global infrastructure | |
| Sanity | Content and content-management infrastructure | Global infrastructure |
The exact providers involved may depend on the Services, features and integrations used by a particular customer.
Maaliya may add, remove or replace service providers and subprocessors as its infrastructure and Services evolve.
Where reasonably appropriate, Maaliya may communicate material changes to subprocessors through its website, customer communications or other appropriate channels. Unless expressly agreed in a separate DPA, Maaliya is not required to obtain individual customer approval before appointing or replacing a subprocessor.
Not every third party connected to Maaliya acts as a Maaliya subprocessor.
Customers may choose to connect or communicate through third-party services such as:
Depending on the circumstances, these providers may act as independent controllers, processors engaged directly by the customer, or providers receiving information at the customer's direction.
When a customer activates an integration, the customer instructs Maaliya to transmit, receive or otherwise process the information reasonably necessary to operate that integration.
Use of those third-party services is also subject to the relevant provider's own contractual and privacy terms.
Maaliya does not control the independent processing activities of third-party services.
The majority of Maaliya's document extraction, OCR and reconciliation functionality is performed using internal or specialised systems.
Third-party artificial intelligence services, including OpenAI, may be used for limited or edge-case processing where appropriate to provide requested functionality.
Where Customer Data is transmitted to an AI provider, Maaliya seeks to limit the information provided to what is reasonably necessary for the relevant processing task.
Maaliya does not use identifiable Customer Data or identifiable customer documents to train general Maaliya AI models without appropriate permission or consent.
Further information about AI processing is available in our Terms of Service and Privacy & Cookie Policy.
Maaliya is established in the United Arab Emirates.
Customer Data may be hosted, accessed or processed in the United Arab Emirates and, where operationally required, India or other jurisdictions in which Maaliya's service providers operate.
Access to Customer Data from another country is restricted to circumstances where such access is reasonably required for the relevant person's role or to provide the Services.
Where applicable data-protection law imposes requirements on international transfers of personal data, Maaliya will use appropriate safeguards or recognised transfer mechanisms where required.
Depending on the applicable law and circumstances, these may include contractual safeguards, Standard Contractual Clauses or other legally recognised mechanisms.
Enterprise customers with particular regulatory or data-residency requirements may contact Maaliya to discuss available arrangements. This does not constitute a guarantee that a particular hosting location or data-residency configuration will be available.
Where Maaliya acts as a processor and receives a request from an individual concerning personal data controlled by a customer, Maaliya may direct the individual to the relevant customer.
Where reasonably required and technically feasible, Maaliya may assist customers in responding to requests involving:
The customer remains responsible for determining whether and how a request must be fulfilled.
Maaliya may charge reasonable fees for exceptional, excessive, repetitive or materially customised assistance where permitted by applicable law or the customer's agreement.
If Maaliya becomes aware of a confirmed personal-data breach affecting Customer Data for which Maaliya acts as processor, Maaliya will notify the affected customer without undue delay where notification is required under applicable law or contractual obligations.
Where reasonably available, our notification may include:
Information may be provided in stages where all relevant facts are not immediately available.
Where the customer acts as controller, the customer remains responsible for determining whether notifications must be made to affected individuals, regulators or other authorities.
Maaliya will provide reasonable assistance with such obligations where required by applicable law and proportionate to the nature of the incident and information available to us.
Nothing in this section requires Maaliya to disclose information that would compromise the security of other customers, confidential security information, legally privileged information or information whose disclosure is prohibited by law.
Customers may request an export of eligible Customer Data.
Where supported, Maaliya may provide exports in CSV format or another format reasonably available for the relevant data.
The scope and format of an export may depend on the nature of the Customer Data and the functionality available at the time of the request.
Customers remain responsible for maintaining their own copies of records they are legally or operationally required to retain.
Following termination or account closure, Customer Data may remain available for retrieval for up to 90 days, where reasonably practicable and subject to the Terms of Service.
During this period, a customer may request or use an available method to retrieve or export eligible Customer Data.
Access or export may be restricted where an account has been suspended or terminated because of fraud, unlawful conduct, a security risk or another serious breach.
After the applicable retrieval period, Maaliya may permanently delete Customer Data.
Once Customer Data has been permanently deleted, Maaliya does not guarantee that it can be recovered.
Certain information may continue to be retained where:
Any retained personal data remains subject to applicable data-protection and security obligations for as long as it is retained.
Where a separately executed DPA requires specific return or deletion procedures, Maaliya will follow those procedures to the extent agreed.
Otherwise, Maaliya's standard post-termination process described above applies.
Customers are responsible for requesting and retaining any exports they require before Customer Data becomes unavailable.
Enterprise customers may request a separately executed Data Processing Agreement where required by their internal policies, regulatory obligations or applicable data-protection law.
An enterprise DPA may address matters such as:
Where applicable, such arrangements may incorporate requirements comparable to Article 28 of the EU General Data Protection Regulation, UK data-protection requirements or other applicable privacy frameworks.
Where a separately signed DPA conflicts with this Policy, the signed DPA will prevail for the relevant customer to the extent of that conflict.
Maaliya continuously develops its Services and may change its infrastructure, hosting providers, technology vendors, integrations and subprocessors.
We assess third-party providers according to factors we consider appropriate to the nature of the service they provide, which may include security capabilities, technical requirements, reliability, privacy considerations and contractual protections.
A change in provider does not necessarily mean Customer Data will be transferred to that provider. The providers processing a particular customer's information depend on the Services and functionality used by that customer.
This Policy supplements Maaliya's Terms of Service and Privacy & Cookie Policy.
The Terms of Service continue to govern the customer's use of the Services and the parties' broader contractual relationship.
The Privacy & Cookie Policy explains Maaliya's broader privacy practices, including circumstances in which Maaliya acts as a controller.
This Policy explains Maaliya's standard framework for processing Customer Data on behalf of customers.
Where a separately executed agreement contains more specific data-processing provisions, those provisions apply to the extent specified in that agreement.
Questions regarding Maaliya's data-processing practices, subprocessors, international processing, security measures or enterprise DPAs can be directed to:
Maaliya Accounting and Bookkeeping DWC-LLC, Trade Licence No. TL 14812, Floor 3, Tower A3, Dubai South Business Park, Dubai, United Arab Emirates.
Email: support@maaliya.ae