Terms of Service

Effective Date: 15 September 2024  |  Last Updated: 15 September 2024

Citytech Software DMCC (“Citytech”, “we”, “us” or “our”) respects your privacy and is committed to protecting personal data entrusted to us.

This Privacy Policy explains how Citytech collects, uses, processes, stores, protects and discloses personal data when you:

• visit or use our websites, including www.citytechme.com;
• communicate with us by email, telephone, online forms or other channels;
• request information, proposals, demonstrations or services from us;
• use Citytech software, applications, portals or services;
• receive support or other services from Citytech;
• participate in our eInvoicing, electronic document exchange or Peppol services;
• interact with us as a customer, supplier, business partner, employee candidate or other business contact; or
• otherwise provide personal data to Citytech in connection with our business activities.

This Privacy Policy should be read together with any applicable contract, service agreement, Data Processing Agreement (“DPA”), terms of service, cookie notice or other privacy notice that may apply to a particular Citytech service.

1. About Citytech

Citytech Software DMCC is a technology and software services company based in the United Arab Emirates.

Our activities may include software development, web and mobile application development, enterprise software implementation and integration, IT services, managed services, eCommerce solutions, ERP and business solutions, eInvoicing and electronic document exchange services, and related technology services.

For certain activities, Citytech may act as a Data Controller. For other activities, particularly where we process information on behalf of our customers, Citytech may act as a Data Processor or service provider.

The distinction between these roles is explained below.

2. Scope of this Privacy Policy

This Privacy Policy applies to personal data processed by Citytech in connection with:

• www.citytechme.com and associated websites;
• Citytech's marketing and business-development activities;
• customer and supplier relationships;
• software development and implementation services;
• application hosting or managed services where applicable;
• customer support and service management;
• eInvoicing and electronic invoicing services;
• Peppol and electronic document exchange services;
• business communications;
• recruitment and employment-related applications where applicable; and
• other services provided by Citytech.

This Privacy Policy does not replace a customer-specific DPA or contractual privacy provisions where Citytech processes personal data solely on behalf of a customer.

3. What is Personal Data?

“Personal Data” means information that relates to an identified or identifiable natural person, or information that can reasonably be associated with such a person, to the extent defined as personal data under applicable law.

Depending on the circumstances, this may include names, contact details, identification information, business information, online identifiers, technical information, transaction information and other information relating to an individual.

4. Personal Data We May Collect

Depending on your relationship with Citytech, we may collect the following categories of information.

4.1 Identity and professional information

This may include:

• name;
• job title;
• department;
• employer/company name;
• business address;
• nationality or other identification information where required for a legitimate business or legal purpose; and
• other professional information provided by you.

4.2 Contact information

This may include:

• email address;
• telephone/mobile number;
• business address;
• correspondence details; and
• communication preferences.

4.3 Enquiry and business information

When you contact Citytech or request our services, we may collect:

• information contained in your enquiry;
• project requirements;
• software and technology requirements;
• company information;
• budget or commercial information;
• information contained in proposals or contracts;
• meeting and communication records; and
• other information voluntarily provided to us.

4.4 Technical and website information

When you use our website or online services, we may collect information such as:

• IP address;
• browser type;
• operating system;
• device information;
• approximate geographic information derived from technical data where permitted;
• pages viewed;
• referring website;
• date and time of access;
• website interactions;
• error and diagnostic information; and
• security and log information.

4.5 Customer and service information

Depending on the services provided, we may process:

• account and user information;
• support tickets;
• service requests;
• application and system information;
• configuration information;
• project documentation;
• technical logs;
• communications;
• files or documents provided to us; and
• other information necessary to provide contracted services.

4.6 eInvoicing and electronic transaction information

Where Citytech provides eInvoicing or related services, including acting as an Accredited Service Provider, we may process information contained in electronic invoices and related documents.

This may include:

• buyer and seller information;
• names and business contact information;
• Tax Registration Numbers (TRNs) and other tax identifiers;
• invoice numbers;
• invoice dates;
• products or services;
• amounts and currencies;
• tax information;
• payment information;
• credit notes and related documents;
• electronic document identifiers;
• Peppol identifiers;
• delivery and transmission information;
• technical metadata;
• validation results;
• status and response information; and
• audit and transaction records.

The UAE eInvoicing framework requires businesses to exchange electronic invoices and related information through Accredited Service Providers, and applicable statutory requirements may require certain electronic invoice and transaction information to be retained.

4.7 Recruitment information

Where you apply for employment or other opportunities with Citytech, we may collect information such as:

• name and contact details;
• CV/resume;
• qualifications;
• employment history;
• professional references;
• skills and experience;
• interview information; and
• other information voluntarily submitted during the recruitment process.

5. How We Collect Personal Data

We may collect Personal Data:

• directly from you;
• through our website and online forms;
• through email or telephone communications;
• during meetings and demonstrations;
• through customer portals and applications;
• through our customers and business partners;
• from publicly available sources;
• from service providers and technology partners;
• through cookies and similar technologies;
• through software integrations and APIs;
• through eInvoicing and electronic document exchange networks; and
• from other lawful sources.

Where required by applicable law, we will provide appropriate notice when collecting Personal Data.

6. How We Use Personal Data

Citytech may use Personal Data for the following purposes:

6.1 Providing services

To:

• provide software and technology services;
• implement, configure and support applications;
• provide eInvoicing and electronic document exchange services;
• provide Peppol-related services;
• manage customer accounts;
• respond to support requests;
• maintain and improve our services; and
• perform our contractual obligations.

6.2 Business communications

To:

• respond to enquiries;
• communicate with customers and prospects;
• arrange meetings and demonstrations;
• prepare proposals and quotations;
• administer contracts;
• manage customer relationships; and
• provide service-related notifications.

6.3 Billing and financial administration

To:

• issue invoices;
• process payments;
• maintain financial records;
• manage accounts receivable and payable;
• prevent fraud; and
• comply with applicable tax and accounting requirements.

6.4 Security

To:

• protect our systems and networks;
• detect and prevent unauthorised access;
• monitor security events;
• investigate suspected fraud or abuse;
• maintain audit trails;
• protect our customers and users; and
• respond to security incidents.

6.5 Legal and regulatory compliance

To:

• comply with applicable laws and regulations;
• comply with lawful requests from government and regulatory authorities;
• comply with tax and accounting requirements;
• comply with eInvoicing requirements;
• meet our obligations as an Accredited Service Provider where applicable;
• establish, exercise or defend legal claims; and
• maintain appropriate business records.

6.6 Marketing

Where permitted by applicable law, we may use business contact information to:

• provide information about Citytech products and services;
• send newsletters;
• provide invitations to webinars and events;
• communicate product updates; and
• provide other relevant business communications.

You may opt out of marketing communications at any time.

7. Legal Bases for Processing

Where applicable data protection law requires a legal basis for processing, Citytech may rely on one or more of the following:

Contract

Processing may be necessary to:

• enter into a contract;
• perform a contract;
• provide contracted services; or
• take steps requested before entering into a contract.

Legal obligation

Processing may be necessary to comply with applicable legal, regulatory, tax, accounting or other obligations.

Legitimate interests

Processing may be necessary for legitimate business interests, including:

• operating and improving our business;
• managing customer relationships;
• information security;
• fraud prevention;
• protecting our systems;
• direct business-to-business marketing where permitted;
• maintaining business records; and
• establishing or defending legal claims.

Where we rely on legitimate interests, we will consider the relevant interests and the rights and freedoms of individuals.

Consent

Where required, we may rely on your consent to process Personal Data for a specific purpose.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

8. Citytech as Data Controller

Citytech acts as a Data Controller when we determine the purposes and means of processing Personal Data.

Examples may include:

• website visitor information;
• marketing and business-development information;
• information relating to our suppliers and business partners;
• recruitment information;
• customer account and relationship information;
• information required for billing and financial administration; and
• other information relating directly to Citytech's own business operations.

When acting as a Data Controller, Citytech is responsible for determining how and why the relevant Personal Data is processed.

9. Citytech as Data Processor

Citytech may act as a Data Processor when a customer determines the purposes and means of processing and Citytech processes Personal Data on the customer's behalf.

This may occur when Citytech:

• develops software for a customer;
• hosts or supports a customer application;
• provides managed services;
• provides application integration;
• processes customer data within an enterprise application;
• provides HR, ERP or other business software services;
• processes eInvoicing information on behalf of a customer; or
• provides other services where customer data is processed according to customer instructions.

In such circumstances:

• the customer may be the Data Controller;
• Citytech will process Personal Data in accordance with applicable contractual instructions;
• Citytech will apply appropriate technical and organisational security measures;
• access to Personal Data will be limited to authorised personnel and service providers who require access;
• Citytech will assist the customer with applicable data-protection obligations to the extent required by the applicable agreement and law; and
• Personal Data will be returned, deleted or retained in accordance with the applicable contract and legal requirements.

Where required, the parties may enter into a separate DPA.

10. eInvoicing and Peppol Services

Citytech provides electronic invoicing and related electronic document exchange services and may act as an Accredited Service Provider within the UAE eInvoicing framework.

In providing these services, Citytech may process Personal Data contained in invoices, credit notes and related electronic documents.

Where applicable, electronic documents may be transmitted or routed through the relevant electronic invoicing or Peppol infrastructure.

Citytech may process such information for purposes including:

• electronic invoice exchange;
• document validation;
• document routing;
• transmission and receipt;
• delivery status;
• transaction tracking;
• audit trails;
• regulatory compliance;
• customer support;
• system security; and
• service management.

Where Citytech acts as a Processor, the customer remains responsible for determining the lawful purpose of processing the information submitted through the service, subject to applicable law and contractual arrangements.

Citytech will not use customer eInvoicing data for unrelated commercial purposes unless authorised by the customer or required/permitted by applicable law.

11. Disclosure of Personal Data

Citytech may disclose Personal Data to the following categories of recipients where necessary and lawful:

• Citytech employees and authorised personnel;
• affiliated companies;
• hosting and cloud service providers;
• software and technology providers;
• infrastructure and security providers;
• telecommunications providers;
• payment service providers;
• professional advisers;
• auditors;
• legal advisers;
• insurers;
• subcontractors and service providers;
• eInvoicing and electronic document exchange ecosystem participants;
• Peppol-related service providers where applicable;
• government and regulatory authorities; and
• other parties where disclosure is required by law or authorised by you or our customer.

We require relevant service providers to maintain appropriate confidentiality and security obligations appropriate to the services they provide.

Citytech does not sell personal information to third parties.

12. International Transfers

Citytech operates in an international business environment and may use service providers, technology platforms and infrastructure located in countries other than the country in which the Personal Data was originally collected.

Personal Data may therefore be transferred to or accessed from jurisdictions outside the UAE, including where necessary to provide services or operate our technology infrastructure.

Where applicable law imposes requirements on international transfers, Citytech will implement appropriate safeguards and comply with applicable transfer requirements.

For individuals whose Personal Data is subject to the GDPR or equivalent laws, Citytech will apply the applicable requirements governing transfers to countries outside the European Economic Area or other relevant jurisdictions. The GDPR regulates transfers of personal data to third countries and international organisations under Chapter V.

13. Data Retention

Citytech retains Personal Data only for as long as reasonably necessary for the purposes for which it was collected, taking into account:

• the nature and purpose of processing;
• contractual requirements;
• legal and regulatory requirements;
• tax and accounting requirements;
• dispute resolution;
• security requirements;
• audit requirements;
• applicable eInvoicing requirements; and
• legitimate business requirements.

When Personal Data is no longer required, Citytech will delete, anonymise or securely dispose of it, subject to applicable legal, regulatory, contractual and legitimate business retention requirements.

For eInvoicing and tax-related information, retention periods may be determined by applicable UAE legislation, regulations and eInvoicing requirements and may therefore be longer than ordinary website or marketing information.

Citytech does not retain Personal Data indefinitely as a general policy.

14. Information Security

Citytech maintains technical and organisational measures designed to protect Personal Data against:

• unauthorised access;
• accidental or unlawful destruction;
• loss;
• alteration;
• disclosure;
• misuse; and
• other unlawful or unauthorised processing.

Depending on the nature of the service, security measures may include:

• access controls;
• role-based permissions;
• authentication controls;
• encryption in transit;
• encryption at rest where appropriate;
• network and endpoint security;
• logging and monitoring;
• vulnerability management;
• backup and recovery;
• secure software-development practices;
• employee confidentiality obligations;
• security awareness and training;
• incident-management procedures; and
• business continuity and disaster-recovery measures.

The specific security measures applicable to a customer service may be described in the applicable contract, DPA, security documentation or other agreed documentation.

No method of transmission or storage can be guaranteed to be completely secure. However, Citytech continuously evaluates and improves its security controls based on applicable risks and industry practices.

15. Personal Data Security Incidents

Citytech maintains procedures for identifying, assessing, managing and responding to information-security and Personal Data incidents.

Where required by applicable law or contractual obligations, Citytech will notify the relevant customer, authority or affected individuals of a Personal Data breach within the applicable timeframe.

Where Citytech acts as a Data Processor, notification and cooperation obligations will be governed by the applicable DPA and customer contract.

16. Cookies and Similar Technologies

Our websites may use cookies and similar technologies to:

• operate the website;
• remember preferences;
• analyse website usage;
• improve website performance;
• understand visitor behaviour; and
• support marketing activities where permitted.

Cookies may be provided by Citytech or by third-party service providers.

Where legally required, we will request consent before placing non-essential cookies or similar technologies.

You may manage cookies through your browser settings and, where available, through our website's cookie-consent mechanism.

A separate Cookie Policy may provide additional information regarding the specific cookies and technologies used on our websites.

17. Marketing Communications

Citytech may send business communications about our services, products, events, webinars and other relevant information where permitted by applicable law.

You may unsubscribe from marketing communications by:

• using the unsubscribe mechanism provided in the communication; or
• contacting us at the privacy contact address below.

Please note that you may continue to receive essential service-related communications, such as contractual notices, security notifications, service updates and transaction-related communications.

18. Data Subject Rights

Depending on applicable law and the circumstances of the processing, you may have rights in relation to your Personal Data.

These may include the right to:

• request access to Personal Data;
• request correction of inaccurate or incomplete information;
• request deletion of Personal Data where legally applicable;
• request restriction of processing;
• object to certain processing;
• withdraw consent where processing is based on consent;
• request portability of Personal Data where applicable;
• request information regarding how Personal Data is processed; and
• lodge a complaint with the relevant data protection authority.

The availability and scope of these rights may vary depending on the applicable law and circumstances.

For example, UAE data protection law establishes a federal framework governing the collection, processing and protection of Personal Data and provides rights and obligations for relevant parties.

Individuals protected by the GDPR may have additional rights under applicable GDPR provisions, including rights concerning access, rectification, erasure, restriction, objection and portability.

19. How to Exercise Your Rights

To exercise a privacy right or submit a privacy-related request, please contact:

When making a request, we may ask for sufficient information to verify your identity and protect against unauthorised disclosure of Personal Data.

We will respond to valid requests within the timeframe required by applicable law.

Where Citytech processes Personal Data on behalf of a customer, we may refer your request to the relevant customer as Data Controller or assist that customer in responding to your request, as appropriate.

20. Accuracy of Personal Data

We seek to maintain accurate and up-to-date Personal Data.

You should notify us if information you have provided to Citytech changes or if you believe information we hold about you is inaccurate.

Where appropriate, we will take reasonable steps to correct or update inaccurate information.

21. Children's Privacy

Our websites and business services are generally intended for businesses and adults and are not directed at children.

Citytech does not knowingly collect Personal Data from children through its websites except where such processing is lawful and necessary for a specific service or purpose.

Under applicable UAE requirements, additional protections apply to children's Personal Data.

If you believe that a child has provided Personal Data to us in circumstances where this was not appropriate, please contact us at legal@citytechme.com

22. Third-Party Websites and Services

Our websites may contain links to third-party websites, applications or services.

Citytech is not responsible for the privacy practices, security or content of third-party websites.

You should review the privacy policies of third-party websites before providing them with Personal Data.

Where Citytech integrates third-party services into a customer solution, the processing of Personal Data by those third parties may also be governed by the customer's contract and applicable DPA.

23. Third-Party Service Providers

Citytech may engage third-party service providers to support our operations and deliver services.

Such providers may include:

• cloud infrastructure providers;
• hosting providers;
• security providers;
• communications providers;
• CRM and business-management platforms;
• analytics providers;
• payment providers;
• software vendors;
• professional advisers; and
• other technology or operational service providers.

Where required, Citytech will impose appropriate contractual confidentiality, privacy and security obligations on relevant service providers.

24. Automated Decision-Making and Artificial Intelligence

Citytech may use automation, analytics and artificial intelligence technologies in certain business operations or services.

Where such technologies process Personal Data, Citytech will take appropriate measures to ensure that processing is conducted in accordance with applicable law and contractual obligations.

Citytech does not intend to use Personal Data collected through this website to make solely automated decisions that produce legal or similarly significant effects on individuals unless such processing is lawfully permitted and appropriate safeguards are implemented.

Where a specific Citytech service involves significant automated decision-making or AI processing of Personal Data, additional information may be provided in the applicable service documentation or privacy notice.

25. Data Provided by Customers

Where customers provide Personal Data to Citytech for processing, the customer is responsible for ensuring that it has an appropriate lawful basis and any required notices, consents or authorisations to provide such Personal Data to Citytech.

Customers should not provide Citytech with sensitive or special-category Personal Data unless:

• the processing is necessary for the contracted service;
• the customer has a lawful basis for the processing; and
• the processing is permitted under applicable law and the applicable contract.

Where special-category or sensitive Personal Data is required, the parties may agree additional safeguards through the applicable DPA or contract.

26. Employee and Recruitment Information

Where you apply for employment or work opportunities with Citytech, your Personal Data may be used for:

• recruitment;
• candidate evaluation;
• interview scheduling;
• background verification where lawful;
• communication regarding employment opportunities;
• maintaining recruitment records; and
• complying with legal obligations.

Recruitment information will be retained only for as long as reasonably necessary for the relevant recruitment process and applicable legal or legitimate business purposes.

27. Complaints

If you have a concern about how Citytech has handled your Personal Data, we encourage you to contact us first so that we can investigate and address the issue.

You may contact:

Where applicable, you may also have the right to lodge a complaint with the relevant data protection or regulatory authority.

28. Changes to this Privacy Policy

Citytech may update this Privacy Policy from time to time to reflect:

• changes in our services;
• changes in technology;
• changes in our business practices;
• changes in applicable laws or regulations; or
• improvements to our privacy practices.

The updated Privacy Policy will be published on this page together with the revised “Last Updated” date.

Where required by applicable law, we will provide additional notice of material changes.

29. Contact Us

If you have questions about this Privacy Policy, our privacy practices or the processing of your Personal Data, please contact:

30. Governing Law

This Privacy Policy is intended to operate in accordance with applicable laws and regulations governing the processing and protection of Personal Data.

Nothing in this Privacy Policy limits any mandatory rights or protections available to individuals under applicable data protection law.

Where a separate agreement between Citytech and a customer contains specific data-protection provisions, those provisions will apply to the extent they govern the relevant processing activity.

End of Privacy Policy

Version: 2.0  |  Effective Date: 15 September 2024