Institutional Privacy Policy & Terms of Engagement
Clear, binding covenants on client code ownership, strict data sovereignty compliant with UAE Federal Decree-Law No. 45/2021 (PDPL), deterministic AI containment, and zero vendor lock-in across all engineering and architecture contracts.
The Four Non-Negotiables of Every Hashed System Contract
Unlike legacy outsourcing firms, we reject intellectual rent-seeking, lock-in wrappers, and data harvesting. These four tenets are irrevocably enshrined in every statement of work.
100% Client IP Ownership
Full assignment governed by UAE Copyright Law (Federal Law No. 38/2021) and international conventions. You own every line of source code, Dockerfile, Terraform template, and vector configuration immediately upon milestone signoff.
Sovereign In-Region Compute
Client records, model embeddings, and customer payloads remain within sovereign UAE boundaries (AWS UAE me-central-1, Azure UAE North, or local UAE Tier-3+ facilities) in strict compliance with UAE PDPL cross-border transfer laws.
Zero AI Model Retention
We mandate zero-data-retention APIs and self-hosted open-weights LLMs. Your operational prompts, internal schemas, and IP are strictly isolated from foundational model training.
Milestone-Based Billing
Predictable fixed-scope sprints with rigorous bi-weekly demos. Capital is disbursed only upon verified automated test pass-rates and production milestone approvals.
Sovereign Data Governance & International Privacy Protocols
Compliant with UAE Federal Decree-Law No. 45/2021 (PDPL), EU Regulation 2016/679 (GDPR), and the UK Data Protection Act 2018. Designed for institutional clients requiring absolute jurisdictional clarity.
Scope & Responsible Operating Entities
This Privacy Policy establishes how Hashed System and its international affiliates process, secure, and govern proprietary information and personally identifiable data (PII). Depending on your contractual domicile and project jurisdiction, the data controller is formally registered as:
Our sovereign architecture delivery models guarantee that customer production payloads remain within the contractual sovereignty borders agreed upon in your respective Statement of Work (SOW).
UAE Personal Data Protection Law (Decree-Law No. 45/2021)
Hashed System operates in strict adherence with the UAE Federal Decree-Law No. 45/2021 on the Protection of Personal Data (PDPL) and supervisory guidelines issued by the UAE Data Office. For all projects with GCC and UAE nexus:
Categories of Information Processed
Hashed System operates strictly under the principle of data minimization. We classify processed data into three non-overlapping tiers:
- check_circle Account & Commercial Metadata: Authorized signatory names, corporate email addresses, billing coordinates, and communications conducted through institutional advisory channels.
- check_circle Architecture & Staging Artifacts: Git branches, automated continuous integration logs, test seeds, and synthetic mock datasets utilized for performance verification.
- check_circle Production Payloads (Client Tenant): Live production records processed within the client’s designated AWS/Azure/GCP VPC or sovereign bare-metal clusters, accessed strictly via zero-trust ephemeral bastions.
Lawful Bases & Multi-Jurisdictional Regulatory Alignment
All processing operations executed by Hashed System engineers are anchored in rigorous statutory standards:
Execution of contract (Article 4.2), explicit sovereign consent for cross-border engineering collaboration, and alignment with the UAE Data Office regulations.
Legitimate commercial interest and contractual performance under Article 6(1)(b) & (f). European Standard Contractual Clauses (SCCs) are baked into every non-EU engagement.
Enterprise AI, LLM Prompt Isolation & Vector Data Privacy
As an enterprise systems advisory implementing autonomous AI agents, Retrieval-Augmented Generation (RAG) pipelines, and high-concurrency LLM routers, we enforce categorical engineering safeguards:
Third-Party Sub-Processors & Cloud Partners
Hashed System leverages only tier-1 SOC-2 Type II and ISO 27001 certified cloud infrastructure for development staging and internal telemetry. Sub-processors are bound by identical confidentiality and security terms:
Data Retention, Ephemeral Staging & Cryptographic Deletion
Staging environments and test databases are subject to automated ephemeral teardown cycles. Upon final milestone handoff and acceptance:
- done Development branch databases undergo complete cryptographic erasure within 30 calendar days.
- done All staging credentials, temporary IAM access keys, and Bastion tunnels are revoked with verification audit logs provided.
- done A formal Certificate of Cryptographic Sanitization is issued by our Lead Security Architect upon request.
Data Subject Rights & Access Requests (DSAR)
Under UAE PDPL (Federal Decree-Law No. 45/2021), EU GDPR, and UK DPA, you retain sovereign ownership of personal records. DSAR requests are resolved within the mandatory 30-calendar-day statutory timeframe in direct coordination with our UAE compliance desk at [email protected].
Security Safeguards & Bilateral NDA Protection
Every client interaction is shielded under a reciprocal mutual Non-Disclosure Agreement (NDA). All engineering staff, principal architects, and advisors hold strict background certifications and are bound by bilateral secrecy obligations that survive the termination of commercial engagements indefinitely.
Terms of Service & Master Delivery Standards
Our delivery methodology is built around transparency, verifiable sprint commits, and total elimination of software vendor lock-in.
Work Product Assignment & Git Transfer
Upon clearance of each sprint milestone invoice, Hashed System assigns 100% of the intellectual property, copyright, patentable algorithms, and repository commits directly to the client. We retain no residual claim or backend telemetry hook.
90-Day Production Defect Warranty
All custom software delivered under fixed-scope contracts is backed by an unconditional 90-day post-launch warranty. Any reproducible deviation from documented functional requirements is remediated at zero additional cost.
Confidentiality & Bilateral Non-Disclosure
All discussions, architecture schemas, financial projections, and proprietary algorithms are protected under mutual non-disclosure covenants enforceable across UAE, English, and Portuguese jurisdictions.
Senior Architect Guarantee
We operate strictly via high-caliber, senior-level principal engineers. We maintain a zero-junior subcontracting policy—every client sprint is managed by named architects with minimum 8+ years distributed systems tenure.
Liability & Consequential Damages
Our liability caps are equitable and tied to the aggregate contract value paid within the preceding 12 months. Standard consequential, indirect, and punitive loss carve-outs conform to DIFC and English Common Law norms.
Dispute Resolution & Arbitration
Disputes are subject to binding international arbitration under the rules of the Dubai International Arbitration Centre (DIAC / DIFC-LCIA) or the High Court of Justice in London, ensuring neutral, enforceable proceedings.
Local Compliance Guarantees by Registered Entity
Execute Master Services Agreements under the sovereign legal entity best aligned with your corporate treasury, tax residency, and cross-border regulatory demands.
Need a Bespoke Master Services Agreement (MSA) or Custom Enterprise DPA?
Our in-house legal and compliance counsel reviews your enterprise procurement requirements, executes custom bilateral NDAs, and countersigns sovereign Data Processing Addendums without delay.
Frequently Asked Questions
Direct technical, commercial, and legal answers regarding our GCC advisory engagements.