Sia T3 The short version
- Your data stays in the UAE. Sia T3 runs on a server in Dubai. Each space has its own database and files, kept apart from every other space.
- We don't sell it, share it for advertising, or track you. There are no ads, no analytics and no tracking cookies.
- Health details and children's accounts get extra care. They stay inside your space, and children see only their own.
- You're in control. In Your data (the menu under your name) you can download a copy, delete your account, or close your space.
- Questions? Write to privacy@siat3.com.
Who we are
Sia T3 is made and run by SIA Nexus Group L.L.C-FZ, a company registered in Meydan Free Zone, Dubai, United Arab Emirates ("we", "us"). This policy explains what personal data we handle when you use siat3.com and the Sia T3 app, why, and what you can do about it.
We follow the UAE's Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). If you are in the European Union or the UK, we also aim to give you the protections of the GDPR.
Companies, and everyone else
Sia T3 has two kinds of spaces, and who is responsible for your data depends on which one you're in.
- A company's space. The company decides what goes into its space and why; it is the controller of that data, and we look after it on the company's behalf as its processor, under our Data processing agreement. If you use Sia T3 at work, your employer's own privacy notice applies too, and questions about your work data should go to them first.
- Free spaces: a family, a trip or event, a shared home, a club or team, a community or study group. Here we are the controller of the account and the service, and this policy is our promise to you directly. The person who created the space (the organiser) decides who joins it, and is responsible for adding other people fairly and with their knowledge.
What we collect
When you sign up or are added
Your name, username, password (stored only as a one-way scrypt hash, never readable), and, if you add them, your email address, phone number, photo and a few words about yourself. For the person creating a space, we also record when they agreed to these terms.
What you put into your space
Everything you and the others in your space enter: tasks, notes, messages, files and photos, calendar events, lists, budgets and shared costs. Depending on the kind of space and what it's used for, that can include:
- Companies: clients and their contacts, timesheets, leave, expense claims and receipts, invoices, staff documents, and, for firms that use the AML module, client identity documents and screening results.
- Families: children's accounts, school timetables and homework, chores and rewards, pocket money, health details (see below), home upkeep, and pets and their vet records.
- Trips and events: the itinerary, and guests' names, contact details, replies, party size and food preferences. Guests answering through an RSVP link don't need an account.
Automatically, when you use Sia T3
- A sign-in log: sign-ins, failed attempts, password and two-step changes, and some sensitive actions, with the time, your IP address and the device's browser. It exists to keep your space secure.
- Notification subscriptions if you turn on notifications: an address issued by your browser's notification service.
- Your time zone, so reminders and the morning summary arrive at the right local time.
When you contact us
If you request an invite code or write to us: your name, email address, company and anything you tell us.
Health details and children
Health details
The Health module and the emergency card can hold blood group, allergies, medical conditions, medicines, vaccinations, doctor visits and insurance details. This is sensitive personal data. It is entered by the person themselves, or by a parent for their child, and we process it only on the basis of that person's explicit consent, which they give when they first open Health, and, for the emergency card, to protect someone's vital interests in an emergency.
Health details are seen only inside your space, by its grown-ups. In a family they are shared on purpose, so anyone can help in an emergency: the emergency card shows everyone's essentials to the family. Children see only their own. Health details are never shared outside the space, never used for anything other than showing them and reminding you, and never sold. You can change or delete them at any time.
Children
Only adults (18 or over) may create a space or an account of their own. A child's account can only be created by their parent or guardian in a family space, who confirms that role when creating it. The parent controls the child's data: they can see it, download it and delete the account. Children's accounts can never see money, documents or other people's health details.
Identity documents (companies)
Firms using the AML module may store their clients' identity documents and screening results. Each opening of an AML file is recorded in the sign-in log. These records are kept as the firm's anti-money-laundering obligations require; the firm is responsible for them as controller.
Why we use it, and on what basis
| What we do | Legal basis |
|---|---|
| Run your space and show you and your people what you've entered | To provide the service you asked for (our contract with you, or with your company) |
| Health details and the emergency card | Your explicit consent; vital interests in an emergency |
| Keep a sign-in log, stop repeated wrong passwords, keep backups | Our legitimate interest, and yours, in keeping your data safe |
| Keep AML records for the time the law requires | A legal obligation (the company's) |
| Answer your messages and requests for a code | Your request; our legitimate interest in replying |
We do not use your data for advertising, we do not build profiles of you, and we do not make automated decisions about you that have legal or similar effects.
Where your data is kept
Everything is stored on our server in a data centre in Dubai, United Arab Emirates. Each space has its own database and its own folder of files, run by its own process, so one space's data is never mixed with another's.
Once we switch on off-site backups, an encrypted copy of each space will also be stored with an off-site storage provider (Backblaze). The copy is encrypted before it leaves our server, with a key the provider doesn't have. We will name the storage region here before that starts; if it is outside the UAE, the transfer will be made only with the safeguards the law requires.
A company can choose to keep its own extra copies in its Google Drive or Microsoft OneDrive. Those copies are encrypted too, and they are then the company's own, under its own agreement with Google or Microsoft.
Who else handles it
We don't sell or rent personal data. Only these service providers handle it, and only to run Sia T3:
| Who | What for | What they see |
|---|---|---|
| WHG Hosting Services Ltd | The server and data centre in Dubai | Stored data, which they don't access except to keep the server running |
| Apple, Google, Microsoft, Mozilla | Delivering notifications to your phone or computer, if you turn them on | The notification's text and the device it goes to |
| Backblaze (when switched on) | Off-site backups | Only encrypted files they cannot read |
| Google or Microsoft (a company's choice) | The company's own backup copies, if it connects its Drive | Encrypted files in the company's own account |
Some features open another service only when you choose to: a map link opens Google Maps, a "send" link opens WhatsApp or your email, "add to calendar" opens Google Calendar or Outlook. Exchange rates come from the European Central Bank, which receives no personal data.
We may disclose data if UAE law or a court order requires it, and will tell the space's organiser or company unless we're not allowed to.
Our own staff can technically reach the server. The operator's console shows only counts (people, tasks, storage), never a space's content, and we look at content only to help when you ask us, or when the law requires it.
How long we keep it
| What | How long |
|---|---|
| What's in your space | Until you delete it, or the space is closed |
| A closed space | Locked at once, deleted for good 30 days later (including its backups on our server) |
| Daily backups on our server | The latest 14 days: something you delete can remain in a backup for up to 14 days |
| Off-site encrypted backups (when switched on) | 30 days |
| The sign-in log | 1 year in free spaces; 5 years in company spaces (matching anti-money-laundering record-keeping) |
| Requests for an invite code | Until dealt with, then 30 days |
Your rights
You have the right to see the data we hold about you and get a copy, to correct it, to have it deleted, to restrict or object to how it's used, to take it with you in a common format (portability), and to withdraw consent you've given (for example for health details) at any time.
Most of this you can do yourself:
- Your data → Download a copy (in the menu under your name): your own data, or (for an organiser or admin) the whole space, as spreadsheets and files in one zip.
- Edit or delete anything you've entered, including your health details, at any time.
- Your data → Delete my account (free spaces). If others rely on things you've done, such as shared costs or messages, those stay, shown as "Former member", and everything personal about you is removed.
- Your data → Close this space (organisers and admins).
For anything else, write to privacy@siat3.com. We answer within 30 days. If your data is in a company's space, we'll pass your request to the company, which decides on it.
If you're unhappy with how we've handled your data, please tell us first. You can also complain to the UAE Data Office or, in the EU or UK, to your local data protection authority.
How we keep it safe
- A separate database, files and sign-ins for every space.
- HTTPS for every connection; passwords stored only as scrypt hashes; repeated wrong guesses pause sign-in.
- Two-step sign-in with an authenticator app, which the space's admin can require for everyone.
- A sign-in log each space's admin can review.
- Daily backups, and encrypted off-site copies.
No system is perfectly secure. If a breach affects your data, we will tell you, or your company, and the UAE Data Office as the law requires, without undue delay.
Changes to this policy
When we change this policy we'll update the version and date at the top. If a change matters, we'll tell each space's organiser or admin in the app before it applies.
Contact
SIA Nexus Group L.L.C-FZ, Meydan Free Zone, Dubai, United Arab Emirates · privacy@siat3.com