Zolia – Sub-processors (Annex 3 to the DPA)

1.1 Microsoft (Microsoft Azure)

Service

Cloud environment that runs the Zolia application (interface, AI runtime, background jobs, virus scanning): virtual machine, managed PostgreSQL database (Azure Database for PostgreSQL) with all structured business data, object storage for files and the write-protected archive (Azure Blob Storage), master keys in a hardware security module (Azure Key Vault), operational logs without personal content (Azure Monitor); speech-to-text for voice messages and text-to-speech for spoken replies (Azure AI Speech) and text recognition in screenshots, business cards and PDFs, including identity documents in KYC checks (Azure AI Document Intelligence), both in UAE North and used only to return the text or the speech to the Service. Azure AI Speech processes audio for real-time speech recognition and text for speech output in UAE North in server memory only; according to Microsoft, neither is stored at rest (audio and transcription logging is off by default and Biturai does not switch it on). Azure AI Document Intelligence keeps the submitted document and the result encrypted in UAE North for up to about 24 hours to deliver the result and then deletes them automatically.

Location

UAE North (Dubai). Backups are kept in the UAE; second site in UAE Central (Abu Dhabi) once it is available

Customer Personal Data

All types listed in Annex 1 of the DPA, including identity documents (encrypted with Tenant keys) and backups; in addition, audio of voice messages and images and documents, including identity documents, while they are being read by the two services above, and the text of spoken replies while it is being turned into speech

Transfer basis

No transfer: storage and processing in the UAE

1.2 Amazon Web Services (contracting entity: Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg; models through AWS Marketplace: Amazon Web Services, Inc., United States)

Service (a): Amazon Bedrock

AI models (Anthropic Claude) for the AI functions of the Service. Only pseudonymised content is sent. The models run within Amazon Bedrock in accounts operated by AWS; the model developer has no access to prompts, outputs or logs. Biturai uses the models under its AWS agreement and the model developer's terms for Amazon Bedrock (section 2). Customer data is not used to train models

Location (a)

EU regions under the AWS "EU" inference profile, called from Frankfurt: depending on the model, requests are processed in Germany, Ireland, France, Italy, Spain or Sweden. Other regions and global profiles are blocked by access policy

Service (b): Amazon Simple Email Service

System e-mails: sign-in codes, notifications, copies of client confirmations; receiving support e-mails sent to support@help.zolia.ai (transit only: forwarded straight to the Service in the UAE, not stored at AWS beyond delivery)

Location (b)

Frankfurt, Germany

Customer Personal Data

(a) pseudonymised text of tasks and AI outputs; (b) e-mail addresses, names and message content

Transfer basis

PDPL Article 23(1)(d), with contractual safeguards (DPA clause 7.2); not Article 22 (no approval published)

1.3 (no longer used)

Meta Platforms (WhatsApp Business Platform) is a provider of the Customer for its own WhatsApp Business account and is listed in section 2 (DPA clause 6.6).

1.4 Vercel Inc. – not a Sub-processor, listed for transparency

Vercel Inc. hosts the website zolia.ai only. The Zolia app is served from Biturai's environment in the UAE (section 1.1). No Customer Personal Data passes through Vercel.

1.5 E-mail for support correspondence – not a Sub-processor for Customer Personal Data

The Customer sends Customer Personal Data to Biturai's support – for example identity documents, contracts or the names of its clients – only within Zolia: through support in the office CRM at app.zolia.ai or in the Zolia app, which are the same system (section 1.1). The Customer never sends such data by e-mail; Biturai's support e-mail addresses are only for questions without Customer Personal Data. Biturai's e-mail service (Google Workspace) and its e-mail client (Spark) are therefore not Sub-processors for Customer Personal Data.

1.6 Didit (identity verification; contracting entity: Didit Identity, Inc., Dover, Delaware, United States)

Service

(a) Identity verification in a KYC case when the Customer starts a check: ID document check, liveness check, face match, device and IP check and an AML screening. The person being checked uploads the ID document and a selfie directly to Didit; for this check Biturai sends Didit only a reference to the KYC case and no personal data. (b) Check against lists of politically exposed persons when a person is screened in a KYC case: the Service sends Didit only the name, the date of birth and the nationality of that person and asks Didit not to store the request

Location

European Union (Amazon Web Services, Ireland)

Customer Personal Data

(a) Images of the ID document and the data read from it, selfie and face template, results of the liveness check, face match and AML screening, device and IP data of the person being checked; (b) name, date of birth and nationality of the person screened and the result of the check

Retention

Biturai moves the result and the images to the Customer's encrypted KYC vault in the UAE (section 1.1) right after the check and then deletes the check at Didit, including the face template. Failed transfers are retried; Didit deletes the data after one month at the latest. (b) The result of a check against lists of politically exposed persons is kept in the KYC case in the UAE; Biturai asks Didit not to store the request

Transfer basis

PDPL Article 23(1)(d), with contractual safeguards (DPA clause 7.2); not Article 22 (no approval published)

Vercel Inc.

Hosting of the website zolia.ai only
Why not a Sub-processor: No Customer Personal Data passes through Vercel; the Zolia app is served from Biturai's environment in the UAE (section 1.1)

Meta Platforms (WhatsApp Business Platform)

Provider of the Customer for its own WhatsApp Business account (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland); the Customer holds the account and pays Meta directly
Why not a Sub-processor: Contracted by the Customer (DPA clause 6.6); the Service sends and receives messages through it on the Customer's instruction. Message data at rest in the UAE where the number uses local storage. Biturai also uses the platform as controller for its own number (sign-in codes) and for measuring its own advertising, without Customer Personal Data

Cloudflare, Inc.

Domain registration and DNS
Why not a Sub-processor: DNS only; traffic of the Service is not routed through Cloudflare

GitHub

Source code of the Service
Why not a Sub-processor: No Customer Personal Data

1Password

Biturai's vault for its own access credentials
Why not a Sub-processor: No Customer Personal Data

Tailscale Inc.

Encrypted administrator access to Biturai's servers
Why not a Sub-processor: Traffic is end-to-end encrypted (WireGuard) between Biturai's devices and servers; Tailscale coordinates connections and sees device metadata only

Anthropic, PBC

Developer and seller of the Claude models that the Service uses through Amazon Bedrock; Biturai has accepted the "Anthropic on Bedrock – Commercial Terms of Service" through AWS Marketplace
Why not a Sub-processor: The models run in accounts operated by AWS to which Anthropic has no access, so Anthropic receives no prompts, outputs or logs. Under its terms, Anthropic may not train models on Customer Content

Providers of the Customer

Providers that the Customer connects to the Service: accredited e-invoicing service provider and accounting software (for example Zoho Books, Wafeq), payment service provider (for example Stripe), telecom operators for do-not-call checks, the Customer's e-mail and calendar provider (Google Workspace, Microsoft 365), WhatsApp business solution providers (for example 360dialog), property portals and portal CRMs (for example Property Finder, Bayut, PropSpace)
Why not a Sub-processor: Contracted by the Customer; the Service transmits data to them only on the Customer's instruction (DPA clause 6.6)

Biturai's billing and accounting tools

Invoicing and collection of Biturai's own fees: payment service provider (Stripe), verification of purchases in the App Store and Google Play (Apple, Google), accounting (Wafeq)
Why not a Sub-processor: Business contact and billing data of the Customer, for which Biturai is controller

Push services (Apple, Google, Mozilla, Microsoft)

Delivery of notifications to devices
Why not a Sub-processor: A native notification carries only a wake-up signal without content; web notifications are end-to-end encrypted (RFC 8291), so the push services cannot read them

Digital Dubai (data.dubai)

Source of public market data (open data of the Dubai Land Department)
Why not a Sub-processor: The Service only downloads public data; no Customer Personal Data is sent

Publishers of official sanctions lists (United Nations Security Council, Executive Office for Control and Non-Proliferation of the UAE, OFAC, European Union, United Kingdom)

Download of the published lists into the Service in the UAE
Why not a Sub-processor: The Service only downloads the lists; names of persons screened are not sent for this

Google (Search Console), LinkedIn, Cloudflare (Turnstile)

Biturai's own website and marketing data and the protection of its sign-up forms
Why not a Sub-processor: Only data of Biturai's own website and contacts, for which Biturai is controller; no Customer Personal Data

Let's Encrypt (Internet Security Research Group)

TLS certificates of the Service and their revocation checks
Why not a Sub-processor: No Customer Personal Data

Cisco Talos (ClamAV)

Signature updates of the virus scanner
Why not a Sub-processor: Only signatures are downloaded; files are scanned in the UAE and are not sent

Canonical (Ubuntu), Docker, Tailscale (package sources)

Security updates and software packages of the servers
Why not a Sub-processor: Only packages are downloaded; no Customer Personal Data is sent

Monitoring service (not yet selected)

Logs, alerts, status page
Note: Personal data are removed before transmission

SMS provider (not yet selected)

One-time codes by SMS
Note: Licensed provider with registered sender ID

Trusted timestamp service (RFC 3161, not yet selected)

Timestamps for records of client confirmations
Note: Receives hash values only

UAE PASS

Identification and confirmation by clients holding an Emirates ID
Note: Terms of the operator apply; role defined before activation

Hetzner Online GmbH (Germany)

Servers, file storage, backup storage
Ended: 1 October 2026; no Customer Personal Data of a customer was ever processed (test data only)
Replaced by: Microsoft Azure (UAE North)

Supabase, Inc. (United States; region Frankfurt)

Managed database
Ended: 1 October 2026; project deleted, test data only
Replaced by: Azure Database for PostgreSQL (UAE North)

Amazon Web Services – Key Management Service

Master keys
Ended: Keys scheduled for deletion on 1 October 2026 (final deletion 31 October 2026); key material only
Replaced by: Azure Key Vault (UAE North)