1. Roles of the parties
For the data in a customer's Mercato workspace, the customer company (the landlord or mall operator) is the controller, or business owner, of the personal data. ReoSoft, Dubai, United Arab Emirates, acts as processor, or service provider, and processes that data on the customer's documented instructions and in line with the applicable subscription agreement and this document.
The customer is responsible for having a lawful basis for the data it places in Mercato, including data about its retailers, tenants, staff and visitors, and for giving any required notices and obtaining any required consents. This agreement is drafted with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) in mind. Where a customer operates in Saudi Arabia, Egypt or another country in our region, the equivalent local data protection law applies to that customer's data, and the parties will cooperate in good faith to meet its processor requirements.
Where ReoSoft decides the purposes of processing for its own account, for example Website analytics or billing and account administration, it acts as controller. That processing is described in our privacy policy.
2. Processing instructions
ReoSoft processes personal data only to provide Mercato and related support: hosting, authentication, leasing and contract records, turnover rent and sales declarations, service charges, collections and cheques, accounting and VAT, mall operations, the retailer portal, reporting, documents, backup, maintenance, security and support. The customer's use of the product's features, its configuration choices and its written support requests are its instructions.
- Categories of data subjects may include the customer's retailers and tenants and their representatives, owners, employees and users, suppliers, contractors, and, where the customer enables visitor marketing, mall visitors.
- Data may include names, e-mail addresses, phone numbers, identity and trade licence details, addresses, contract and payment records, cheque details, sales declarations, documents, notes and audit logs. Where the customer enables visitor marketing through POS receipts or guest Wi-Fi, it may also include the contact details and consent records of visitors.
- Processing continues for the duration of the subscription and during the return and deletion period described below.
- If ReoSoft considers that an instruction would breach applicable law, it will tell the customer, and may suspend the instruction until it is clarified.
Everyone at ReoSoft who can access customer personal data is bound by a duty of confidentiality and receives access only as far as needed to run and support the service.
3. Security measures
ReoSoft applies technical and organisational measures designed to protect personal data. They include:
- Per-company isolation enforced in the database with PostgreSQL row-level security, so one customer's data is not readable from another customer's workspace.
- Encryption in transit with TLS; documents stored with server-side encryption; sensitive credentials encrypted at the application level.
- Two-factor authentication (TOTP), passkeys and single sign-on through OpenID Connect.
- Role-based permissions and property-level access, so users see only what their role and assignment allow.
- An audit trail of important actions.
- Automated, scheduled database backups with off-site copies, and monitoring of the service.
- Tools for data subject export and erasure, and automatic anonymisation of visitor-marketing data after a default retention period of 24 months, which the customer can configure.
No system is perfectly secure, and ReoSoft does not claim any security certification beyond what it states in writing. The customer is responsible for managing its own users, passwords, roles and devices, and for configuring access appropriately.
4. Sub-processors and hosting
The customer gives ReoSoft a general authorisation to use the sub-processors below. ReoSoft remains responsible for them and binds each to confidentiality and data protection obligations appropriate to its role.
| Sub-processor | Purpose | When it applies |
|---|---|---|
| Cloud hosting provider | Hosting of the customer's dedicated deployment and its own database | Always |
| Amazon Web Services | Object storage with server-side encryption for documents; e-mail delivery through SES | Always |
| Anthropic | Powers the Ask Mercato assistant, which runs read-only queries on the customer's own records | Only if the customer enables the Ask Mercato add-on |
| Meta (WhatsApp Business Cloud API) and Twilio (SMS) | Delivery of messages to retailers, tenants or visitors | Only if the customer enables messaging |
| Stripe | Subscription billing | For customers billed through Stripe |
| Error-monitoring service | Detecting and diagnosing faults in the service | May be used; configured to avoid sending personal data where practical |
The hosting location is agreed with each customer, and in-region hosting is available where data residency requires it. Google Analytics is used on the reosoft.ai Website only, and only with consent; it does not process the content of customer workspaces. See our cookie policy.
ReoSoft will give customers reasonable notice of the addition or replacement of a sub-processor, for example by updating this page or by e-mail. A customer may object on reasonable data protection grounds within 30 days of notice; the parties will then discuss a solution in good faith, and if none is found the customer may terminate the affected service.
5. Requests, return and deletion
If ReoSoft receives a request from a data subject about personal data in a customer's workspace, it will normally refer the person to the customer, unless the law requires ReoSoft to respond directly. ReoSoft will give the customer reasonable help, including the built-in export and erasure tools, so that the customer can respond to such requests, and with its own data protection assessments and regulator enquiries where they concern the service.
During the subscription, and for a period after termination stated in the subscription agreement, the customer can export its data. After that period ReoSoft deletes or anonymises the customer's data, unless the law requires it to keep some of it. Data in backups is overwritten in the normal backup cycle. On request, ReoSoft will confirm the deletion in writing.
6. Personal data breaches
If ReoSoft becomes aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to customer personal data, it will notify the customer without undue delay. The notice will describe, as far as known, the nature of the breach, the data affected, the likely consequences and the measures taken, so that the customer can meet its own notification duties to regulators and individuals.
7. Contact, audits and changes
The customer may ask ReoSoft for reasonable information to show compliance with this agreement; ReoSoft will answer security questionnaires and, where the customer is required to audit, will agree a reasonable scope and timing so that other customers and the service are not put at risk. Questions and requests under this agreement go to info@reosoft.ai.
This agreement is governed by the laws of the United Arab Emirates as applied in the Emirate of Dubai, and disputes are subject to the courts of Dubai, consistent with our terms. We may update it as the service or the law changes; material changes will be notified to customers.
Effective 22 October 2026. This agreement covers Mercato.