Sign in Book a walkthrough
Legal

Data Processing

Last updated: 01/01/2026

When you subscribe to Malek365, you (the Subscriber) upload information about your properties, tenants, and lease contracts. This section explains how Mosaic Elite handles that information on your behalf.

1. Roles

  • You are the Data Controller for tenant and property data you upload. You decide what to enter and why.
  • We are the Data Processor. We process this data only on your instructions and only to deliver the Service.

2. What We Process on Your Behalf

  • Tenant records: names, contact details, identity numbers (where you provide them), commercial registration and VAT numbers for business tenants.
  • Lease contracts: terms, dates, financial values, attached documents.
  • Payments: schedules, statuses, amounts, history.
  • Documents you upload: contracts, IDs, permits, licenses, fit-out plans.

3. How We Process It

We process this data to:

  • Display it back to you and your authorized users.
  • Generate reports, reminders, and notifications you initiate.
  • Power AI features inside the Service that you choose to use.
  • Maintain backups and security.
  • Provide support when you request it.
  • Produce anonymized, aggregated insights for product improvement and market research (see Section 5).

We do not access your data for any other purpose.

4. Subprocessors

We use trusted service providers ("subprocessors") to operate the infrastructure behind Malek365, including cloud hosting, email delivery, and AI inference. Each subprocessor is bound by written confidentiality and data-protection obligations.

A current list of subprocessors is available on request. We will notify Subscribers of material changes in writing.

5. Anonymized Aggregated Insights

By subscribing to Malek365, you acknowledge and agree that we may use Subscriber data in anonymized and aggregated form to improve the Service and produce market research and industry insights.

This processing is subject to strict safeguards:

  • All personal identifiers (tenant names, contact details, IDs, contract references, property names, organization names) are stripped before any aggregation.
  • Aggregated outputs are produced from a minimum of five (5) organizations per data point, so that no individual party can be identified or inferred.
  • We may publish industry-level summaries (for example, average lease durations by sector, regional payment-timeliness trends) without exposing any source data.
  • We never sell or share raw, identifiable Subscriber data with third parties for marketing or analytics purposes.

Aggregated outputs cease to be personal data once anonymized and cannot be linked back to any individual Subscriber, tenant, or property.

6. Security and Confidentiality

We apply technical and organizational measures appropriate to the risk, including:

  • Encrypted transmission (TLS) of all data in transit.
  • Encryption at rest for sensitive identifiers.
  • Role-based access control within Mosaic Elite.
  • Audit logging of administrative actions.
  • Regular backups with restricted access.
  • Confidentiality obligations on all personnel and subprocessors.

7. Data Retention and Deletion

We retain Subscriber data for as long as the subscription is active. After cancellation:

  • You have 30 days to export your data in standard formats.
  • After 30 days, we may delete the data unless legal retention obligations require us to keep specific records (for example, invoices for tax purposes).

You may request deletion of specific records (such as a former tenant's information) at any time, subject to your own legal obligations as Data Controller.

8. Data Breach Notification

If a personal data breach affecting your data occurs, we will notify you without undue delay and provide:

  • A description of the incident and the data involved.
  • Steps we are taking to address it.
  • Recommendations for any actions you should take.

We will report to the Saudi Data and Artificial Intelligence Authority (SDAIA) where PDPL requires.

9. Subscriber Obligations

As Data Controller, you are responsible for:

  • Having a lawful basis to upload tenant and third-party data.
  • Informing your tenants, where required, that their data is stored in a property-management system.
  • Keeping uploaded data accurate.
  • Removing data when you no longer have a lawful basis to retain it.

10. International Transfers

If data is processed outside the Kingdom of Saudi Arabia by our subprocessors, we ensure protections consistent with PDPL through contractual safeguards.

11. Audit and Cooperation

We will reasonably cooperate with regulatory inquiries and, on request, provide Subscribers with the information they need to demonstrate compliance with PDPL, provided such requests are lawful and reasonable in scope.

12. Contact

Data processing questions or requests:
support@malek365.com · +966 59 363 6777