Legal

Data processing addendum

AI Team is operated by Akii Technologies, Ltd in DIFC. This DPA describes the controls expected when Akii/AI Team processes client workflow data as a Processor for managed Agent services.

Version and entity

Effective 2026-06-25. Operating entity: Akii Technologies, Ltd, Innovation One, No IH-00-01-03-OF-05, Level 3, Dubai International Financial Centre, Dubai, United Arab Emirates.

AI Team is the product/service brand used for the managed Agent service.
The signed order, scope, approval rules, and compliance evidence define the processing instructions.
Custom enterprise terms override this public summary where they conflict.

Role matrix

For client workflow data, the client is usually Controller and Akii/AI Team is usually Processor.

Akii is an independent Controller for billing, account, website, legal, security, abuse-prevention, and business operations data.
Client-owned systems remain under the client's control and vendor contracts.
Public sector, minors, legal privileged data, sensitive data, residency-sensitive work, and high-impact HR require documented review before go-live.

Processor instructions

AI Team processes client workflow data only for the agreed Agent scope, approved tools, model route, retention rule, and human-review decision.

No client Agent can go live without compliance profile, data classification, transfer assessment, subprocessor approval, retention rule, AI system register, legal acceptance, and model-route approval.
Healthcare providers, medical workflows, regulated financial firms, and regulated financial workflows are rejected or escalated outside standard setup.
Client workflow data is not used for cross-client training or product learning unless explicitly contracted.

Security measures

The service uses technical and organizational measures designed for controlled, auditable Agent operation.

Access control, least-privilege permissions, credential access review, audit logs, incident paths, backup/restore evidence, and tenant separation.
Operator notes, run summaries, logs, monitoring, and traces must not contain raw secrets, credentials, medical records, regulated finance records, or full customer exports.
Sentry, Langfuse, analytics, OpenTelemetry, and support tooling are governed by data-minimization and redaction rules.

Subprocessors and transfers

Subprocessors must be disclosed with purpose, data categories, region/location, transfer basis, support access, retention posture, and allowed data classes.

Material provider changes can require notice depending on the signed agreement.
Default hosting is EU/international provider based unless a separate in-country deployment is contracted and evidenced.
Model providers and Agent-tool providers are approved by data class before production use.

AI governance

Where personal data is processed by autonomous or semi-autonomous Agent behavior, AI Team maintains an AI system register and human oversight record.

The register records purpose, data classes, model route, tool permissions, autonomy tier, human intervention, testing, incidents, and kill-switch/rollback paths.
Consequential HR, customer-facing, external-action, or sensitive workflows require human review unless specifically approved.
DIFC Regulation 10 style governance is treated as a first-class control for the DIFC operator.

Assistance and deletion

AI Team supports reasonable controller requests for access, correction, export, deletion, restriction, objection, incident investigation, and audit evidence.

Requests may be routed to the client when the client controls the underlying workflow data.
Breach support includes known scope, mitigation, affected services, next update, and evidence where practical.
Return, deletion, backup expiry, log retention, legal hold, billing, security, and dispute exceptions follow the applicable agreement.

Next step

Need help applying this policy?

Start with setup so AI Team can confirm the work, required access, approval rules, pass-through costs, and go-live requirements.

Start setup Contact AI Team