Business Account Terms & DPA
These Terms apply to corporate and organisational accounts. Where they conflict with the consumer Terms of Service, these prevail for business accounts. Where a signed enterprise agreement conflicts with these Terms, the signed agreement prevails.
Part A — Business Account Terms
Who this is for
Organisations using Let's Horaro for employee recognition, corporate gifting, internal announcements, scheduled communications and digital signage.
"Customer" means the organisation. "Authorised Users" means employees and others the Customer permits to use the account.
The Customer is responsible for its users
The Customer is responsible for:
- all activity under its account, including by Authorised Users
- ensuring Authorised Users comply with these Terms and the Acceptable Use & Community Guidelines
- promptly removing access when someone leaves
- the accuracy of employee and recipient data it uploads
- having a lawful basis to process the personal data it puts into the PlatformAuthorised Users are individuals with their own rights. An employee using a corporate account is still a person whose data is protected. The Customer cannot instruct us to act against an individual's data protection rights.
Employee groups
When the Customer creates its first Tribute, we automatically create a chat group containing its employees. Employees join when they register through their invitation link.
Before you switch this on, please consider:
- Employees can see each other's phone numbers in the group.
- Employees may not expect their personal mobile number to be visible to colleagues.
- In some jurisdictions, requiring employees to use a personal device or personal number for work communication raises employment law issues.We recommend telling employees clearly, before they join, what the group is, who can see what, and that participation is voluntary or a condition of the role — the Customer must specify which.
What Customers cannot do
- No unified customer groups. Corporate admins cannot create a single chat group containing their customers. Customer communications must be individual. This is a deliberate design restriction that prevents corporate accounts being used for bulk unsolicited messaging.
- No covert monitoring. The Customer must not use the Platform to monitor employees' private communications, and must not represent to employees that content is monitored when it is encrypted and cannot be.
- No use of employee personal data beyond the stated purpose.
Digital signage
The Customer can push scheduled messages to signage, office screens and event displays.
This publishes content to a physical space where anyone may see it. The Customer is solely responsible for:
- ensuring displayed content is appropriate for a public or semi-public space
- obtaining consent before displaying an identifiable individual's name, photograph or personal message
- compliance with workplace and public display laws
- a human confirmation step before anything reaches a public screenWe strongly recommend that no content reaches a public display without a person approving it first, particularly where the content is AI-generated. See the AI Features Terms.
Gift catalogue
Corporate accounts see a curated catalogue of up to 10 gift options configured by the Customer or by us. Corporate pricing, volume terms and invoicing arrangements are as separately agreed.
Account administration
- The Customer nominates administrators who can add and remove Authorised Users, configure settings, view billing, and manage the catalogue.
- Administrators cannot read employees' end-to-end encrypted private chats. No configuration enables this. If an administrator needs to be told this, please tell them.
- The Customer must keep at least two administrators, so account access is not lost.
Payment terms
Unless otherwise agreed: invoices are payable within 30 days; late payment may incur interest at the rate set out in the order form; and we may suspend the account for non-payment after 14 days' notice.
We will not delete already-scheduled, already-paid Tributes for non-payment of unrelated invoices.
Term and termination
- Term as set out in the order form, or month-to-month.
- Either party may terminate for material breach not cured within 30 days of written notice.
- On termination, the Customer may export data for 30 days, after which we delete it under the DPA.
- Scheduled Tributes already paid for will be delivered unless the Customer instructs otherwise before termination.
Confidentiality
Each party will keep the other's confidential information confidential, use it only for the purposes of this agreement, and protect it with at least reasonable care. This survives termination by 3 years, and indefinitely for trade secrets.
Liability
Section 17 of the Terms of Service applies, except that the cap in Section 17.3 is the greater of the fees paid by the Customer in the 12 months preceding the claim, or AED 5,000.
Part B — Data Processing Addendum
This DPA applies where we process personal data on the Customer's behalf. It forms part of the agreement between us.
Roles
| Data | Role |
|---|---|
| Employee and recipient data the Customer uploads | Customer = controller; Let's Horaro = processor |
| Account, billing and usage data | Let's Horaro = controller |
| Security, fraud prevention and service improvement | Let's Horaro = controller |
Where we are processor, we act only on the Customer's documented instructions. Where we are controller, our Privacy Policy applies.
Scope of processing
| Subject matter | Provision of the Let's Horaro platform |
|---|---|
| Duration | The term of the agreement, plus the deletion period in Section 18 |
| Nature and purpose | Storage, scheduled delivery, transmission, manufacture and fulfilment of gifts, notification |
| Types of personal data | Names, mobile numbers, email addresses, photographs, delivery addresses, employment relationship, message content, order and delivery records |
| Categories of data subject | The Customer's employees, contractors, gift recipients, and their nominated recipients |
| Special categories | Not intended. The Customer must not upload special category or sensitive personal data without our prior written agreement. |
Our obligations as processor
We will:
- process personal data only on the Customer's documented instructions, unless required otherwise by law — in which case we will tell the Customer first, unless the law prohibits it;
- ensure personnel with access are bound by confidentiality;
- implement the security measures in Section 16;
- respect the conditions on sub-processors in Section 15;
- assist the Customer, as far as reasonably possible, in responding to data subject requests;
- assist the Customer with data protection impact assessments and regulator consultations;
- notify the Customer without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting the Customer's data;
- delete or return personal data at the end of the agreement, per Section 18;
- make available information reasonably necessary to demonstrate compliance, and allow audits under Section 17;
- immediately inform the Customer if we consider an instruction infringes applicable data protection law.
Customer obligations
The Customer warrants that it:
- has a lawful basis for the personal data it uploads;
- has given required privacy notices to its employees and to recipients;
- has obtained any consents required — particularly for gift recipients who are not employees;
- will not instruct us to do anything unlawful;
- is responsible for the accuracy of data it uploads.
Sub-processors
The Customer gives general authorisation for us to engage sub-processors. Our current list is at letshoraro.com/legal/sub-processors and includes cloud hosting, couriers, payment processors, messaging gateways and AI providers.
We will:
- give 30 days' notice before adding or replacing a sub-processor;
- impose data protection obligations on each sub-processor equivalent to those in this DPA;
- remain fully liable to the Customer for a sub-processor's performance.
If the Customer reasonably objects to a new sub-processor on data protection grounds within the notice period, we will work in good faith to find an alternative. If we cannot, the Customer may terminate the affected service and receive a pro-rata refund.
Security measures
| Area | Measure |
|---|---|
| Encryption in transit | TLS 1.2 or higher |
| Encryption at rest | AES-256 |
| End-to-end encryption | Industry-standard end-to-end encryption with forward secrecy for one-to-one and group chats; keys generated and held on user devices only, never on our servers |
| Access control | Role-based, least privilege, MFA for administrative access |
| Logging | Access and administrative actions logged and retained 12 months |
| Data residency | United Arab Emirates — named on our sub-processor page |
| Backups | Automated, encrypted, with restore testing |
| Personnel | Background checks where lawful, confidentiality undertakings, security training |
| Vulnerability management | Regular scanning and patching; annual penetration testing |
| Incident response | Documented plan with defined escalation |
| Business continuity | Documented plan, tested annually |
We may update these measures provided the level of protection is not reduced.
Audit
The Customer may audit our compliance with this DPA:
- no more than once per 12 months, unless a breach or regulator requires more;
- on 30 days' written notice;
- during business hours, without unreasonable disruption;
- subject to confidentiality;
- at the Customer's cost, unless the audit finds material non-compliance.
We may satisfy an audit request by providing a current third-party certification or audit report (for example ISO 27001 or SOC 2) where that reasonably addresses the Customer's concerns.
Return and deletion
On termination, at the Customer's choice, we will return the personal data in a commonly used format or delete it.
- Export is available for 30 days after termination.
- Deletion follows within 30 days of the export window closing.
- Backups are overwritten within 90 days.
- We may retain data we are legally required to keep, and will tell the Customer what and why.
One exception: where a Tribute has already been delivered to a recipient, the recipient's copy is theirs and is not deleted. The Customer should make this clear to employees before using the Platform — it is a consequence of how the product works and cannot be configured away.
International transfers
Personal data is stored in the UAE. Transfers outside the UAE occur only as described in Section 9 of the Privacy Policy — international delivery, payment processing, and AI features — and are made under appropriate safeguards, including Standard Contractual Clauses where the GDPR applies.
Data subject requests
If we receive a request from one of the Customer's data subjects, we will forward it to the Customer without undue delay and will not respond ourselves, except to acknowledge and redirect, unless the Customer instructs otherwise or the law requires us to respond.
We will assist the Customer in responding, taking into account the nature of the processing.
Precedence
If this DPA conflicts with the Business Account Terms or the Terms of Service on a data protection matter, this DPA prevails.
Contact
Data Protection Officer: dpo@letshoraro.com
Business enquiries: billing@letshoraro.com
Legal notices: legal@letshoraro.com