MyGatePass Master Terms and Conditions

On this page

• 1. Introduction and structure of these Terms
• Part A, Platform Terms
• 2. Eligibility and accounts
• 3. User conduct and permitted use
• 4. Content and intellectual property
• 5. How your information is shared when you visit a site
• 6. Your visit history
• 7. Service availability and changes
• Part B, Client Service Terms
• 8. Definitions
• 9. The Services
• 10. Modules and features under development
• 11. Data protection and the Data Processing Agreement
• 12. Confidentiality
• 13. Intellectual property
• 14. Publicity and customer references
• 15. Term, fees and payment
• 16. Termination
• 17. Indemnification
• 18. Personal data breach notification
• 19. Service levels
• 20. Limitation of liability
• 21. Governing law
• 22. Miscellaneous
• 23. Changes to these Terms
• 24. Acceptance
• 25. Contact

1. Introduction and structure of these Terms

These Master Terms and Conditions ("Terms") are issued by MyGatePass FZ-LLC, a limited liability company registered with the Dubai Development Authority, registration number 104344, with its registered office at in5 Tech, Dubai Internet City, Dubai, United Arab Emirates ("Service Provider", "MyGatePass", "we", "us", "our").

These Terms have two parts, both binding on anyone who accesses or uses MyGatePass solutions:

• Part A, Platform Terms (sections 2 to 7) governs all users of the Visitor App, the GateKeeper App and the Admin Dashboard, including individual Visitors.
• Part B, Client Service Terms (sections 8 to 25) governs the commercial relationship between Service Provider and any organisation that subscribes to the Services (a "Client"). Part B replaces the need for a separately negotiated and countersigned Service Agreement for standard licensing arrangements, as set out in section 24.

If you are a Visitor using the Visitor App only, Part A applies to you. If you are a Client, or an authorised user acting on a Client's behalf, both Part A and Part B apply.

Existing signed agreements. These Terms supersede all prior versions of the MyGatePass Terms and Conditions. Where Service Provider and a Client have already executed a written Service Agreement, that agreement continues to govern on its own terms until the parties agree otherwise in writing, and these Terms apply to it only to the extent it refers to them. Nothing in these Terms varies an agreement a Client has already signed.

Part A, Platform Terms

2. Eligibility and accounts

2.1 Visitor App. You must have reached the age of majority in your country of residence to create a MyGatePass account. MyGatePass accounts are not for children.

2.2 Children. Where an organisation records a visit by, or otherwise processes information about, someone under the age of majority, it does so as controller of that information, under its own policies and its own legal basis, and no MyGatePass account is created for that person. If you believe a child has created a MyGatePass account, contact dpo@mygatepass.com and we will close it and delete the information.

2.3 GateKeeper App and Admin Dashboard. Accessible only to authorised personnel of a Client that has an active subscription to the Services.

2.4 Accounts. Users must register an account to access certain features, must provide accurate and complete information and keep it up to date, and are responsible for the confidentiality of their credentials and for all activity under their account. Notify us immediately of any unauthorised access.

2.5 Roles.

3. User conduct and permitted use

3.1 You agree to use the platforms lawfully, to provide truthful information, and to respect the privacy, security and rights of other users.

3.2 You must not: use the platforms for illegal purposes; harass, threaten or abuse others; tamper with, hack or bypass security measures; upload viruses or malicious code; or impersonate any individual or entity.

3.3 Permitted use. The Visitor App for personal, non-commercial purposes. The GateKeeper App and the Admin Dashboard for internal security and administrative purposes only.

3.4 Violations may result in suspension, termination of access, or legal action where applicable.

4. Content and intellectual property

MyGatePass owns all right, title and interest in the platforms, including all related intellectual property. Users may not copy, modify, distribute, sell or lease any part of the platforms or included software without our written permission.

5. How your information is shared when you visit a site

5.1 MyGatePass is the technology used by the organisations that operate the sites you visit, such as offices, schools and communities. Those organisations decide what information is collected about visitors, why, and how long it is kept. In data protection terms, the organisation is the controller of that information and MyGatePass acts as its processor.

5.2 When you identify yourself at a site, by scanning a QR code, presenting a pass, or any other method the site offers, your information is recorded for the organisation operating that site, for purposes such as access control, recording the time and location of entry and exit, verifying your credentials, and improving your visiting experience.

5.3 Your rights over that information are exercised against the organisation operating the site, because it decides how the information is used. It is responsible for telling you what it collects, why, and on what legal basis. MyGatePass does not obtain consent from you on the organisation's behalf, and nothing in these Terms is to be read as it doing so. If you contact us about information held for a site, we will pass your request to that organisation and support it in responding. See our Privacy Policy.

5.4 Separately, MyGatePass holds your Visitor App account details as controller in its own right, for the purpose of providing you with the app. You can access and delete your MyGatePass account and its data directly in the app at any time. Deleting your account does not delete the visit records held by an organisation for its own site, which are subject to that organisation's retention decisions.

6. Your visit history

6.1 The Visitor App keeps a record of the places you have visited, so that you can see your own history. This is part of how the app works. It is created when you use MyGatePass to enter a site, and it is not something you have to switch on.

6.2 We hold that record as controller in our own right, and it is separate from the organisation's own record of your visit. Yours contains only the site you visited, the date and time, and your own MyGatePass account details.

6.3 It does not contain anything from the organisation's record. No host, no reason for your visit, no permit or contractor details, no vehicle plate, no record of an access decision, no notes about you, and no free text written by anyone at the site. Deleting yours does not affect theirs, and theirs being deleted does not affect yours.

6.4 What we use it for. Today, one thing only: to show you your own history in the app, which is why it exists. We intend to use these records to produce anonymised, aggregated statistics and insights, such as how busy sites are at different times of day, which we may publish or provide to others, and we will update our Privacy Policy before that starts. Those outputs will never identify you, never identify any individual person, and never describe an individual site. We do not sell your personal information, and we will not use an organisation's own records for this at all.

6.5 You can stop that second use, without giving anything up. Once it starts, email privacy@mygatepass.com and we will stop using your history to produce statistics and insights. You do not have to give a reason, and you do not have to delete your profile, your history, or anything else in order to do it. Your history keeps working, and entry to a site is unaffected either way. Stopping it does not change statistics already produced, because those contain no personal information and cannot be traced back to you.

6.6 Deleting it. You can delete your MyGatePass profile at any time in the app, and doing so deletes your visit history with it.

6.7 Limits we hold ourselves to. Only account holders who have reached the age of majority have a visit history, because MyGatePass accounts are for adults. We do not attempt to re-identify anyone from the anonymised outputs, and we do not permit anyone else to. We keep your history until you delete your profile, and in any event no longer than 24 months after each visit. Our Privacy Policy sets out the legal basis and your rights.

6.8 Schools, and why none of this affects a pick-up record. Where a school uses our pick-up and dismissal module, the school's own record of every release is created and kept in the school's own account, as a complete and auditable trail. That record exists for safeguarding and audit, the school is its controller, and nothing in this section changes, limits, shortens or deletes it. This section is about the separate history we hold in our own right, which is a different thing.

6.9 We never use an organisation's own record commercially. We never use the information we hold on behalf of an organisation, being that organisation's own record of who came to its site, to produce statistics or insights or for any other commercial purpose. That applies to every organisation and every module equally, it is not something anyone has to ask for, and it is not something we will offer to vary.

6.10 Your own history is treated the same as everyone else's. The history we keep for you is ours as controller, and we apply the same rules to every account holder, whatever kind of place you visited. We use it as our Privacy Policy describes. The Visitor App carries no advertising today. Where advertising is introduced, we will use the history to group accounts into broad audiences for advertising inside the Visitor App, and our Privacy Policy will say so before it starts. We never group you by, or infer, anything sensitive, meaning health, religion or belief, political opinion, racial or ethnic origin, sex life or sexual orientation, or trade union membership, and we keep any categorisation of places coarse enough that it cannot reveal one. We do not direct advertising at children, and an account is for adults. You will be able to tell us to stop using your information to choose which advertising you see, at any time, and you will not have to delete anything to do it.

7. Service availability and changes

We do not guarantee uninterrupted access to the platforms. Reasonable notice will be given for major changes. Where a Service Level Agreement applies to a Client, availability and support commitments for live Modules are set out in it, as described in section 19.

Part B, Client Service Terms

This Part B applies to every Client that subscribes to the Services, whether the subscription is confirmed by accepting a MyGatePass quotation, by payment of an invoice, or by execution of a separate Service Agreement. Where a separate signed Service Agreement expressly states that it supersedes these Terms, that Service Agreement governs. Otherwise this Part B, together with the Data Processing Agreement incorporated by section 11, is the entire agreement between Service Provider and the Client for the Services.

8. Definitions

9. The Services

9.1 Service Provider provides the following Services:

• Digital visitor management. Registration and management of entries and exits through QR code scanning, identity-document scanning, mobile number, manual invitation, or such other check-in methods as may be made available from time to time.
• Operational record. A real-time digital log of entries and exits.
• Analytics and reporting. Insights on visitor patterns, compliance and resource utilisation, within the Client's own tenant.
• Optional integrations. Service Provider provides APIs enabling Client integration with third-party systems. Service Provider does not itself perform integration work. Additional Modules or integrations may be added under a new Quote or Annex.
• Additional Modules as set out in the applicable Quote, which may include permit and contractor management, gate and access management, automated number-plate recognition, and the school pick-up and dismissal module.

9.2 Service standard. Service Provider shall perform the Services with a high standard of professionalism and competence.

9.3 Hardware exclusion. This Agreement does not include access control hardware or door controller integrations.

9.4 Data protection, residency and security. Service Provider holds ISO/IEC 27001:2022 certification for its information security management system. Personal Data processed on the Client's behalf is stored and processed in Microsoft Azure UAE North, with backup replication to Microsoft Azure UAE Central, both in the United Arab Emirates, on the terms and with the exceptions stated in clause 8 of the DPA. Any requirement for residency in another region is scoped, agreed and priced separately. The technical and organisational measures Service Provider operates are summarised in Annex B of the DPA and set out in full in the Security Measures Description available under that Annex, which states which measures have not yet been independently evidenced and which gaps have not yet been closed. The Client is responsible for its own regulatory compliance obligations as controller, including establishing a lawful basis, issuing privacy information and providing any signage its own law requires.

9.5 Delivery confirmation. Service Provider shall issue written confirmation upon delivery of access to each Module ("Delivery Confirmation"). The Client has five business days from receipt to raise a written objection, limited to whether the Module matches the scope set out in the applicable Quote. Absent a timely objection, the Module is deemed accepted and reaches General Availability on the sixth business day. Delivery Confirmation governs scope acceptance only; it does not delay the Effective Date or any payment obligation.

10. Modules and features under development

10.1 A Module referenced in a Quote or in Service Provider's marketing materials may not yet be built or generally available (a "Beta Module"). Quotes must clearly mark any Beta Module as "under development" or "pending SOW".

10.2 Beta Modules, where made available for early or trial use, are provided on an "as-is" and "as-available" basis and are not covered by the uptime, support or incident response commitments in any applicable SLA.

10.3 Any delivery timeline given for a Beta Module is an estimate only and not a binding commitment. A delay in delivering a Beta Module is not a breach of this Agreement and does not entitle the Client to withhold or delay payment for Modules that have already reached General Availability.

10.4 A Beta Module becomes subject to the full terms of this Agreement and the SLA once Service Provider issues a Delivery Confirmation for it under section 9.5.

10.5 Service Provider may modify, pause or discontinue a Beta Module at its discretion prior to General Availability. If the Client has already been charged Fees specifically for that Beta Module, Service Provider will adjust those Fees on a fair basis reflecting what was actually delivered.

10.6 The obligations in the DPA apply to a Beta Module that processes Personal Data in the same way as to a Module at General Availability. Data protection obligations are not subject to the "as-is" basis in section 10.2.

11. Data protection and the Data Processing Agreement

11.1 Where Service Provider processes Personal Data on the Client's behalf in providing the Services, it does so as processor and the Client acts as controller.

11.2 The MyGatePass Data Processing Agreement, published at mygatepass.com/dpa, forms part of this Agreement and is incorporated into it by reference. By accepting these Terms, or by continuing to use the Services, the Client accepts the version of the DPA in force at that time.

11.3 No signature is required for the DPA to take effect. Where a signed counterpart is required, Service Provider will execute one on request; the signed and unsigned versions contain the same terms. Where the parties have signed a separately negotiated data processing agreement, that agreement applies instead.

11.4 Amendments and version archive. Service Provider may amend the DPA as set out in its clause 1.4. It publishes each version at mygatepass.com/dpa, keeps a dated archive of previous versions at mygatepass.com/dpa-versions, records on the Client's account which version it accepted and when, and will notify the Client's account administrator of every amendment at least 30 days before it takes effect. Where an amendment reduces the protections in the DPA, the Client may object and terminate the affected Services as set out in that clause.

11.5 Subprocessors. The subprocessors Service Provider engages, and the country in which each processes Personal Data, are published at mygatepass.com/subprocessors. Service Provider gives account administrators at least 30 days' notice before adding or replacing a subprocessor, or before one changes the country in which it processes data, and the Client may object on reasonable data-protection grounds.

11.6 Precedence. Where this Agreement conflicts with the DPA in relation to the processing of Personal Data, the DPA prevails, save that sections 20 (limitation of liability) and 21 (governing law) of these Terms give effect to the corresponding provisions of the DPA.

12. Confidentiality

12.1 "Confidential Information" means any non-public information disclosed by either party, in any form, that is marked confidential or that should reasonably be understood to be confidential given its nature and the circumstances of disclosure.

12.2 Both parties agree to keep Confidential Information confidential, not to disclose it to third parties without prior written consent, to use it only to perform this Agreement, and to take reasonable measures to protect it. This does not apply to information that is or becomes public other than through breach, was already known to the receiving party, is received from a third party without breach of confidentiality, or is independently developed.

12.3 Personal Data is not Confidential Information for the purposes of this section; it is governed by the DPA.

13. Intellectual property

13.1 Any proprietary tools, methodologies or materials provided by Service Provider remain Service Provider's property. Deliverables created specifically for a Client outside the standard scope are governed by a separate project agreement defining scope, ownership and cost.

13.2 Service Provider grants the Client a non-exclusive, non-transferable licence to use its proprietary tools and materials solely to receive the Services. The Client may not modify, copy, distribute or otherwise use them for any other purpose without prior written consent.

13.3 The Client retains all right, title and interest in its own data, including Personal Data processed on its behalf. Nothing in this Agreement transfers ownership of that data to Service Provider.

14. Publicity and customer references

14.1 Name and logo. The Client grants Service Provider a non-exclusive, royalty-free licence to use the Client's name and logo to identify the Client as a customer of MyGatePass: in its customer lists, on its website, in sales and marketing materials, in investor and funding materials, and in responses to tenders, proposals and questionnaires. Use is limited to identifying the Client as a customer and will follow any brand guidelines the Client supplies.

14.2 Case studies, quotations and announcements require approval. Anything beyond section 14.1 needs the Client's prior written approval, including a case study, a named testimonial, a quotation attributed to the Client or any of its personnel, a press release, a joint announcement, an award or tender submission that describes the Client's deployment, and any customer story. Service Provider will provide the proposed text for review. Approval of one item is not approval of any other.

14.3 Aggregate figures. Service Provider may publish aggregate figures about its platform, such as the number of sites, visits processed or gates managed, provided that no figure identifies the Client or any individual site.

14.4 What Service Provider will not use, whatever is approved. Regardless of any approval given under this section, Service Provider will not use in any marketing, promotional or investor material:

• any Personal Data, or the image, name, voice or likeness of any individual;
• any information about or image of a student, child, parent or guardian, in any form;
• any Confidential Information;
• any detail of the Client's security configuration, gate layout, staffing, access rules, incident history or vulnerabilities; or
• any content taken from the Client's own records in the platform.

14.5 Withdrawal. The Client may withdraw the licence in section 14.1 at any time on written notice to marketing@mygatepass.com. Service Provider will remove the Client's name and logo from materials within its control within 30 days, and from printed or third-party materials at the next reprint or update. Withdrawal does not require Service Provider to recall material already distributed, and does not affect a case study or announcement the Client has separately approved unless the Client also withdraws that approval.

14.6 The Client's use of Service Provider's marks. The Client may state that it uses MyGatePass, and use Service Provider's name and logo for that purpose, on equivalent terms.

15. Term, fees and payment

15.1 Term. This Agreement commences on the Effective Date and continues for the initial term stated in the Quote, or if none is stated, one year, renewing automatically for successive one-year periods unless terminated in accordance with section 16.

15.2 Fees. The Client pays the Fees set out in the applicable Quote, in the currency and on the schedule stated in it. Where the Quote states no schedule, Fees for the initial term are invoiced on the Effective Date and Fees for each renewal term are invoiced on the renewal date.

15.3 Payment. Invoices are payable within thirty days of the invoice date, without set-off or deduction.

15.4 Taxes. Fees are exclusive of value added tax and of any other tax or duty, which the Client pays in addition at the rate in force where it is properly chargeable. Each party is responsible for its own income and corporate taxes.

15.5 Late payment and suspension. Service Provider may charge interest on any overdue amount at one per cent per month from the due date until payment. Where an invoice remains unpaid more than thirty days after its due date, Service Provider may suspend the Services on fifteen days' written notice to the Client, which it will not do where the amount is the subject of a good-faith dispute the Client has raised in writing before the due date. Suspension does not affect the safe release of a student, and the manual fallback procedure in clause S1.6 of the DPA applies throughout any suspension.

15.6 Fee changes on renewal. Service Provider may change the Fees for a renewal term on at least sixty days' written notice before the renewal date. Where the Client does not accept the change it may terminate with effect from the end of the then-current term by written notice before the renewal date.

16. Termination

16.1 Termination for cause. Either party may terminate if the other breaches a material term and fails to cure within fifteen days of written notice, or becomes insolvent, is declared bankrupt, or is otherwise unable to meet its financial obligations. A breach of the DPA is deemed material.

16.2 Termination for convenience. This Agreement is not terminable for convenience during the initial term. After the initial term, either party may terminate for convenience on thirty days' written notice.

16.3 No refunds on convenience termination. Termination for convenience does not entitle the Client to any refund, credit or reimbursement of Fees paid or payable, and the Client retains access to the Services until the end of the paid subscription term. This section does not apply to a termination under clause 1.4, 7.3 or 8.2 of the DPA, where the pro-rata refund provided by the DPA applies and prevails.

16.4 Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, including acts of God, war, terrorism, civil unrest, embargoes, strikes, pandemics and government action. The affected party must give prompt notice and use reasonable efforts to mitigate. If the event continues beyond thirty consecutive days, either party may terminate on written notice.

16.5 Effect of termination. The Client shall pay for Services rendered and pre-approved expenses incurred up to the termination date, and each party shall return or destroy the other's Confidential Information. Return and deletion of Personal Data is governed by clause 10 of the DPA, which provides a 30-day read-only export window opening automatically, assisted export at no additional charge, deletion from production within 30 days of the end of that window, and a certificate of deletion. Additional work requested beyond standard scope is subject to additional fees.

17. Indemnification

17.1 Service Provider indemnity. Service Provider will indemnify and hold harmless the Client, its affiliates and their respective officers, directors, employees and agents from claims, damages, liabilities or expenses, including reasonable legal fees, arising from Service Provider's breach of this Agreement or its gross negligence or wilful misconduct in performing the Services.

17.2 Client indemnity. The Client will indemnify and hold harmless Service Provider, its affiliates and their respective officers, directors, employees and agents from claims, damages, liabilities or expenses, including reasonable legal fees, arising from the Client's breach of this Agreement or its gross negligence or wilful misconduct.

17.3 These indemnities are symmetrical. Neither party's indemnity may be narrowed, including as to affiliates, officers, directors, employees or agents, without an equivalent change to the other.

18. Personal data breach notification

18.1 Service Provider will notify the Client of a personal data breach affecting the Client's Personal Data without undue delay after becoming aware of it, and in any event within 72 hours. "Without undue delay" is the operative obligation; the 72-hour period is an outer limit and not a permitted period of delay.

18.2 Awareness means the point at which Service Provider has a reasonable degree of certainty that a security incident involving the Client's Personal Data has occurred. It is not conditional on Service Provider having completed its investigation or classified the incident.

18.3 The content of the notification, the initial-notification obligation, the assistance Service Provider provides, and the position on notifying regulators and data subjects are set out in clause 6 of the DPA, which prevails over this section.

18.4 Service Provider's liability for a personal data breach is subject to the cap in section 20.

19. Service levels

19.1 Where Service Provider has published a MyGatePass Service Level Agreement ("SLA"), or has provided one to the Client, that SLA is incorporated into this Agreement by reference and sets out platform uptime, support hours and channels, incident severity and response and resolution targets, maintenance windows, and data retention for Modules that have reached General Availability. Service Provider will give the Client at least 30 days' notice before any change that materially reduces it.

19.2 Until an SLA applies to the Client, service availability is as stated in section 7 and Service Provider gives no uptime, response-time or resolution commitment beyond it. Beta Modules are excluded from any SLA, under section 10.2.

19.3 Conflicts. In the event of conflict between these Terms and an applicable SLA on a matter of service performance, the SLA prevails; on a matter of legal terms, these Terms prevail; and on a matter concerning the processing of Personal Data, the DPA prevails over both.

20. Limitation of liability

20.1 Neither party is liable to the other for indirect, incidental, special or consequential damages arising out of or in connection with this Agreement, even if advised of the possibility of such damages.

20.2 Service Provider's total aggregate liability for any claim arising out of or in connection with this Agreement, including personal data breaches, shall not exceed the total Fees paid or payable by the Client under the applicable Quote in the twelve months preceding the claim.

20.3 Nothing in this Agreement excludes or limits liability that cannot be excluded or limited under applicable law, including liability for death or personal injury caused by negligence, or for fraud or fraudulent misrepresentation.

20.4 The limitations in this section apply to liability under the DPA, as provided in its clause 11.4.

21. Governing law

This Agreement is governed by the laws of the United Arab Emirates. The courts of Dubai have exclusive jurisdiction over any dispute arising out of or in connection with this Agreement, and each party waives any objection to that venue. Where the transfer clauses in Annex F of the DPA apply, the governing law and forum stated in that Annex apply to those clauses.

22. Miscellaneous

• Entire agreement. These Terms, the applicable Quote, the DPA, and any Annex or applicable SLA constitute the entire agreement and supersede all prior understandings on the same subject.
• Amendments. Service Provider may update these Terms as set out in section 23. Client-specific commercial terms in a Quote may only be amended in writing signed or accepted by both parties.
• Severability. If any provision is held invalid or unenforceable, the remaining provisions remain in full force.
• Waiver. No waiver of any term is a continuing waiver or a waiver of any other term.
• Assignment. Neither party may assign its rights or obligations without the other's prior written consent, save that either party may assign to a successor in connection with a merger, acquisition or sale of substantially all of its assets, on notice.
• Notices. Notices must be in writing and delivered by hand or email to the addresses on file. Notices concerning Personal Data are given as provided in clause 11.7 of the DPA.
• Relationship of the parties. Nothing here creates a partnership, joint venture or agency relationship. Service Provider is an independent contractor.

23. Changes to these Terms

Service Provider may update these Terms from time to time and will publish the revised version on this page with an updated date.

Where a change materially affects a party's rights or obligations, Service Provider will give at least 30 days' notice before it takes effect: to Clients, by notifying the account administrator; to Visitor App users, in the app or by email. Continued use of the platforms or the Services after a change takes effect constitutes acceptance of the revised Terms. A Client that does not accept a material change may terminate the affected Services under section 16 before the change takes effect.

Amendments to the DPA are governed by its clause 1.4 and its version archive, rather than by this section.

24. Acceptance

24.1 These Terms apply without the need for a separately countersigned Service Agreement. A Client is bound by these Terms, including Part B, the DPA incorporated by section 11, and any SLA that applies under section 19, upon whichever of the following occurs first: (a) acceptance of a MyGatePass Quote that references these Terms; (b) payment of an invoice referencing these Terms; or (c) access to or use of the Services.

24.2 These Terms apply uniformly to all Clients, regardless of size or sector, unless Service Provider and the Client have separately executed a written Service Agreement that expressly states it supersedes these Terms.

24.3 Service Provider records on each Client's account the version of these Terms and of the DPA that the Client accepted, and the date of acceptance, and will provide a copy on request.

24.4 By using our website, applications or Services, you acknowledge that you have read, understood and agree to these Terms, including the Data Processing Agreement where it applies to you and our Privacy Policy.

25. Contact