Brand Terms & Conditions

1. Definitions

"Content" or "UGC" means any video, audio, image, caption, voice-over, or other creative material produced by a Creator and delivered to a Brand through the Platform.
"Creator" means any individual accepted onto the Platform to produce Content for Brands.
"Project" means a campaign request the Brand posts on the Platform, with one or more Creator slots, described in a Brief.
"Project Order" means the order placed and paid at checkout for the accepted Creators of a Project (Section 4.3), or a written Managed Campaign quotation accepted by the Brand (Section 4.6), together with the content type (Dark UGC or Spark UGC) and the rights details recorded for it on the Platform or in the quotation.
"Package" means any legacy paid service tier or custom quotation agreed before the marketplace model described in Section 4; references to a Package apply to the corresponding Project Order.
"Brief" means the creative, technical, and commercial instructions the Brand submits to the Platform for a Project.
"Spark Code" (also referred to as a TikTok Spark Ads Authorization Code or equivalent feature on other platforms) means the authorization token granted by a Creator from their own social media account enabling the Brand to promote an organic post as a paid advertisement. A Spark Code is a technical authorisation only (Section 7.8).
"Dark UGC" and "Spark UGC" have the meanings given in Section 7.1.
"Assignment" means the transfer to the Brand of the transferable intellectual-property rights in delivered Dark UGC under Section 7.2.
"Spark Licence Period" means the period during which the Brand may run a Creator's post as Spark Ads under Section 7.3: thirty (30) days from the day the Creator provides the Spark Code, unless a longer period agreed with the Creator is recorded on the Project Order. For Project Orders under earlier versions, references there to the "Licence Term" or "Usage Term" keep the meaning given in that version (Section 7.10).
"Account Owner" means the user designated in the Brand account as authorised to bind the Brand (initially the user who created the account).
"Creator Personal Data", "Data Protection Law" and "Personal Data Breach" have the meanings given in Section 18.

2. Overview of services

MabrookUGC is a technology platform that connects Brands with vetted Creators in the GCC and wider MENA region for the production of User-Generated Content optimized for social platforms (including but not limited to TikTok, Snapchat, Meta, YouTube, and X).

MabrookUGC is a facilitator only. We are not a talent agency, advertising agency, production company, employer of Creators, or a party to any employment relationship with Creators. Creators are independent contractors. MabrookUGC does not produce Content directly; we contract with Creators who do so.

Brands can (a) post Projects (Briefs) free of charge, (b) invite pre-vetted Creators or receive their applications, each carrying the Creator's own price per video, (c) accept Creators and, once every slot of the Project is filled, place a Project Order and pay for it, (d) receive delivered Content, and (e) request revisions within the scope defined in Section 6. Our team may also run Managed Campaigns for a Brand at a price agreed in writing (Section 4.6).

3. Account, eligibility & security

Brand accounts are available only to legal entities or individuals acting in a B2B capacity for lawful commercial purposes.
You must provide accurate, current, and complete information at registration and keep it updated. We may suspend or terminate accounts with false or misleading information.
You are solely responsible for safeguarding your login credentials and for all activity under your account. You must notify us immediately at support@mabrookugc.com of any unauthorized access.
An agency using the Platform for a client must name the client (the advertiser) in its account or Brief and confirms that it is authorised to act for that client and to bind it to these Brand Terms, or that it contracts in its own name and is responsible for its client's compliance with them.
We reserve the right to refuse, suspend, or terminate any Brand account at our sole discretion, including where we reasonably believe the Brand operates in a Restricted Category (Section 9) or poses a reputational, legal, or financial risk to the Platform or its Creators.

4. Prices, service fee & payment

4.1 Creator prices. Each Creator sets their own price per video (minimum SAR 100). The price shown on a Creator's profile, application or invite response is the price you accept; it is fixed for that Project the moment you accept the Creator. Creator prices are amounts owed to the Creator for their Content. MabrookUGC collects them from you on the Creator's behalf and pays the Creator in full after you approve the Content (or after the review window in Section 6 has passed).
4.2 Service fee. MabrookUGC charges a platform service fee of 15 % of the accepted Creator prices on each Project Order. The service fee is MabrookUGC's remuneration for the Platform, Creator vetting, briefing and review tools, payment handling and support.
4.3 Project Order and payment. A Project Order is placed when every slot of a Project is filled with an accepted Creator and you start the Project at checkout. The Project Order total is the sum of the accepted Creator prices plus the service fee and applicable VAT. It is payable in full, in advance, by card (or by bank transfer where we have agreed this in writing). No Creator is asked to film before cleared funds are received.
4.4 Currency and VAT. Prices are in Saudi Riyal (SAR) unless stated otherwise. VAT is applied as required by UAE VAT law, and any other law that applies, to the actual supply made to you. Each invoice states the VAT treatment applied and the reason for it (for example zero-rating as an export of services where the legal conditions for it are met). You must give us the information and evidence we reasonably need to determine the correct treatment, such as your place of establishment and your tax registration details, and tell us promptly if they change. If a VAT treatment turns out to be incorrect, the VAT due is payable by you, or refunded or credited to you, as the law requires.
4.5 Refunds and changes. Once a Project Order is paid, the accepted Creators are committed and start filming. The Order is non-refundable, except where a Creator fails to deliver, in which case MabrookUGC will, at its option, replace the Creator or refund that Creator's price together with the service fee charged on it. Creators added to a Project after payment are paid for through a further Project Order.
4.6 Managed Campaigns. Campaigns run by MabrookUGC's team for a Brand (including Spark UGC campaigns posted from the Creator's own profile) are priced per campaign in a written quotation, invoiced in advance and non-refundable once production has started; payouts to Creators on such campaigns are set by MabrookUGC.
Payments are processed by third-party payment processors (e.g. Stripe or equivalent). By paying, you accept the processor's own terms. We are not liable for the acts, omissions, or fees of third-party processors.
Without prejudice to lawful payment disputes and to remedies under mandatory law, chargebacks, payment reversals, or payment disputes filed without first contacting us in good faith are a material breach of these Brand Terms. We reserve the right to suspend services and block the account in line with Section 14.1, retain the Content and rights under the disputed Project Order, and recover all costs (including legal fees, bank fees, and administrative charges) from you. Subject to Section 14.5, your rights under other Project Orders you have paid for that are not affected by the dispute remain unaffected.
Late payments on invoiced (non-card) orders accrue interest at 1.5% per month or the maximum rate permitted by UAE law, whichever is lower.

5. Brand responsibilities & Briefs

By submitting a Brief, you warrant and represent that:

The Brief is complete, accurate, and submitted in good faith, including any mandatory disclosures (e.g. health claims, regulated product categories).
You own or are duly licensed to use all brand assets you provide (logos, scripts, product names, trademarks, imagery, music, testimonials).
Your product, service, and any claims made in the Brief comply with all applicable UAE, GCC, and destination-market laws (including but not limited to advertising standards, consumer protection, health, financial services, gambling, and telecommunications laws), and you meet the advertising obligations in Section 9.2.
You will not instruct Creators to make false, misleading, defamatory, deceptive, or legally non-compliant statements.
No minors. No identifiable person under 18 years of age may appear in Content, including in the background, and a Brief must not ask for this. This applies until MabrookUGC publishes a separate release process for minors. Content showing an identifiable minor is not a conforming delivery and must not be used.
You will not ask a Creator to film other identifiable people (co-performers, customers, bystanders) unless the Brief says so and the Creator confirms those people have agreed to appear.
You will provide any necessary product samples, accesses, or materials within the time window required by the Project. Delays caused by you do not entitle you to refunds and may extend the delivery timeline on a day-for-day basis.

Working with Creators outside the Platform. You will not commission work from a Creator introduced to you through the Platform outside the Platform, or bypass the Platform's payment flow for such work. This is a commercial rule. It does not prevent contact that is strictly needed to deliver products, run advertising under Section 7 or handle a legal claim (Section 18.2).

You indemnify MabrookUGC and its Creators for any claim arising out of inaccurate, unlawful, or infringing Brief content, in accordance with Section 13.

6. Delivery, acceptance & revisions

Estimated delivery windows for each Project are indicative only. Delivery times vary based on Creator availability, Brief complexity, Brand responsiveness, and third-party factors.
Content is deemed delivered when it is uploaded to the Brand dashboard, emailed to the Brand, or otherwise made available via the Platform.
The Brand must review each deliverable and submit any revision request within two (2) calendar days of delivery (including delivery of a revised version). Failure to respond within this window constitutes final acceptance, and no further revisions or refunds will be available.
The Brand may request up to two (2) revisions per video, re-editing the existing footage, unless the Project Order says otherwise. A "revision" means editing or re-cutting existing footage (adjusting text overlays, trimming, reordering scenes, changing music bed from our approved library). A revision does not include: re-shooting footage, replacing the Creator, changing the product, changing the core concept, or correcting Brand-supplied errors in the original Brief.
Re-shoots, Creator changes, and out-of-scope changes are billed at a separate rate agreed in writing before work begins.
Content that deviates materially from the approved Brief will be revised free of charge, provided the deviation is clearly identified and substantiated within the two (2) calendar day window.

7. Content rights & Spark Codes

7.1 Two types of Content and who owns it

The rights in Content depend on the type of Project recorded on the Project Order:

Dark UGC: the Creator only delivers the video to the Brand; it is not posted on the Creator's profile, and the Brand runs it from its own ad accounts. Once the Project Order is paid in full, the rights in the delivered video pass to the Brand by Assignment (Section 7.2).
Spark UGC: the Creator posts the video on the Creator's own TikTok profile and gives the Brand a Spark Code. The Creator keeps the copyright, and the Brand receives a licence to run the post as Spark Ads for the Spark Licence Period (Section 7.3).

MabrookUGC does not acquire ownership of Content in either case; its own licence is set out in Section 7.11.

7.2 Dark UGC — assignment on full payment

Once the Project Order is paid in full, the Creator assigns to the Brand, for each item of Dark UGC delivered under it, all transferable intellectual-property rights in the delivered video, including the copyright and related economic rights (such as the rights of reproduction, publication, distribution, communication to the public, adaptation, translation and editing), worldwide, without time limit (for the full term of protection), for all media and channels, including the right to edit and adapt the video, to sub-license and transfer it, and to use it in any advertising. The Assignment is made by the Creator under the Creator Terms and made available through the Platform; MabrookUGC records it on the Project Order.

Name, image and voice. Under the Creator Terms, the Creator irrevocably consents to the Brand using, without time limit, the Creator's name, image and voice as they appear in the video, in connection with that video (including edited versions of it and ads made from it). This consent does not extend to use of the Creator's likeness apart from the video, or to synthetic versions of it (Section 7.6).

Reserved platform licence. The Assignment is subject to MabrookUGC's licence under Section 7.11, which the Creator grants before the Assignment. The Brand acquires the rights subject to that licence and agrees to it.

Before full payment. Until the Project Order is paid in full, no rights in the Content pass to the Brand, and the Brand may not use the Content except to review it under Section 6. If a payment is reversed or charged back and not made good, the Brand must stop using the Content, and, to the extent the law allows, the Assignment is treated as not having taken effect.

7.3 Spark UGC — 30-day Spark licence

For Spark UGC the Creator keeps the copyright and all other rights in the Content. Once the Project Order is paid in full and the Creator has provided the Spark Code, the Brand receives a non-exclusive, non-transferable licence to run the Creator's post as Spark Ads through the Spark Code, on TikTok or the equivalent feature of the platform named in the Brief, for thirty (30) days from the day the Creator provides the Spark Code (the Spark Licence Period), unless a longer period agreed with the Creator is recorded on the Project Order and priced separately. The licence includes the Creator's name, image, voice and handle as they appear in the post. The Brand may have an appointed advertising agency or media buyer run the Spark Ads on its behalf. The licence is granted by the Creator under the Creator Terms and made available through the Platform; MabrookUGC records on the Project Order the day the Spark Code was provided and any longer period agreed.

7.4 When the Spark Licence Period ends

At the end of the Spark Licence Period the Brand must stop running the Spark Ads using the Creator's post and must not use the post or the video in any other way, unless a further use has been recorded under Section 7.5. The Brand may not download or re-upload a Spark video unless this has been separately agreed under Section 7.5. Any copies of Spark UGC the Brand received through the Platform (for example for review) must be deleted no later than thirty (30) days after the Spark Licence Period ends, except copies it must keep by law or under a documented legal hold (Section 18.4). The Creator's own post remains the Creator's.

7.5 Longer periods and other uses of Spark UGC

A longer Spark Licence Period, any other use of a Spark video (for example on the Brand's own organic social media accounts, as a Dark ad from the Brand's own ad accounts, on its website, or by downloading or re-uploading it) and any exclusivity are available only where priced separately, agreed by the Creator and recorded in writing on the Platform or in a written quotation. Until so recorded, they are not granted. Unless that record expressly states that the Creator assigns the rights, it is a licence and the copyright stays with the Creator. No licence or extension arises from silence, from continued use, or from payment for a different order.

7.6 Restrictions

The Brand may not: (a) for Spark UGC, resell, sub-license or transfer the Content or the Spark licence, except (i) to an appointed advertising agency or media buyer acting solely on the Brand's behalf and bound by these restrictions, and (ii) to the advertising platform to the extent needed to run the Spark Ads, with no broader onward use; (b) for Spark UGC, use the Content, or the Creator's name, image or voice, outside the Spark licence or after the Spark Licence Period ends, unless a further use has been recorded under Section 7.5; (c) for either type, use the Content in a way that is defamatory, pornographic, discriminatory, unlawful, offensive or otherwise damaging to the Creator's reputation, or that distorts the Creator's likeness; (d) register any trademark or other right in the Creator's name or likeness or, for Spark UGC, in the Content; (e) for either type, use the Content, or the Creator's face, body or voice, for AI training, fine-tuning, dataset generation, or to create a synthetic likeness or voice or a "deepfake", without the Creator's prior written permission (Sections 12.4 and 18.2); or (f) use the Content to imply that the Creator endorses a product not shown in the Content, an employment relationship, or an exclusive partnership, unless separately contracted.

7.7 Moral rights and the Creator's likeness

The Creator's moral (author) rights under UAE Federal Decree-Law No. 38 of 2021 on Copyright and Neighbouring Rights, and under any other law that applies, that cannot be waived or transferred stay with the Creator and are not part of the Assignment. Under the Creator Terms, the Creator consents to the edits the Brand reasonably makes to Dark UGC: trimming, cutting, reordering and re-editing; resizing and reformatting; adding or changing captions, subtitles, translations, text overlays, logos, calls to action and product shots; adding music the Brand has cleared; combining the Content with other footage of the Brand; and ordinary colour and sound correction. Spark Ads run the Creator's post as posted, with the features the platform provides. Without the Creator's written consent, the Brand must not make changes that distort the meaning of the Content, attribute to the Creator statements they did not make, alter the Creator's face, body or voice (including by AI tools), or place the Content in a context that harms the Creator's honour or reputation.

The Creator consents to the Content being used without attribution where it is customary in advertising to omit it: paid ads and the Brand's posts need not name the Creator unless the Project Order says so. This does not affect a platform showing the Creator's handle (for example with Spark Ads), a legally required disclosure, or any right to be identified as author that cannot be waived under mandatory law. The Creator's name and likeness may only be used together with the Content itself.

7.8 TikTok Spark Codes and equivalent features

Technical authorisation only. A Spark Code is a technical authorisation provided through a third-party platform, generated from the Creator's own account. Its duration is set in the platform and is not the licence. The Spark Licence Period governs: the Creator issues a Spark Code whose duration covers at least the Spark Licence Period, and a Spark Code that remains technically active after the Spark Licence Period does not extend the licence.
Technical control. The Creator keeps control of their account, and the platform controls the availability and behaviour of the feature, which may change without notice. MabrookUGC cannot guarantee that a Spark Code will remain technically active.
Contractual commitment and permitted withdrawal. Under the Creator Terms, the Creator agrees to keep the post live and the Spark Code active for the Spark Licence Period, and not to revoke or stop the Spark Code, delete the post or make it private during that period. The Creator may withdraw or stop a Spark authorisation without breach only if: (a) the platform bans or restricts the post or the Creator's account for reasons not caused by the Creator; (b) the Brand has not paid, or uses the Content outside the licence or otherwise in breach of these Brand Terms; (c) removal is required by law, by an order of a court, regulator or other authority, or by a valid takedown request based on a third party's rights ("legal takedown"); or (d) there is a serious threat to the Creator's safety, in which case no strike is recorded against the Creator and the Creator's payout for that Order is reduced pro rata for the remaining days of the Spark Licence Period. Any other withdrawal during the Spark Licence Period is a breach by the Creator, with pro-rata consequences limited to that Order.
Process. If a Spark Code stops working before the Spark Licence Period ends, tell us through the Platform. We will contact the Creator within two (2) business days and ask for reinstatement or a new Spark Code. In the case of a legal takedown, the Brand must stop using the affected Content in all channels promptly after we notify it.
Pro-rata remedy. If a Spark Code stops working before the Spark Licence Period ends for a reason within (a), (c) or (d) above, or because of a withdrawal that is a breach by the Creator, and it is not restored within five (5) business days, MabrookUGC will credit the Brand with the unused share of the affected Creator's price and of the service fee charged on it, calculated on a straight-line daily basis over the Spark Licence Period. In case (d), and where the withdrawal is a breach by the Creator, the Brand may choose a refund of that amount instead of a credit. No credit or refund is due in case (b), or for any period in which the Brand continues to use the Content under a further use recorded under Section 7.5.
Campaign monitoring. The Brand is responsible for monitoring its ad campaigns and pausing paid media that relies on a Spark Code that no longer works. Except for the remedy above and liability that cannot be limited by law, MabrookUGC is not liable for ad-platform fees, wasted ad spend, agency fees or lost revenue caused by the withdrawal, expiry or malfunction of a Spark Code.

7.9 Dark UGC — Brand-owned ad account

For Dark UGC Projects no Spark Code is issued and the Creator does not post the video. The Brand receives the delivered video and, once the Project Order is paid in full, may run it as a Dark ad from its own ad accounts and use it in any other way within the Assignment in Section 7.2, subject to Sections 7.6, 7.7 and 7.11.

7.10 Orders placed under earlier versions

Content delivered under a Project Order paid or started before this version took effect for the Brand's account stays under the rights and licence terms of the version accepted for that order (including any fixed-term licence, its channels and territories, and its rules on the end of the licence), unless the Brand and the Creator expressly agree otherwise (Section 16.3).

7.11 MabrookUGC's promotion of the platform

Under the Creator Terms, each Creator grants MabrookUGC a non-exclusive, worldwide, royalty-free, perpetual and irrevocable licence to use, reproduce, edit (for example cut, subtitle, resize or excerpt), publish and display Content delivered through the Platform — including the Creator's name, image and voice as they appear in it — on MabrookUGC's own website, social media accounts, sales materials and advertising of the MabrookUGC platform (including paid ads promoting MabrookUGC). This licence applies to both Dark UGC and Spark UGC. For Dark UGC it is reserved from the Assignment: the Brand acquires the rights in the Content subject to it. The Brand agrees that MabrookUGC may show delivered Content in this way, including the Brand's products, brand names and logos as they appear in it, and grants MabrookUGC the permission needed for this. MabrookUGC does not sell or license the Content to third parties under this right, and the Brand's rights under this Section 7 are not otherwise affected. MabrookUGC will not use Content before the Brand's campaign using it is public unless the Brand agrees. The Brand may ask in writing, at support@mabrookugc.com, for use to be delayed for a reasonable period, for example for a confidential launch; we will then not use the Content before the date agreed with the Brand. MabrookUGC removes Content from its own channels on a lawful takedown request or where a safety or legal reason applies. For Content delivered under Project Orders that stay under an earlier version of these Brand Terms, the rules of that version on MabrookUGC's own use continue to apply. Use in line with this Section 7.11 is not a breach of Section 8.

8. Confidentiality

Each party agrees to treat as confidential any non-public information designated as confidential or that a reasonable person would treat as confidential (including Briefs, product roadmaps, pricing, and Creator lists). Confidentiality obligations survive termination for three (3) years. Confidential information does not include information that is (a) publicly available through no breach, (b) independently developed, (c) received from a third party without restriction, or (d) required to be disclosed by law. Personal data is additionally protected by Section 18, which is not limited to three years. The Brand agrees that MabrookUGC may show delivered Content, including the Brand's products and brand as they appear in it, as described in Section 7.11; this is not a breach of this Section.

9. Restricted categories & advertising compliance

9.1 Restricted and prohibited categories

We reserve the right, at our sole discretion, to refuse or terminate any order that involves or promotes:

Illegal goods or services under UAE, GCC, or destination-market law.
Adult content, pornography, escort services, or sexually suggestive products.
Gambling, betting, or games of chance (unless licensed in all target markets and pre-approved by us in writing).
Tobacco, vapes, e-cigarettes, cannabis, recreational drugs, or drug paraphernalia.
Weapons, ammunition, or tactical equipment.
Unregulated financial services, cryptocurrency investment schemes, "get rich quick" offers, MLM / pyramid schemes, or binary options.
Prescription pharmaceuticals, fake medication, unregistered supplements, or unapproved medical claims.
Political campaigns, religious proselytizing, or content that could reasonably be considered offensive to UAE cultural, religious, or legal standards.
Competitor platforms to MabrookUGC in the MENA UGC marketplace category.

If an order is found to fall in a Restricted Category after payment, we may cancel the order and refund the fees paid for Content not yet delivered less a 15% administrative fee, or offer a credit of equivalent value for another Project.

9.2 Advertising compliance

Disclosures. As the advertiser, the Brand is responsible for making sure that every ad and sponsored post using the Content carries the disclosures required by law and by the platform (for example an "ad", "paid partnership" or equivalent label), including under the rules of the UAE Media Council and the Saudi General Authority for Media Regulation where they apply.
A Brief never overrides a legal disclosure. No Brief or instruction authorises a Creator to omit or hide a legally required disclosure. Any such instruction has no effect, the Creator may add the required disclosure, and MabrookUGC may refuse or pause the Project.
Claims. The Brand must be able to substantiate every factual, health, performance, price or comparative claim it asks a Creator to make, and must provide the evidence to us on request.
Regulated categories. For regulated products and services (for example health, cosmetics, food supplements, medical devices, financial services, real estate and education), the Brand is responsible for obtaining any approval, permit or pre-clearance required before the Content is published, and for any content restrictions that apply.
Creators' advertising permits. No permit is required for a Creator to sign up. A Creator needs a permit only for Spark projects, where the Creator posts the video on their own TikTok profile: Creators resident in the UAE need a valid UAE Media Council Advertiser Permit, and Creators resident in Saudi Arabia a valid Mawthooq licence. For Dark projects, where the video is delivered to the Brand and run from the Brand's own ad account, no permit is required from the Creator. Permits are self-declared by the Creator; MabrookUGC does not verify them, and the Creator is legally responsible for their accuracy and validity. The Platform shows the Brand only "permit on file (self-declared)". This status is not a guarantee that a permit is valid or covers a particular campaign, and it does not mean that a campaign is exempt from any legal requirement. The Brand remains responsible for deciding which permits, approvals and disclosures its campaign needs, including for ads run from the Brand's own accounts.

10. Intellectual property of the Platform

The Platform, including all software, UI, Brief templates, training materials, Creator scoring systems, analytics, trademarks ("MabrookUGC", logos, taglines), and compilations of data, is and remains the exclusive property of VM MEDIA LLC. No rights are granted to Brands beyond the limited right to use the Platform as intended. Reverse-engineering, scraping, automated querying, resale of Platform access, or creation of derivative marketplaces from Platform data is strictly prohibited.

11. Warranties & disclaimers

MabrookUGC warrants that it will provide the Platform with reasonable skill and care and that delivered Content will substantially conform to the approved Brief (subject to the revision process in Section 6).

EXCEPT AS EXPRESSLY STATED, THE PLATFORM AND ALL CONTENT ARE PROVIDED "AS IS" AND "AS AVAILABLE". TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE DISCLAIM ALL OTHER WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, UNINTERRUPTED OR ERROR-FREE OPERATION, CAMPAIGN PERFORMANCE, ROI, CLICK-THROUGH-RATE, CONVERSION, OR ANY COMMERCIAL OUTCOME.

We do not warrant that Content will be approved by any third-party advertising platform (TikTok, Meta, Snapchat, YouTube, etc.) or that it will pass any third-party algorithmic review.

12. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW:

12.1 Excluded losses. Subject to Section 12.5, neither party shall be liable for indirect, incidental, special, consequential, exemplary, or punitive damages, including lost profits, lost revenue, lost goodwill, lost data, lost ad-spend, or business interruption, even if advised of the possibility.
12.2 MabrookUGC's cap. The total aggregate liability of MabrookUGC and its affiliates, officers, employees, and Creators, arising out of or relating to these Brand Terms, whether in contract, tort, statute, or otherwise, shall not exceed the total fees actually paid by the Brand to MabrookUGC for the specific order giving rise to the claim in the three (3) months immediately preceding the event giving rise to liability.
12.3 Brand's cap for data protection. The Brand's total aggregate liability for breaches of Section 18 and under the data-protection indemnity in Section 13.2 is limited to the greater of (a) SAR 100,000 and (b) the total fees paid by the Brand to MabrookUGC in the twelve (12) months before the claim is first notified.
12.4 No cap for serious misuse. The cap in Section 12.3 does not apply to liability arising from: (a) wilful or knowing misuse of Creator Personal Data; (b) selling, renting or licensing Creator Personal Data or lists of Creators; (c) creating a synthetic likeness, voice clone or "deepfake" of a Creator, or using a Creator's likeness or voice to train or fine-tune an AI model, without the Creator's prior written permission; or (d) fraud.
12.5 Data-protection losses treated as direct. Section 12.1 does not exclude or reduce, within the limits of Sections 12.3 and 12.4: amounts payable under Section 13 in respect of claims by third parties (including Creators); regulatory fines and penalties to the extent lawfully recoverable; and reasonable costs of investigating, containing and notifying a Personal Data Breach.
12.6 Mandatory liability. Nothing in these Brand Terms limits liability that cannot be limited by law (e.g. fraud, death or personal injury caused by negligence, gross negligence, or wilful misconduct).

13. Indemnification

13.1 General indemnity. The Brand agrees to defend, indemnify, and hold harmless MabrookUGC, VM MEDIA LLC, its officers, directors, employees, contractors, and Creators against claims, damages, liabilities, losses, fines, costs, and expenses (including reasonable legal fees) arising out of or in connection with:

The Brand's Brief, product, service, or any claim made about them.
The Brand's use of the Content beyond the rights granted in Section 7, or in breach of Sections 7.6 and 7.7.
Any breach of these Brand Terms by the Brand.
Any third-party claim that the Brand's materials, instructions, or products infringe rights or violate law.
Any regulatory fine or action in any jurisdiction arising from the Brand's product, service, or advertising claims.

13.2 Data-protection indemnity. The Brand indemnifies MabrookUGC and the affected Creators against losses caused by a breach of Section 18 by the Brand, its team members, agencies or service providers, subject to Sections 12.3 to 12.5.

13.3 Conditions for every indemnity in this Section.

(a) The indemnity covers proven loss and reasonable costs (including reasonable legal fees) only to the extent caused by the Brand's breach, act or omission.
(b) Fines and penalties are covered only to the extent the law allows them to be recovered from another party.
(c) The indemnified party must take reasonable steps to mitigate its loss.
(d) The indemnified party must notify the Brand of a claim promptly in writing; a delay reduces the indemnity only to the extent the Brand is prejudiced by it.
(e) The Brand may control the defence and settlement of a third-party claim with counsel reasonably acceptable to the indemnified party, who will cooperate at the Brand's cost. No settlement may admit fault by, or impose an obligation on, the indemnified party without its consent, which must not be unreasonably withheld. MabrookUGC always controls its own communications with regulators.
(f) The same loss can be recovered only once, whether under Section 13.1, Section 13.2, Section 18 or a Creator's direct claim (Section 18.10).
(g) MabrookUGC cannot recover any part of a loss that was caused by its own breach, negligence or non-compliance with the law; the indemnity is reduced in proportion to MabrookUGC's share of responsibility.

14. Suspension & termination

14.1 We may suspend or terminate the Brand's access immediately, without refund, for material breach, fraud, chargeback abuse, Restricted Category violation, harassment of Creators or staff, or any activity we reasonably believe harms the Platform's reputation. Any suspension under this Section 14.1 follows the proportionate standard of Section 14.2: we suspend only the users, features, exports or Projects that it is necessary to suspend, only for as long as necessary, and with notice to the Account Owner stating the reason, unless the matter is urgent or the law prevents it, in which case we tell the Account Owner promptly afterwards.
14.2 Proportionate suspension for privacy or security risks. Where we reasonably believe there is an actual risk to personal data or to the security of the Platform (for example a compromised account, suspected misuse of Creator Personal Data, or an unusual volume of exports), we may suspend the affected users, features, exports or Projects. Any such suspension will be limited to what is necessary and last only as long as the risk remains. We will tell the Account Owner the reason promptly, unless the law or the security of the investigation prevents it, and restore access once the risk is resolved. A suspension under this Section 14.2 is not in itself a termination, and paid Project Orders continue as far as it is safe to do so.
14.3 The Brand may close its account at any time by emailing support@mabrookugc.com from the email address registered for the account (the Account Owner's email address), with the subject line "Close my account". We confirm the closure within five (5) business days, subject to open Projects, Project Orders and payments being completed or settled. Closure does not entitle the Brand to a refund of fees already paid for ordered or delivered Project Orders.
14.4 Sections 4 (outstanding fees), 7 (the Assignment of Dark UGC, and each Spark licence for the rest of its Spark Licence Period, subject to Section 14.5), 8 (Confidentiality), 11–13 (Warranties, Liability, Indemnification), 17 (Governing Law), 18 (Data protection) and Schedule 1 survive termination.
14.5 Where we terminate for cause (fraud, chargeback abuse, unlawful use), all Spark licences granted in Section 7 terminate immediately and the Brand must cease all use of the Spark UGC, delete it from all systems, and certify deletion in writing within 10 days. The same applies to Dark UGC under any Project Order that has not been paid in full or whose payment has been reversed or charged back and not made good, because no rights have passed under Section 7.2.

15. Force majeure

Neither party is liable for failure or delay caused by events beyond reasonable control, including acts of God, natural disasters, war, terrorism, civil unrest, pandemic, government action, internet or cloud provider outages, or third-party platform outages. Obligations are suspended for the duration of the event.

16. Notices, changes, language & miscellaneous

16.1 Notices. Notices to us must be sent to support@mabrookugc.com. Notices to you are sent by email to the Account Owner's email address on file and shown in the Brand Portal dashboard. You must keep your email address current.
16.2 Changes to these Brand Terms. We may update these Brand Terms. We will notify material changes by email to the Account Owner and by a notice in the Brand Portal at least fourteen (14) days before they take effect, counted from the date of the email notice, which we keep evidence of. Each notice states the effective date and time with its time zone. From the effective date, the updated Brand Terms apply to your account: if you start a new Project or send a new Creator invitation on or after that date, you accept the updated version for that activity. You can still complete Project Orders already paid or started, receive deliveries, download invoices, use chat, contact support and exercise your privacy rights. If you do not agree to the updated version, you may close your account under Section 14.3. Earlier versions you accepted can be viewed in your MabrookUGC account under "Legal documents", or requested from support@mabrookugc.com.
16.3 Existing orders. Each Project Order is governed by the version of these Brand Terms accepted when it was placed, unless the Brand expressly agrees in writing that a later version applies to it.
16.4 Authority to accept. Only a person authorised to bind the Brand may accept these Brand Terms, or an updated version of them, on the Brand's behalf, including by starting a new Project or sending a new Creator invitation after an update takes effect. Whoever accepts warrants to us that they have that authority. You must keep the Account Owner designation accurate and tell us if the person authorised to bind the Brand changes.
16.5 Electronic acceptance and evidence. When you sign up, and wherever we ask you to accept in the Brand Portal, you accept these Brand Terms by ticking an unticked acceptance box. For each acceptance we record: the version accepted; an archived copy of the exact text accepted and its SHA-256 hash; the language version shown; the time (UTC); the user's ID and email address; the company; the IP address; the browser user agent; and whether the user was the Account Owner. We email a receipt with a permanent link to the archived version. We keep this evidence for the life of the contract plus five (5) years, as described in our Privacy Policy.
16.6 Language. These Brand Terms are drafted in English and translated into Arabic. Both versions are intended to have the same meaning, and we keep them in sync. If there is any conflict or difference in interpretation between them, the English version prevails, to the extent permitted by law. This clause does not override mandatory law, or any rule of a court, arbitral tribunal or regulator on the language of proceedings or of documents submitted to it.
16.7 Assignment. You may not assign these Brand Terms without our prior written consent. We may assign to an affiliate or in connection with a merger, acquisition, or sale of assets.
16.8 Severability. If any provision is held unenforceable, the remainder remains in full force; the unenforceable clause shall be reformed to the minimum extent necessary.
16.9 Waiver. No waiver of any breach shall be deemed a waiver of any subsequent breach. Failure to enforce a provision is not a waiver of it.
16.10 Entire agreement. These Brand Terms (including Schedule 1) and each Project Order constitute the entire agreement between the parties and supersede all prior agreements on the same subject matter. Our Privacy Policy explains how we process personal data; it is a notice, not a contract term.

17. Governing law & dispute resolution

These Brand Terms are governed by, and construed in accordance with, the federal laws of the United Arab Emirates as applied in the Emirate of Sharjah, without regard to conflict-of-laws principles.

The parties will first attempt to resolve any dispute amicably through good-faith negotiation for thirty (30) days. Failing resolution, the dispute shall be finally settled by the competent courts of Sharjah, United Arab Emirates, which shall have exclusive jurisdiction. At our sole option, we may instead elect arbitration under the DIAC Arbitration Rules, seat Dubai, language English, single arbitrator.

18. Data protection & Creator personal data

Each party shall comply with the data protection laws that apply to it, including UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data; the Saudi Personal Data Protection Law issued by Royal Decree No. M/19 of 1443H as amended by Royal Decree No. M/148 of 1444H, its Implementing Regulation and the Regulation on Personal Data Transfer outside the Kingdom; and, only where they apply, the EU and UK General Data Protection Regulation (together, "Data Protection Law"). "Controller" and "processor" include the Saudi terms "controlling entity" and "processing entity".

Order of precedence. On personal data matters the following order applies: (1) mandatory Data Protection Law and any mandatory transfer clauses; (2) Schedule 1, for processing we carry out on your behalf; (3) this Section 18, for personal data shared between us; (4) the accepted Project Order, for the authorised scope of Content use; (5) the rest of these Brand Terms. Where two provisions actually conflict, the parties will cooperate to resolve the conflict rather than rely on this order alone. This Section does not change the commercial rights in Section 7 and does not remove any right that individuals have under mandatory law.

Definitions. "Creator Personal Data" means personal data about a Creator that you receive through the Platform, including their name, handle, profile photo, city, country, gender, follower band, performance statistics, reviews, messages, any shipping address released to you, and any Content showing their face, body or voice. A "Personal Data Breach" means any breach of security, whether accidental or unlawful, that leads to the destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, personal data. "Project Closure" means the date on which all Content under a Project Order has been approved or deemed accepted (or the Project has been cancelled) and all related payments and refunds have been settled. "Spark Licence Expiry" means the end of the last Spark Licence Period of the Spark UGC under that Project Order, including any recorded extension.

18.1 Roles of the parties

MabrookUGC is the controller of personal data it processes to run the marketplace: Creator and Brand accounts, profiles, matching, messaging, payments, payouts, safety and acceptance evidence.
You are an independent controller of Creator Personal Data for your own selection decisions, communications and campaign use under Section 18.2.
Receiving personal data from the other party does not by itself make either party the other's processor. MabrookUGC acts as your processor only for the services described in Schedule 1.
If you are an agency, you act for the client named under Section 3. You and your client must decide and document which of you controls each activity, and you remain responsible to us for compliance with this Section.
If we select audiences, take campaign decisions together with you, or reuse campaign data for another purpose, the parties will first assess whether they act as joint controllers and put any required written arrangement in place before that processing starts. The same applies before any other materially different processing starts.
Aggregate statistics that do not identify any individual are not personal data merely because they come from an ad account.

18.2 Permitted purposes and prohibited uses

You may use Creator Personal Data only to:

(a) review and select Creators for your Projects;
(b) communicate with Creators through the Platform about a Project;
(c) use the Content you have paid for within your rights under Section 7 (for Dark UGC, the Assignment and the consent to use the Creator's name, image and voice as they appear in the video; for Spark UGC, the Spark licence for the Spark Licence Period), including publishing it on advertising platforms (for example TikTok, Meta or Snapchat), which act under their own terms and roles;
(d) where a Creator's shipping address is released to you after selection for a product-shipping Project, ship the product and contact the Creator or courier strictly about that delivery;
(e) where strictly necessary, reconcile payments, keep accounting and tax records, meet legal obligations, protect security, and establish, exercise or defend legal claims.

You may use AI tools to translate, subtitle, caption or edit delivered Content within your rights under Section 7, provided the tool is used under business terms that exclude training on your inputs and outputs, and the tool is not used to create a synthetic likeness or voice of the Creator.

You must not:

sell, rent, license or otherwise share Creator Personal Data or lists of Creators, other than with your agencies and service providers acting for you on a Project and bound by equivalent obligations, and the advertising platforms described in (c);
use Creator Personal Data to build audiences (including custom or lookalike audiences), add Creators to marketing lists, profile them, or combine their data with other data sets for purposes unrelated to the Project;
apply facial recognition, create biometric templates, or infer sensitive characteristics (such as health, religion, ethnicity, political opinion or sexual life) from Creator Personal Data or Content;
enter Creator Personal Data into AI model prompts other than as allowed in the paragraph above; use a Creator's face, body, voice or name to train or fine-tune AI models; or create synthetic, cloned or "deepfake" versions of a Creator's likeness or voice, or synthetic endorsements, without the Creator's prior written permission;
use Spark UGC showing a Creator after the Spark Licence Period ends or outside the Spark licence, unless a further use has been recorded under Section 7.5, or use a Creator's name, image or voice apart from the Content;
ask Creators for personal contact details, bank details or identity documents.

A Creator's written permission is required where this Section says so, but it does not override mandatory law, platform rules or the rights of other people.

18.3 Security

You shall protect Creator Personal Data with appropriate technical and organisational measures, including: an individual account for each team member (invite them through the Brand Portal; never share credentials); access limited to people who need it for the Project; removal of leavers' access promptly and in any case within five (5) business days; multi-factor authentication wherever your systems offer it (recommended); secure transfer methods; exports and downloads limited to what the Project needs and stored in access-controlled systems, not on personal devices or personal email accounts; confidentiality obligations for everyone with access; and an internal route to escalate incidents. MabrookUGC protects Platform data with measures that include encryption in transit, private file storage with short-lived download links (except Creator profile photos and portfolio videos, which are stored at long, random public links that anyone with the exact link can open, as described in Section 11 of our Privacy Policy), separation of Brand accounts by access rules, two-factor authentication required for administrator access to personal data in our database, and encrypted payout details; the measures for processor services are set out in Schedule 1.

18.4 Retention and deletion

Creator Personal Data other than delivered Content (for example profile data, messages, shortlists and exports) must be deleted as soon as it is no longer needed and no later than thirty (30) days after Project Closure.
Dark UGC assigned to you under Section 7.2, and the Creator identification needed to manage it, may be kept for as long as you use the Content under the Assignment; Creator identification you no longer need for that purpose must be deleted.
Copies of Spark UGC you hold, and the Creator identification needed to manage them, may be kept until Spark Licence Expiry and must be deleted no later than thirty (30) days after Spark Licence Expiry, unless a further use has been recorded under Section 7.5.
MabrookUGC keeps its own copy of delivered Content as described in Section 9 of our Privacy Policy: for Dark UGC, as long as it is needed for delivery, disputes and claims and MabrookUGC's own promotion of the platform (Section 7.11); for Spark UGC, for the Spark Licence Period plus ninety (90) days, except a low-resolution evidence copy kept for two (2) years and videos used under Section 7.11.
These are outer limits. An earlier deadline under law, or an earlier deletion obligation following a valid request by the Creator or by us, prevails.
Exceptions: (i) copies you must keep by law (for example accounting or tax records), kept only for that purpose and with restricted access; (ii) a legal hold for a specific actual or reasonably expected claim, limited to what is needed and approved and documented internally; and (iii) backups that are overwritten in their normal cycle, are not restored for any other use, and are deleted again if restored.
You must make sure your agencies and service providers delete their copies on the same basis, and confirm deletion in writing within ten (10) business days if we or the Creator ask.
At Spark Licence Expiry you must stop running the Spark Ads, remove the ads and copies you control and take reasonable steps with your recipients. You are not required to remove copies made by third parties that you do not control. The Creator's own original posts belong to the Creator; the technical expiry of a Spark Code does not delete them.

18.5 Personal Data Breaches

If you become aware of a Personal Data Breach affecting Creator Personal Data in your possession or in the possession of your recipients, you shall notify us at support@mabrookugc.com (subject "Security incident") without undue delay and in any case within twenty-four (24) hours after becoming aware of it. A preliminary notice is acceptable, with updates to follow as facts become known. The notice should describe the nature of the breach, the categories and approximate number of Creators and records affected, the likely consequences, and the measures taken or proposed. You shall contain the breach, preserve evidence and cooperate with us. We will notify you in the same way and within the same time if we become aware of a Personal Data Breach affecting personal data of your team members. Each party remains responsible for its own notifications to regulators and individuals under Data Protection Law; for example, under Saudi law a controller must notify SDAIA within seventy-two (72) hours where the legal threshold is met, and must notify affected individuals without undue delay. Neither party's notification to a regulator depends on the other party's permission.

18.6 Requests from individuals and authorities

Each party answers requests from individuals about its own processing. If a request concerns processing by the other party, the receiving party forwards it to the other party within five (5) business days and tells the individual.
Each party gives the other, within five (5) business days of a request, the information and help reasonably needed to answer a request or an authority's enquiry about Creator Personal Data, to the extent lawful.
Where a correction, deletion, restriction or objection must be passed on, each party passes it on to the recipients to which it disclosed the data.
Identity checks must be proportionate; neither party asks for copies of identity documents by default.
Each party informs the other of any authority request relating to Creator Personal Data received through the Platform, unless the law prohibits it. Neither party's response to a regulator depends on the other party's permission.

18.7 Where we process data on your behalf

Where we process personal data on your behalf (managed campaign services, Spark Ads management on your ad account, or hosting material you control), we act as your processor and Schedule 1 (Data Processing Schedule) applies. Schedule 1 forms part of these Brand Terms.

18.8 Service providers and international transfers

We use the following providers to run the Platform. Their role depends on the activity:

Supabase (processor): database, authentication, file storage and server functions, hosted on Amazon Web Services in Mumbai, India (region ap-south-1). Backups (database snapshots every six hours and the provider’s daily backups) are overwritten within thirty (30) days; data deleted from the live systems remains only in those backups until then and is excluded from any use. Backups are restored only to recover from an incident, and if a backup is restored, deletions are re-applied before the restored data is used.
Vercel (processor for hosting; independent controller for certain service data): hosting of the website and portals, USA with a global edge network; request logs.
Resend (processor): transactional and account emails, USA.
Anthropic (processor, API, USA): on-demand translation of in-platform chat and support messages for our staff, with phone numbers, bank details and email addresses removed before sending; and optional script suggestions that use only the text you type into the Brief fields (you should not include personal data in those fields; no Creator records are sent). Data is kept by Anthropic under its commercial terms (usually up to 30 days) and not used for model training under those terms.
Stripe (processor for payment processing; independent controller for fraud prevention and compliance): card payments. No card data reaches MabrookUGC.
TikTok (independent controller for its platform): sign-in and account linking for Creators (where TikTok account linking is enabled), public video statistics, Spark Ads and TikTok Business integrations you authorise, and embedded public videos.
Google (independent controller): sign-in.

As a result, personal data is stored in India and accessed from the UAE, and is also processed in the USA and other countries where these providers operate. These transfers rely on our providers' data processing terms and contractual safeguards; we are completing our assessment under the Saudi Regulation on Personal Data Transfer outside the Kingdom. MabrookUGC is responsible for the transfers it controls, including making Content and Creator Personal Data available to you for download. You are responsible for the lawful transfer of Creator Personal Data after you export or download it and for any onward transfers you make. Our Privacy Policy contains the full list of recipients.

18.9 Your team

People you invite to your Brand account receive our privacy notice directly in the invitation email; you should also tell them how you use their data. You are responsible for their use of the Platform and of Creator Personal Data. Only a person authorised to bind the Brand may accept these Brand Terms for it (Section 16.4). You must remove users who leave your organisation or no longer need access, and tell us promptly about any change in the ownership of your company or in who is authorised to act as Account Owner; we log such changes.

18.10 Liability, affected Creators and survival

Liability for breaches of this Section 18 is governed by Sections 12 and 13, including the cap in Section 12.3 and the exceptions in Section 12.4.
A serious breach of this Section, or a breach not cured within ten (10) business days after written notice where it can be cured, is a material breach of these Brand Terms. A minor administrative lapse that is promptly corrected is not in itself a material breach.
Affected Creators as beneficiaries. In accordance with Articles 227 and 229 of the UAE Civil Transactions Law (Federal Decree-Law No. 25 of 2025), Creators whose personal data you receive through the Platform are intended third-party beneficiaries of your obligations in Sections 18.2 to 18.6, 18.9 and 13.2 as they relate to their own personal data, and may enforce those obligations directly against you, subject to Sections 12 and 13.3. Creators are not parties to, and do not take on or benefit from, any other obligation in these Brand Terms, and Section 17 (dispute resolution) does not bind them.
This Section survives termination for as long as you or your recipients hold Creator Personal Data. Claims that arose before deletion, and the duties needed to complete the handling of an incident or of a request, survive deletion.

Schedule 1 — Data Processing Schedule

This Schedule applies when MabrookUGC processes personal data on the Brand's behalf as its processor ("Processor Services"). It forms part of these Brand Terms and, for Processor Services, prevails over the rest of them except mandatory law (Section 18). It does not apply to processing for which MabrookUGC is a controller (Section 18.1).

S1.1 Services

(a) Managed Campaign services under Section 4.6, where we set up, run or report on campaigns for the Brand; (b) Spark Ads management on the Brand's advertising account, including through the TikTok Business API or access the Brand grants to its ad account; and (c) any hosting by MabrookUGC of material controlled by the Brand that contains personal data (for example customer testimonials or staff images the Brand supplies).

S1.2 Purposes

Only to provide the Processor Services requested by the Brand, including configuring campaigns, uploading authorised Content, monitoring delivery and reporting results.

S1.3 Data subjects

The Brand's staff and ad-account users; people shown or named in material the Brand supplies; and people who interact with the Brand's ads, to the extent their data is visible in the ad account (for example public comments and handles).

S1.4 Categories of personal data

Names, business contact details, account and ad-account identifiers, campaign settings, audience definitions supplied by the Brand, performance reports (usually aggregated), public comments and handles, and personal data contained in material the Brand supplies. No special categories of personal data are expected; the Brand must not provide sensitive data or customer lists unless we agree in writing.

S1.5 Processing operations

Access, collection from the ad account, storage, retrieval, configuration, upload, analysis for reporting, transmission to the Brand, and deletion.

S1.6 Duration

For the term of the relevant Processor Service, plus the return and deletion period in S1.14.

S1.7 Instructions

We process personal data only on the Brand's documented instructions, which are these Brand Terms, the Project Order or quotation, and written instructions given through the Platform or by email by an authorised user of the Brand, unless the law requires otherwise (in which case we inform the Brand first, unless the law prohibits it). If we believe an instruction infringes Data Protection Law, we will tell the Brand without delay and may suspend that instruction until it is confirmed in a lawful form or changed.

S1.8 Confidentiality

Only staff who need access to provide the Processor Services have it, and all of them are bound by confidentiality obligations.

S1.9 Security measures

Encryption in transit; access controls separating Brand accounts; individual staff accounts with least-privilege access; two-factor authentication required for administrator access to personal data in our database; private storage with short-lived download links; logging of sensitive administrative access; secure handling of ad-account access tokens and revocation when a service ends; and regular review of access rights.

S1.10 Sub-processors

We keep a dated register of the sub-processors used for Processor Services and provide it on request. As at 22 September 2026: Supabase (hosting on Amazon Web Services, Mumbai, India); Vercel (hosting, USA and global edge network); Resend (email, USA); and Anthropic (API, USA — only where Brief fields are used for optional script suggestions). The advertising platform on which the Brand's account is held acts under the Brand's own agreement with it and is not our sub-processor. We will give the Brand at least fifteen (15) days' notice by email before a new sub-processor processes the Brand's personal data. The Brand may object on reasonable data-protection grounds within that period. If we cannot resolve the objection, we will offer an alternative, suspend the affected service, or allow the Brand to terminate the affected service with a refund of any unused prepaid fees for it. We impose data-protection obligations on each sub-processor that are equivalent in substance to those in this Schedule and remain responsible to the Brand for their performance.

S1.11 Assistance

Taking into account the nature of the processing, we help the Brand to answer requests from individuals, to meet its security and breach-notification duties, and with data protection impact assessments and consultations with authorities.

S1.12 Personal Data Breaches

We notify the Brand of a Personal Data Breach affecting personal data processed under this Schedule without undue delay and in any case within twenty-four (24) hours after becoming aware of it. A preliminary notice may be followed by updates. The notice describes the nature of the breach, the data and individuals affected, the likely consequences and the measures taken or proposed.

S1.13 Audits

We make available the information reasonably needed to demonstrate compliance with this Schedule, first in the form of documents (such as policy summaries, sub-processor terms and answers to reasonable questionnaires). If these are not sufficient, the Brand may carry out an on-site audit, or have one carried out by an independent auditor bound by confidentiality, on at least thirty (30) days' notice, no more than once a year unless a Personal Data Breach has occurred or an authority requires it, during business hours, at the Brand's cost and without access to other customers' data.

S1.14 Return and deletion

When a Processor Service ends, we delete the Brand's personal data processed under this Schedule no later than thirty (30) days after the service ends, whether or not the Brand asks for its return. If the Brand asks within that period, we first return the data to it in a common format. This does not apply to data the law requires us to keep (for example invoices and accounting records, which we keep for seven (7) years after the end of the tax period to which they relate); any data we must keep is restricted to that purpose. Deleted data remains only in backups, which are overwritten within thirty (30) days; while it remains there it is excluded from any use, and if a backup is restored, the deletion is re-applied before the restored data is used.

S1.15 Disclosure required by law

If a law or authority, including a foreign law or authority, requires us to disclose personal data processed under this Schedule, we will inform the Brand before disclosing (unless the law prohibits it), challenge the request where there are reasonable grounds, and disclose only the minimum required.

S1.16 Locations and transfers

Processing takes place in the UAE (access by our staff), India (hosting) and the countries of the sub-processors listed in S1.10. Section 18.8 applies to these transfers.

S1.17 Legal requirements covered

This Schedule is intended to contain the matters that a processing agreement must address under Article 17 of the Implementing Regulation of the Saudi Personal Data Protection Law and the processor obligations under UAE Federal Decree-Law No. 45 of 2021, where they apply. Any stricter duty under Data Protection Law continues to apply.

19. Contact

VM MEDIA LLC
Sharjah Media City (Shams), Sharjah, United Arab Emirates
Licence No.: 2322072.01
Email: support@mabrookugc.com