1. Why we publish this list
DSH is a controller of personal data under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "UAE PDPL"). When we use a third party to process data on our instructions, that third party becomes our processor.
Article 10 of the UAE PDPL requires the controller to:
- Pick processors that give enough technical and organisational guarantees.
- Sign a written contract that binds the processor to the same duties we owe you.
- Stay liable to you for what our processors do.
Article 16 of the UAE PDPL governs cross-border transfers. Personal data may leave the UAE only when the destination country offers an adequate level of protection, or when the controller puts a recognised safeguard in place such as standard contractual clauses, binding corporate rules, or your explicit consent.
We have the right to engage subprocessors to deliver our services. When we add or replace a subprocessor we will notify you in advance by email. You have the right to object, as set out in section 5 below.
2. Subprocessors by category
2.1 Website hosting, email, and business systems
| Name | Service we use it for | Data category | Country of processing | Lawful transfer mechanism | Privacy policy |
|---|---|---|---|---|---|
| Amazon Web Services (EC2, CloudFront, S3) | Hosting for dubaismarthome.ae, our quotation and invoice system, and content delivery | Page logs, IP, request headers, enquiry form contents, quotation, invoice and customer records | India (Mumbai region), with content cached at CloudFront edge locations worldwide | AWS Data Processing Addendum (contractual safeguards) | https://aws.amazon.com/privacy/ |
| Amazon Simple Email Service (SES) | Delivering enquiry notifications, quotations, invoices and receipts by email | Name, email address, phone number, message contents | United States (Ohio region) | AWS Data Processing Addendum (contractual safeguards) | https://aws.amazon.com/privacy/ |
2.2 Partners
Products and installation are supplied, installed and invoiced by independent, licensed UAE mainland companies that we introduce (our Partners), as explained in our Terms of Service. We pass to the Partner only the data it needs to quote and carry out your project: your name, contact number, property address, access arrangements, and the relevant design drawings. The data stays in the UAE. Because the Partner contracts with you directly, it is responsible for the data it holds for that contract under its own privacy terms. Each Partner agrees in writing with us to keep the data we pass to it confidential and use it only for your project. The Partner is named on its own quotation.
2.3 Smart-home cloud platforms
These platforms are activated only when you choose the matching brand of lighting, control, audio, or voice. The vendor is the data controller for its own end-user account; DSH is a processor on your behalf during installation and remote support.
| Name | Service we use it for | Data category | Country of processing | Lawful transfer mechanism | Privacy policy |
|---|---|---|---|---|---|
| Lutron Electronics | RadioRA 3, HomeWorks QSX, Caseta cloud auth and remote keypad updates | Device IDs, firmware logs, your installer account | United States | SCCs + DPA at integrator level | https://www.lutron.com/en-US/Pages/Legal/PrivacyPolicy.aspx |
| Crestron Electronics | Crestron Home cloud auth and remote diagnostic | Project file metadata, device serials | United States | SCCs + DPA | https://www.crestron.com/Legal/Privacy-Statement |
| Snap One (Control4 4Sight) | Remote-monitoring portal for Control4 systems | Scene names, device status, alarm codes | United States | SCCs + DPA | https://www.snapone.com/privacy-policy |
| Ubiquiti Inc. (UniFi Cloud) | Network controller, remote management of switches and access points | MAC addresses, device names, traffic counters | United States | SCCs + DPA | https://www.ui.com/legal/privacypolicy/ |
| Apple Inc. (HomeKit, Home Hub, iCloud) | HomeKit pairing and iCloud sync of accessory state | Accessory identifiers, end-to-end encrypted home data | United States and EU | SCCs + DPA; end-to-end encryption for HomeKit data | https://www.apple.com/legal/privacy/en-ww/ |
| Amazon (Alexa) | Voice fall-back and routine triggers | Voice utterance metadata, account ID | United States and EU | SCCs + DPA | https://www.amazon.com/gp/help/customer/display.html?nodeId=GVP69FUJ48X9DT8X |
| Google LLC (Google Home, Assistant) | Voice fall-back and casting | Voice utterance metadata, device list | United States and EU | SCCs + DPA | https://policies.google.com/privacy |
| Sonos Inc. | Multi-room audio cloud and casting | Account ID, room names, content source IDs | United States and EU | SCCs + DPA | https://www.sonos.com/en/legal/privacy |
| Josh.ai Inc. | Private voice control, voice training, OTA updates | Voice training samples (opt-in), device IDs | United States | SCCs + DPA; on-device default, cloud opt-in | https://www.josh.ai/privacy |
2.4 Surveillance and access cloud
| Name | Service we use it for | Data category | Country of processing | Lawful transfer mechanism | Privacy policy |
|---|---|---|---|---|---|
| Hikvision (Hik-Connect) | Camera and intercom remote view | Stream metadata, device serials | Hong Kong SAR with EU mirror | SCCs + DPA; on-prem NVR primary, cloud optional | https://www.hikvision.com/en/support/cybersecurity/privacy-policy/ |
| Axis Communications (Axis Companion) | Axis camera management | Device firmware logs, recording metadata | Sweden (EU) | EU adequacy under PDPL Art.16 | https://www.axis.com/about-axis/privacy |
| Motorola Solutions (Avigilon Cloud) | Avigilon ACC cloud connection | Device IDs, alarm events | United States and EU | SCCs + DPA | https://www.motorolasolutions.com/en_us/about/privacy-policy.html |
| Mobotix AG | Mobotix camera management | Device IDs, firmware logs | Germany (EU) | EU adequacy under PDPL Art.16 | https://www.mobotix.com/en/privacy-statement |
2.5 Energy stack monitoring
| Name | Service we use it for | Data category | Country of processing | Lawful transfer mechanism | Privacy policy |
|---|---|---|---|---|---|
| SolarEdge Technologies | PV inverter monitoring | Generation data, inverter serial | Israel and EU | SCCs + DPA | https://www.solaredge.com/us/legal/privacy-policy |
| Enphase Energy | Microinverter and battery monitoring | Generation data, battery state | United States | SCCs + DPA | https://enphase.com/en-us/privacy-policy |
| Tesla Inc. | Powerwall and Tesla mobile app pairing | Battery state, charge cycles | United States | SCCs + DPA | https://www.tesla.com/legal/privacy |
| Span.IO | Smart electrical panel monitoring | Per-circuit consumption | United States | SCCs + DPA | https://www.span.io/privacy-policy |
| Wallbox Chargers (myWallbox) | EV charger telemetry | Charge sessions, kWh, vehicle ID | Spain (EU) | EU adequacy under PDPL Art.16 | https://wallbox.com/en_uk/legal/privacy-policy |
| ABB Ltd (ChargerSync) | ABB EV charger management | Charge sessions, firmware logs | Switzerland and EU | EU adequacy + SCCs | https://new.abb.com/privacy-notice/customers |
2.6 Payment processing
When you pay an invoice or a deposit, the card data is captured by the payment processor and is never stored on DSH systems.
| Name | Service we use it for | Data category | Country of processing | Lawful transfer mechanism | Privacy policy |
|---|---|---|---|---|---|
| Stripe (Stripe, Inc. and its affiliates) | Online card payments for any invoice issued by DSH | Card data (held by Stripe only), name, email, billing address, amount paid | United States, Ireland and other Stripe locations | Stripe Data Processing Agreement (contractual safeguards) | https://stripe.com/en-ae/privacy |
2.7 Government API
| Name | Service we use it for | Data category | Country of processing | Lawful transfer mechanism | Privacy policy |
|---|---|---|---|---|---|
| Islamic Affairs and Charitable Activities Department (IACAD) | One-way ingest of UAE prayer-times for Adhan-aware lighting, audio, voice | Public prayer-time table, no personal data | UAE (Dubai) | Onshore public dataset; no personal data flows out | https://www.iacad.gov.ae |
3. How we vet a new subprocessor
Before any vendor in the table above is given access to customer data, our operations team runs a four-step check:
- Contract. A signed Data Processing Addendum that binds the vendor to UAE PDPL Article 10 duties, including breach notice, audit rights, and deletion on termination.
- Security evidence. Current ISO 27001 certificate, SOC 2 Type II report, or equivalent. Where the vendor is a hardware-control cloud, we accept an IEC 62443 attestation.
- PDPL Article 16 transfer check. We confirm the destination country and pick a lawful transfer mechanism, and record both in the tables above.
4. How we notify you of new subprocessors
Whenever we add or replace a subprocessor we will:
- Email the account contact listed in your project file.
- Update this page and the Last updated date.
The notice goes out at least 30 days before the new subprocessor goes live. This 30-day window is your objection window, in line with UAE PDPL principles on transparency and the data subject right to object under Article 13.
5. Your right to object and your right to terminate
You may object to a new subprocessor by emailing support@dubaismarthome.ae during the 30-day notice window. We will then either:
- Offer a workaround, for example a regional alternative or an on-prem-only deployment of the same function.
- Pause the rollout for your account until we can offer a workaround.
- Allow you to terminate the affected service line for cause, with a pro-rata refund of any prepaid fees, where no workaround is possible.
You may also raise a complaint with the UAE Data Office under Article 25 of the UAE PDPL.
6. Last updated
This list was last updated on 28 September 2026. We review the list at least every six months and on every onboarding of a new platform.
For privacy questions please contact:
support@dubaismarthome.ae
Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates
+971 50 506 1871