Estata Terms of Service

Last updated: 18 October 2026

Version 2026-10-18

These Terms of Service (the "Terms") govern access to and use of Estata, the property management platform available at https://estata.app and through its web and mobile applications. Please read them carefully. By accepting these Terms, creating or using a workspace, or using the Service, you agree to them on behalf of the business you represent.

1. Who we are and who these Terms apply to

1.1 Provider. The Service is provided by KMT TECHNOLOGIES FZCO, a Free Zone Company registered in the Dubai Multi Commodities Centre (DMCC), licence number DMCC 821264, registration number DMCC190245, with its registered address at Unit 3298, DMCC Business Centre, Level 1, Jewellery & Gemplex 3, Dubai, United Arab Emirates ("KMT", "we", "us" or "our"). Estata is a brand of KMT. You can contact us at support@estata.app.

1.2 Customer. These Terms are an agreement between KMT and the business, organisation or individual trading as a business that subscribes to the Service (the "Customer" or "you"). The person accepting these Terms confirms that they have authority to bind the Customer.

1.3 Business use only. The Service is offered only to businesses and professionals, such as property managers, property owners and hospitality operators, for use in the course of their trade, business or profession. It is not offered to consumers.

1.4 Order of precedence. If there is a conflict between documents, the following order applies: (a) a separate written agreement or order form signed by both parties; (b) the Data Processing Addendum, for matters of data protection; (c) these Terms; and (d) the Documentation.

2. Definitions

In these Terms:

• "Account Data" means personal data about the Customer's Authorised Users and billing contacts that we process to manage the Customer's account, subscription and billing, as described in our Privacy Policy.
• "Agreement" means these Terms, the Data Processing Addendum, and any order form or other document that refers to these Terms.
• "Authorised User" means an individual whom the Customer invites or permits to use the Service under its workspace, including its employees, contractors, staff and the property owners it invites to the owner portal.
• "Customer Data" means all data, files and content that the Customer or its Authorised Users submit to the Service, or that the Service imports on the Customer's instruction (for example from channel calendar feeds), including personal data of renters, guests, property owners, staff and contractors.
• "Data Processing Addendum" or "DPA" means the Estata Data Processing Addendum published at https://estata.app, as updated from time to time in accordance with its terms.
• "Documentation" means the user guides, help pages and feature descriptions for the Service that we make available.
• "Fees" means the subscription fees for the Plan the Customer selects, and any other fees agreed in writing.
• "Plan" means a subscription plan for the Service (currently Starter, Pro or Business), with the features and limits described on our pricing page at the time of purchase.
• "Service" means the Estata platform, including its web application, progressive web application, application programming interfaces, Documentation and related support.
• "Subscription Term" means the monthly or annual period for which the Customer has paid or agreed to pay Fees, including each renewal period.
• "Third Party Services" means services, platforms and data sources that are not provided by KMT, including booking channels such as Airbnb and Booking.com, payment providers and app stores.
• "Workspace" means the separate tenant environment within the Service that holds the Customer's configuration and Customer Data.

3. Account and workspace

3.1 Creating a workspace. Workspaces are created by our platform administrators on request or, where we make it available, through online sign up. We may decline to open a workspace at our discretion.

3.2 Accurate information. The Customer must provide accurate, current and complete account and billing information and keep it up to date.

3.3 Authorised Users and roles. The Customer decides who may access its Workspace and assigns each Authorised User a role. The Service currently offers the roles admin, property manager, property owner and staff, each with the permissions described in the Documentation. Property owners invited by the Customer can view and modify the data of the properties linked to them, and every change is recorded in the activity log. The Customer is responsible for choosing appropriate roles, for removing access promptly when it is no longer needed, and for all acts and omissions of its Authorised Users as if they were its own.

3.4 Credentials. Each Authorised User must have individual login credentials, which must not be shared. The Customer must keep credentials confidential, use strong passwords, and tell us without delay at support@estata.app if it becomes aware of any unauthorised access to its Workspace.

3.5 Workspace administrators. At least one Authorised User with the admin role must remain active in the Workspace. We may rely on instructions from any Workspace admin as instructions from the Customer.

4. Free trial

4.1 Trial period. New Customers may use the Service free of charge for 30 days from the date the Workspace is created (the "Trial"). No payment card is required to start the Trial.

4.2 Trial conditions. We may limit the features, number of properties, units or users available during the Trial. A Trial is available once per Customer, and we may end a Trial early if we reasonably believe it is being misused.

4.3 No warranty during the Trial. During the Trial the Service is provided "as is", without any warranty, support commitment or availability commitment, and to the extent permitted by law we have no liability to the Customer arising from the Trial.

4.4 End of the Trial. When the Trial ends, the Workspace becomes read only until the Customer chooses a Plan (see Section 7). Customer Data is not deleted at the end of the Trial and remains available for export.

4.5 Unconverted trials. If the Customer has not chosen a Plan within 90 days after the end of the Trial, we may close the Workspace after giving at least 14 days notice by email to the Workspace admins. Section 15 then applies as if the Agreement had ended on the date the Workspace is closed.

5. Plans, subscriptions and billing

5.1 Plans. The Service is offered on three Plans, Starter, Pro and Business, each available with monthly or annual billing. Fees are stated in United States dollars (USD) on our pricing page. The features, limits and Fees that apply are those shown at the time of purchase or renewal, unless agreed otherwise in writing.

5.2 Payment. Fees are payable in advance for each Subscription Term. Payments are processed by our payment provider, Stripe, using a payment card, Apple Pay or Google Pay. By providing a payment method, the Customer authorises us and Stripe to charge the Fees for the current and each renewal Subscription Term, together with applicable taxes, until the subscription is cancelled.

5.3 Card data. We do not receive or store full payment card numbers. Payment details are collected and stored by Stripe under its own terms and privacy policy.

5.4 Taxes. Fees are exclusive of value added tax, goods and services tax, sales tax, withholding tax and similar taxes. Where we are required to charge such taxes, they will be added to the invoice. Where the reverse charge mechanism applies, the Customer is responsible for accounting for the tax. If the Customer is required by law to withhold tax from a payment, it must increase the payment so that we receive the amount we would have received without the withholding.

5.5 Failed payments. If a payment fails, Stripe may retry the charge and we will notify the Customer. If the amount remains unpaid 14 days after our notice, we may place the Workspace in read only mode or suspend the Service under Section 13 until payment is received.

5.6 Upgrades and downgrades. An upgrade to a higher Plan takes effect immediately, and the Customer will be charged the prorated difference for the remainder of the current Subscription Term as calculated by our payment provider. A downgrade takes effect at the start of the next Subscription Term. If Customer Data exceeds the limits of the new Plan, the Customer must reduce its usage or some features may become unavailable, but we will not delete Customer Data because of a downgrade.

5.7 Price changes. We may change the Fees for any Plan by giving at least 30 days notice by email or within the Service. New Fees apply from the first renewal that starts after the notice period ends. If the Customer does not agree to the new Fees, it may cancel before that renewal.

5.8 Invoices and disputes. Invoices and receipts are provided electronically. If the Customer disputes a charge in good faith, it must tell us at support@estata.app within 30 days of the charge, and both parties will work together to resolve the dispute promptly. The Customer should contact us before initiating a chargeback.

6. Auto renewal and cancellation

6.1 Auto renewal. Each subscription renews automatically at the end of its Subscription Term for a further term of the same length (monthly or annual) at the then current Fees, unless the Customer cancels before the end of the current Subscription Term.

6.2 Cancellation. The Customer may cancel at any time through the billing settings of its Workspace or by writing to support@estata.app. Cancellation takes effect at the end of the current paid Subscription Term, and the Customer keeps full access until then.

6.3 No refunds for partial periods. Fees are not refundable, and no refunds or credits are given for partial Subscription Terms, unused time, unused features or downgrades, except where required by applicable law or where these Terms expressly provide for a refund.

6.4 Renewal reminders. For annual subscriptions we will send a reminder to the Workspace admins before the renewal date where required by applicable law.

7. Read only mode and data export

7.1 When read only mode applies. The Workspace becomes read only: (a) when the Trial ends and no Plan has been chosen; (b) during the export window after a subscription ends (see Section 15); and (c) where we restrict access for non payment under Section 5.5.

7.2 Effect of read only mode. In read only mode, Authorised Users can sign in, view and export Customer Data, but cannot create or change data. Automated functions may stop, including channel calendar synchronisation, reminders and notifications. The Customer must therefore manage its bookings directly with its booking channels while the Workspace is read only, and we are not responsible for double bookings or missed reservations that occur during that time.

7.3 Data export. The Customer may export Customer Data at any time during the Subscription Term, during the Trial, while the Workspace is read only and during the export window, using the export features available in the Service. If a reasonable export cannot be made through those features, we will provide an export of Customer Data in a commonly used, machine readable format on request.

8. Use of the Service and acceptable use

8.1 Right to use. Subject to the Agreement and payment of the Fees, we grant the Customer a non exclusive, non transferable right, during the Subscription Term, for its Authorised Users to access and use the Service for the Customer's internal business purposes.

8.2 Restrictions. The Customer must not, and must not allow anyone else to:

• resell, rent, sublicense or provide the Service to third parties, other than giving access to its own Authorised Users, including the property owners it serves;
• copy, modify, translate, decompile, disassemble or reverse engineer the Service, except to the extent that applicable law expressly permits this despite this restriction;
• use the Service to build a competing product or service, or copy its features or user interface;
• circumvent or test security controls, rate limits, access restrictions or Plan limits, or carry out load testing, penetration testing or vulnerability scanning without our prior written consent;
• access the Service by automated means, such as scraping, except through interfaces we provide for that purpose;
• introduce malware or any code designed to harm, disrupt or gain unauthorised access to any system or data; or
• access or attempt to access another customer's Workspace or data.

8.3 Acceptable use. The Customer must not use the Service to:

• store or process data without a lawful basis, or in breach of data protection, privacy, consumer, housing, anti discrimination or electronic communications laws;
• harass, threaten or discriminate against renters, guests or any other person;
• send unsolicited marketing or spam through the messaging, email or notification features;
• upload content that is unlawful, infringing, defamatory or obscene;
• store special categories of personal data (such as health data, biometric data or data about criminal convictions) unless this is necessary, lawful and the Customer has implemented the additional safeguards the law requires;
• enter full payment card numbers, card security codes, bank account passwords or similar credentials in free text fields, notes or uploaded files; or
• operate rentals that require a licence, permit or registration the Customer does not hold.

8.4 Sanctions and export control. Each party confirms that it is not, and is not owned or controlled by, a person subject to sanctions administered by the United Arab Emirates, the United Nations, the European Union, the United Kingdom or the United States, and the Customer will not use the Service in breach of those sanctions or export control laws.

8.5 Security reports. If you discover a security vulnerability in the Service, please report it to support@estata.app and do not access more data than needed to demonstrate the issue. Good faith reports made in this way are not a breach of Section 8.2.

9. Customer Data and Customer responsibilities

9.1 Ownership. As between the parties, the Customer owns all rights in Customer Data. We obtain no ownership rights in Customer Data.

9.2 Licence to us. The Customer grants us a worldwide, non exclusive licence, for the duration of the Agreement and the deletion periods in Section 15, to host, copy, process, transmit and display Customer Data only as needed to provide, secure, support and maintain the Service, to prevent or address technical or security problems, and as otherwise instructed by the Customer, in each case in accordance with the DPA.

9.3 Roles. For personal data within Customer Data, the Customer is the controller (in Israel, the database controller, also referred to as the database owner) and KMT acts as processor (in Israel, a holder). KMT is the controller of Account Data. The DPA forms part of the Agreement and governs our processing of personal data on the Customer's behalf.

9.4 Lawful basis. The Customer is solely responsible for ensuring that it has a lawful basis for collecting and processing all personal data it puts into the Service, including data about renters, guests, property owners, staff and contractors. In particular, the Customer must record government identification numbers, passport numbers or copies of identity documents only where this is required or permitted by applicable law (for example under lease, guest registration or anti money laundering rules), and must limit the data it records to what is necessary for its purposes.

9.5 Notices to individuals. The Customer must provide all notices required by law to the individuals whose data it puts into the Service, including its renters and guests, and obtain any consents required. These notices must explain that the Customer uses service providers, such as KMT, to store and process their data, and that the data is hosted in the United States.

9.6 Accuracy and retention. The Customer is responsible for the accuracy, quality and legality of Customer Data, and for deciding how long it keeps each record. The Customer must delete Customer Data it no longer needs, using the deletion features of the Service or by asking us.

9.7 Requests from individuals. The Customer is responsible for responding to requests from individuals who wish to exercise their rights over personal data in Customer Data. We will assist as described in the DPA.

9.8 Customers in Israel. A Customer that is subject to the Israel Protection of Privacy Law, 5741 (1981) acknowledges that it is the database controller of the databases it maintains in the Service, and that it remains responsible for its obligations as controller, including determining the security level of each database under the Protection of Privacy (Data Security) Regulations, 5777 (2017), notifying or registering a database where the law requires it, appointing a data protection officer or information security officer where required, and notifying the Privacy Protection Authority of serious security incidents. KMT acts as a holder and complies with the holder obligations set out in the DPA.

9.9 Messages sent through the Service. The Customer is responsible for the content of messages, emails and notifications that it or its Authorised Users send through the Service, and for complying with laws on electronic communications and direct marketing when sending them.

9.10 The Customer's own records. Our backups exist to recover the Service after an incident and are not an archive for the Customer. The Customer should export and keep its own copies of records it must retain for legal, tax or business reasons.

9.11 No professional advice. The Service is a software tool. Reports, receipts, financial summaries, reminders and exchange rate conversions are provided for convenience only and are not legal, tax, accounting or financial advice. The Customer is responsible for its own compliance with tax invoicing, deposit protection, rental registration, tourist tax, guest registration and similar obligations. Exchange rates are obtained from third party sources and may be delayed or inaccurate.

10. Channel calendars and Third Party Services

10.1 Channel calendar synchronisation. The Service can import booking calendars from channels such as Airbnb and Booking.com using iCal feed links that the Customer provides. Please note that:

• KMT is not affiliated with, endorsed by or a partner of any booking channel, and Airbnb, Booking.com and other channel names are trademarks of their respective owners;
• iCal feeds carry dates only, so guest names, prices and fees are not imported;
• synchronisation runs periodically (currently about every 30 minutes) and may be delayed, interrupted or affected by changes the channel makes to its feeds;
• the Service creates, updates or cancels bookings and related cleaning tasks in the Workspace according to the content of each feed, and will skip a run where a feed unexpectedly returns no events; and
• the Customer remains responsible for checking its channel accounts, managing availability and resolving double bookings.

To the extent permitted by law, we are not liable for losses caused by errors, delays or changes in channel feeds, or by overbookings or missed reservations that result from them.

10.2 Calendar export links. The Service can generate a private calendar export link for each unit, showing busy dates without guest data. The Customer is responsible for sharing these links only with intended recipients and should rotate a link through the Service if it may have been exposed.

10.3 Other Third Party Services. The Customer's use of Third Party Services is governed by the terms of their providers. We are not responsible for Third Party Services, their availability or the way their providers handle data, except where a provider acts as our subprocessor under the DPA.

11. Our obligations

11.1 Provision of the Service. We will provide the Service in all material respects in accordance with the Documentation, using reasonable skill and care.

11.2 Security. We will maintain the technical and organisational security measures described in Annex 2 of the DPA. We may update these measures, but we will not materially reduce the overall level of protection during a Subscription Term.

11.3 Customer Data. We will process Customer Data only in accordance with the Agreement, the DPA and the Customer's documented instructions, and we will not sell Customer Data.

11.4 Personnel. We will ensure that our personnel and subcontractors who may access Customer Data are bound by appropriate confidentiality obligations and access it only as needed to perform their tasks.

11.5 Support. We provide support by email at support@estata.app on business days during normal business hours in Dubai. We will use reasonable efforts to respond promptly, but response and resolution times are not guaranteed unless agreed in a signed order form.

11.6 Changes to the Service. We continuously develop the Service and may add, change or remove features. We will not materially reduce the core functionality of a paid Plan during the Customer's current paid Subscription Term. If we make a change that materially and adversely affects the Customer, we will give reasonable notice where practicable.

12. Availability

12.1 Commercially reasonable availability. We will use commercially reasonable efforts to make the Service available 24 hours a day, 7 days a week, except for planned maintenance (of which we will give advance notice where practicable), urgent maintenance needed for security or stability, and events beyond our reasonable control.

12.2 No service level commitment. Unless a service level agreement is agreed in a signed order form, we make no commitment about uptime, performance or response times, and no service credits apply.

12.3 Offline use. Some features can be used without a connection. Changes made offline are stored on the device and sent to the Service when the connection returns. Changes may be lost if the device storage is cleared, or the user signs out, before they have been sent.

13. Suspension

13.1 Grounds. We may suspend all or part of the Service, or the access of individual Authorised Users, if:

• Fees remain unpaid 14 days after we notify the Customer of the overdue amount;
• the Customer or its Authorised Users breach Section 8;
• we reasonably believe suspension is necessary to prevent or address a security threat, or harm to the Service, other customers or third parties;
• suspension is required by law or by a competent authority; or
• the Customer's use of the Service exposes us to a material risk of legal liability.

13.2 How we suspend. Where practicable and lawful, we will give notice before suspending and an opportunity to fix the issue. We will limit any suspension in scope and duration to what is reasonably necessary and will restore access promptly once the cause is resolved.

13.3 Fees during suspension. Fees remain payable during a suspension caused by the Customer's breach or non payment.

14. Term and termination

14.1 Term. The Agreement starts when the Customer accepts these Terms or first uses the Service and continues until all subscriptions have ended and the deletion steps in Section 15 are complete.

14.2 Cancellation by the Customer. The Customer may end its subscription at any time under Section 6.2.

14.3 Termination for breach or insolvency. Either party may terminate the Agreement by written notice if the other party: (a) materially breaches the Agreement and does not remedy the breach within 30 days after receiving written notice describing it; or (b) becomes insolvent, enters into liquidation, administration or an arrangement with its creditors, or ceases to carry on business.

14.4 Discontinuation of the Service. We may stop offering the Service by giving at least 90 days notice. In that case we will refund any prepaid Fees for the period after the Service ends.

14.5 Refund on termination for our breach. If the Customer terminates under Section 14.3 because of our breach, we will refund any prepaid Fees for the remainder of the Subscription Term after the date of termination.

15. Effect of termination, data export and deletion

15.1 End of access. When a subscription or the Agreement ends, the Customer's right to use the Service ends, except for the read only access described in Section 15.2.

15.2 Export window. For 30 days after the end of the subscription (the "export window"), the Workspace remains available in read only mode so that the Customer can export Customer Data. We may shorten or withhold read only access only where the law requires it or where access would create a security risk, and in that case we will provide an export on request instead.

15.3 Deletion. After the export window, we will delete Customer Data from the Service's active systems within 90 days after the end of the subscription, unless the law requires us to keep it.

15.4 Backups. Database backups are kept for 14 days, and daily disk snapshots, which also contain those backups, are kept for 14 days. Residual copies of deleted Customer Data are therefore removed from all backups within 28 days after deletion from the active systems. Until then, backups remain protected under the DPA and are used only to restore the Service after an incident.

15.5 Retention required by law. We may retain Account Data, invoices and payment records for as long as required by tax, accounting and other applicable laws, and may retain Customer Data where we are legally required to do so, in which case we will continue to protect it under the DPA and use it only for that purpose.

15.6 Confirmation. On written request we will confirm in writing that deletion has been completed.

15.7 Survival. Sections 9.1, 15, 16, 17, 18, 19.4, 20, 21, 23, 24 and 25, the obligation to pay Fees accrued before termination, and any other provision that by its nature should survive, continue after the Agreement ends.

16. Intellectual property

16.1 Our rights. KMT and its licensors own all rights, title and interest in and to the Service, the software, the Documentation, the Estata name and logo, and all improvements and derivative works of them. Except for the rights expressly granted in these Terms, no rights are granted to the Customer, whether by implication or otherwise.

16.2 Usage data. We may collect technical and usage information about how the Service operates, such as performance metrics, error rates and feature usage counts, and use it to operate, secure, support and improve the Service. We use this information outside the Service only in aggregated form that does not identify the Customer, any Authorised User or any other individual, and that does not include the content of Customer Data.

16.3 Customer name and logo. We will not use the Customer's name or logo in our marketing without the Customer's prior written consent.

17. Feedback

If the Customer or its Authorised Users give us suggestions, ideas or other feedback about the Service, we may use it freely and without obligation or payment, and the Customer grants us a perpetual, irrevocable, worldwide, royalty free licence to do so. This does not give us any right to disclose the Customer's Confidential Information or Customer Data contained in the feedback.

18. Confidentiality

18.1 Definition. "Confidential Information" means any non public information disclosed by one party to the other in connection with the Agreement that is marked as confidential or that a reasonable person would understand to be confidential, including Customer Data, the non public parts of the Service, pricing offered privately, and security information. It does not include information that: (a) is or becomes public through no fault of the recipient; (b) the recipient already knew without a duty of confidentiality; (c) the recipient lawfully receives from a third party without a duty of confidentiality; or (d) the recipient develops independently without using the Confidential Information.

18.2 Obligations. The recipient will use Confidential Information only to perform or exercise its rights under the Agreement, protect it with at least reasonable care, and disclose it only to its employees, contractors, subprocessors and professional advisers who need to know it and who are bound by confidentiality obligations no less protective than this Section.

18.3 Disclosure required by law. The recipient may disclose Confidential Information where required by law or by a competent authority, provided that, where lawful, it gives the disclosing party prompt notice and reasonable assistance to seek protective treatment, and discloses only what is required. Requests from authorities for Customer Data are also governed by the DPA.

18.4 Duration. These obligations apply during the Agreement and for 5 years after it ends, except that obligations regarding trade secrets continue for as long as the information remains a trade secret, and obligations regarding Customer Data continue for as long as we hold it.

19. Warranties and disclaimers

19.1 Mutual warranties. Each party warrants that it is validly organised and has full power and authority to enter into and perform the Agreement.

19.2 Service warranty. We warrant that, during a paid Subscription Term, the Service will perform materially in accordance with the Documentation. If it does not, and the Customer tells us within 30 days after first becoming aware of the issue, we will use reasonable efforts to correct it. If we cannot do so within a reasonable time, either party may terminate the affected subscription, and we will refund the prepaid Fees for the remainder of the Subscription Term. This is the Customer's sole remedy for breach of this warranty.

19.3 Customer warranty. The Customer warrants that it has all rights, consents and lawful bases needed to submit Customer Data to the Service and to have it processed in accordance with the Agreement.

19.4 Disclaimer. Except as expressly stated in the Agreement, and to the fullest extent permitted by law, the Service is provided "as is" and "as available", and KMT disclaims all other warranties, conditions and representations, whether express, implied or statutory, including those of satisfactory quality, merchantability, fitness for a particular purpose, non infringement and accuracy. We do not warrant that the Service will be uninterrupted or error free, that channel feeds or exchange rates will be accurate or timely, or that the Service will meet every legal requirement that applies to the Customer's business.

20. Limitation of liability

20.1 Excluded losses. To the fullest extent permitted by law, neither party is liable to the other, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for any: (a) loss of profits, revenue, business, contracts or anticipated savings; (b) loss of goodwill or reputation; (c) loss of bookings or reservations, or costs of double bookings; (d) loss or corruption of data, except our obligation to restore Customer Data from available backups; or (e) indirect, special or consequential loss, in each case arising out of or in connection with the Agreement.

20.2 Liability cap. To the fullest extent permitted by law, each party's total aggregate liability arising out of or in connection with the Agreement, including the DPA, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is limited to the total Fees paid by the Customer to KMT for the Service in the 12 months immediately before the event giving rise to the liability, or USD 100 if no Fees have been paid.

20.3 Exceptions. Nothing in the Agreement limits or excludes liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; or (c) any other liability that cannot be limited or excluded by law. The cap in Section 20.2 does not apply to the Customer's obligation to pay Fees, to the Customer's indemnity under Section 21.2, or to a breach of Section 8.2.

20.4 Data subjects. The limits in this Section do not limit any rights that individuals have directly against either party under the Standard Contractual Clauses or applicable data protection law.

21. Indemnities

21.1 By KMT. We will defend the Customer against any claim by a third party alleging that the Service, as provided by us and used in accordance with the Agreement, infringes that third party's intellectual property rights, and we will pay any damages and costs finally awarded against the Customer, or agreed by us in settlement, in respect of that claim. We have no obligation for claims arising from Customer Data, Third Party Services, modifications not made by us, combination of the Service with items not provided by us, or continued use after we have provided a non infringing alternative. If the Service is, or in our opinion is likely to be, subject to such a claim, we may obtain the right for the Customer to continue using it, modify it so that it is not infringing, or terminate the affected subscription and refund the prepaid Fees for the remainder of the Subscription Term. This Section states our entire liability for intellectual property infringement claims.

21.2 By the Customer. The Customer will defend KMT, its affiliates and their personnel against any claim by a third party, including a claim by a renter, guest, property owner, staff member or contractor, or by a regulator, to the extent arising from: (a) Customer Data, or the Customer's lack of a lawful basis, notice or consent for processing it; (b) the Customer's or its Authorised Users' breach of Section 8 or of applicable law; or (c) a dispute between the Customer and its renters, guests, property owners, staff or contractors. The Customer will pay any damages, fines (to the extent the law permits them to be indemnified) and costs finally awarded against KMT, or agreed by the Customer in settlement, in respect of that claim.

21.3 Procedure. The indemnified party must notify the indemnifying party promptly of the claim, give it sole control of the defence and settlement, and provide reasonable cooperation at the indemnifying party's expense. The indemnifying party may not settle a claim in a way that imposes an obligation or admission on the indemnified party without its prior written consent, which may not be unreasonably withheld.

22. Changes to these Terms

22.1 Updates. We may update these Terms from time to time. We will give at least 30 days notice of material changes by email to the Workspace admins or within the Service before they take effect. Changes required by law, or that relate only to new features, may take effect sooner.

22.2 Acceptance and objection. Continued use of the Service after a change takes effect means the Customer accepts the updated Terms. If the Customer does not agree to a material change, it may cancel before the change takes effect. If a material change adversely affects the Customer during a prepaid annual Subscription Term, the Customer may instead terminate within 30 days after the change takes effect and receive a refund of prepaid Fees for the remainder of that term.

22.3 Versions. Each version of these Terms is identified by its version number and date, and we will provide earlier versions on request.

23. Governing law and dispute resolution

23.1 Governing law. The Agreement, and any dispute or claim arising out of or in connection with it or its subject matter or formation, including non contractual disputes or claims, is governed by the laws of England and Wales.

23.2 Negotiation. Before starting arbitration, the parties will try in good faith to resolve any dispute through discussions between senior representatives for at least 30 days after one party notifies the other of the dispute in writing.

23.3 Arbitration. Any dispute that is not resolved under Section 23.2 will be referred to and finally resolved by arbitration administered by the Dubai International Arbitration Centre (DIAC) under the DIAC Arbitration Rules in force when the arbitration starts. The seat of arbitration will be the Dubai International Financial Centre (DIFC), Dubai, United Arab Emirates. The tribunal will consist of one arbitrator, and the language of the arbitration will be English. The award will be final and binding, and judgment on it may be entered in any court of competent jurisdiction.

23.4 Urgent relief. Nothing in this Section prevents either party from seeking urgent interim or injunctive relief from any court of competent jurisdiction, in particular to protect its intellectual property or Confidential Information, or KMT from bringing proceedings to recover unpaid Fees in any competent court.

23.5 Data protection clauses. Where the Standard Contractual Clauses or another mandatory data transfer mechanism incorporated by the DPA requires a particular governing law or forum, that requirement prevails for disputes under that mechanism.

23.6 Excluded convention. The United Nations Convention on Contracts for the International Sale of Goods does not apply to the Agreement.

24. Notices

24.1 Notices to KMT. Legal notices to KMT must be sent by email to support@estata.app, with a copy by courier to KMT TECHNOLOGIES FZCO, Unit 3298, DMCC Business Centre, Level 1, Jewellery & Gemplex 3, Dubai, United Arab Emirates, marked for the attention of the Manager.

24.2 Notices to the Customer. We may send notices to the email addresses of the Customer's Workspace admins or billing contact, or display them within the Service. The Customer must keep these contact details current.

24.3 Receipt. An email notice is treated as received when sent, if sent on a business day in the place of receipt during business hours, and otherwise on the next business day, unless the sender receives a delivery failure message. A courier notice is treated as received when delivered.

25. General

25.1 Entire agreement. The Agreement is the entire agreement between the parties about its subject matter and supersedes all prior agreements, proposals and representations, whether written or oral. Purchase orders or other terms issued by the Customer do not apply, even if accepted. Each party confirms that it has not relied on any statement not set out in the Agreement, but nothing in this Section limits liability for fraud.

25.2 DPA incorporated by reference. The Data Processing Addendum is incorporated into and forms part of these Terms. By accepting these Terms, the Customer also enters into the DPA, including the Standard Contractual Clauses where they apply. A countersigned copy of the DPA is available on request at support@estata.app.

25.3 Privacy Policy. Our Privacy Policy explains how we handle Account Data and other personal data for which KMT is controller. It is provided for information and does not form part of the Agreement.

25.4 Assignment. The Customer may not assign or transfer the Agreement without our prior written consent. We may assign or transfer the Agreement to an affiliate or to a successor of all or part of our business on notice to the Customer.

25.5 Subcontractors. We may use subcontractors and subprocessors to provide the Service. We remain responsible for their performance under the Agreement, and subprocessors of personal data are governed by the DPA.

25.6 Force majeure. Neither party is liable for delay or failure to perform its obligations (other than payment obligations) caused by events beyond its reasonable control, including natural disasters, war, terrorism, civil unrest, epidemics, government action, failure of utilities or telecommunications, failure of third party hosting or network providers not caused by the affected party, and cyber attacks that could not reasonably have been prevented by the measures in the DPA. If such an event continues for more than 30 days, either party may terminate the affected subscription by notice, and we will refund prepaid Fees for the remainder of the Subscription Term.

25.7 Independent parties. The parties are independent contractors. Nothing in the Agreement creates a partnership, joint venture, agency or employment relationship.

25.8 Third party rights. No person other than the parties has any right under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of the Agreement, except that individuals may enforce the Standard Contractual Clauses where those clauses give them that right.

25.9 Severability. If any provision of the Agreement is found invalid or unenforceable, it will be modified to the minimum extent necessary to make it enforceable, and the rest of the Agreement continues in effect.

25.10 No waiver. A failure or delay in exercising a right does not waive that right, and a single or partial exercise of a right does not prevent its further exercise.

25.11 Language. The Agreement is written in English. If it is translated, the English version prevails.

25.12 Electronic acceptance. The Agreement may be accepted electronically, and an electronic record of acceptance is evidence of the Agreement.