Data Processing Agreement (draft)

1. Subject matter and parties' roles

The Processor processes personal data on behalf of the Controller only to provide the service the Controller has asked for. The Controller decides why and how its data is used; the Processor acts on its documented instructions (GDPR Art. 28(3)(a); Saudi PDPL, processor provisions).

[Commitment – owner to confirm]

2. Nature, purpose, data and duration

Nature and purpose: storing and reading business documents and messages, preparing drafts and filings for the Controller's approval, and communicating on the Controller's behalf by email, phone and messaging.

Categories of data and of people: [owner to confirm – for example identity and contact details of the Controller's founders, directors, staff and counterparties, and the content of documents the Controller uploads].

Duration: for as long as the Controller uses the service, plus the period needed to return or delete data under clause 9.

3. Instructions

The Processor will process personal data only on the Controller's documented instructions, including for transfers, unless a law requires otherwise. If the Processor believes an instruction breaks the law, it will say so.

[Commitment – owner to confirm]

4. Confidentiality of staff

People who can reach the Controller's personal data are bound by a duty of confidentiality and may use it only to provide the service.

[Commitment – owner to confirm] Access by staff is described in Annex 1 and is still being tightened.

5. Security

The Processor will keep appropriate technical and organisational measures to protect personal data, as described in Annex 1 (GDPR Art. 28(3)(c) and Art. 32; Saudi PDPL, security provisions).

[Commitment – owner to confirm] Annex 1 lists only what is in place today and states plainly what is in progress or missing.

6. Sub-processors

The Controller agrees to the sub-processors in Annex 2. The Processor will tell the Controller before adding or replacing one, and give the Controller a fair chance to object. The Processor will bind each sub-processor to data protection duties no weaker than these (GDPR Art. 28(2) and (4)).

[Commitment – owner to confirm] No change-notice process or flow-down terms were found when this draft was prepared.

7. Helping with rights requests

The Processor will help the Controller answer requests from people exercising their rights over their data, such as access, correction and deletion (GDPR Art. 28(3)(e); Saudi PDPL, data subject rights).

[Commitment – owner to confirm] There is no self-service export or deletion today; requests are handled by hand. The response time is [owner to fill in].

8. Personal data breaches

The Processor will tell the Controller without undue delay after becoming aware of a personal data breach, with the information the Controller needs to meet its own duties to report it (GDPR Art. 33(2); Saudi PDPL, breach notification).

[Commitment – owner to confirm] Notice period: [owner to fill in]. No breach process was found when this draft was prepared.

9. Return and deletion

When the service ends, the Processor will, at the Controller's choice, return or delete the personal data and delete existing copies unless a law requires them to be kept (GDPR Art. 28(3)(g)).

[Commitment – owner to confirm] No deletion route or job exists today, and retention periods are still being defined (see Annex 1).

10. Audits and information

The Processor will give the Controller the information needed to show these duties are met, and will allow and help with audits, including inspections, by the Controller or an auditor it appoints (GDPR Art. 28(3)(h)).

[Commitment – owner to confirm] The Processor has not completed an independent audit and no report has been issued.

11. Location and transfers of data

The Controller's data is stored in Singapore (Google Cloud region asia-southeast1). It is not stored in Saudi Arabia. Some sub-processors in Annex 2 have a processing region that is not confirmed.

Where the Controller is subject to the Saudi PDPL or the GDPR, moving data outside the Controller's country may need a legal basis or safeguards. The parties will agree them here: [owner and lawyer to complete].

[Commitment – owner to confirm]

12. Liability, governing law and disputes

Governing law: [GOVERNING LAW – owner to fill in].

Liability and the forum for disputes: [lawyer to complete].

Annex 1 – Security measures

Taken from the Processor's Trust facts. “In progress” and “gap” mean the measure is not fully in place.

• In progress: Our website tells browsers to connect to us only over secure connections. We have not yet confirmed, from our own deployment files, that every public address refuses unencrypted connections, so we do not mark this as complete.
• In progress: Stored documents rely on the standard encryption our cloud provider applies to its storage. Encryption with keys that we control ourselves is in progress and is not yet in place.
• In place: The storage holding uploaded documents is set so that no document can be made publicly readable.
• In place: The login details a customer gives us to connect a mailbox or messaging account are encrypted before they are stored.
• In place: Customer passwords are stored only as salted one-way hashes, never as the password itself.
• In place: A sign-in session expires after 30 days, and the expiry is checked on our side, not only in the browser.
• In place: Repeated attempts to sign in, sign up or change an account are limited, to make password guessing harder.
• Gap: Two-step sign-in is not available for customer accounts.
• In progress: Support access to a customer workspace goes through a dedicated tool. Each use is limited to one hour, needs a written reason, and is recorded in an audit log. Our wider internal access controls, including access to our cloud accounts, are still being tightened and reviewed.
• In place: A support session cannot download a customer's uploaded document files.
• In place: Your data is stored in Singapore (Google Cloud region asia-southeast1). It is not stored in Saudi Arabia.
• In progress: Each uploaded document is given a retention date 365 days after it is saved. Nothing yet deletes a document when that date passes, and retention periods for other data are still being defined.
• In place: Accounts that were started but never confirmed by email are deleted automatically after 30 days, together with the data attached to them. Accounts that were confirmed are not deleted automatically.

Annex 2 – Sub-processors

Taken from the same list as the public Trust page. The list was built from a code search, not from contracts or invoices.