Data Processing Addendum

1.Parties and scope

This Data Processing Addendum ("DPA") applies between ALAbrish Technologies FZCO, of Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates, acting as processor, and the Customer, acting as controller, whenever we process personal data on the Customer's behalf under the Terms of Service.

It supplements the Terms of Service. If a term here conflicts with the Terms of Service on a data-protection matter, this DPA prevails.

2.Roles and instructions

The Customer determines the purposes and means of processing and warrants it has a lawful basis for the data it loads and the messages it sends. We process personal data only on the Customer's documented instructions, which include the configuration chosen in the platform and the use of its features.

We will tell the Customer if, in our opinion, an instruction infringes applicable data-protection law, and we may decline to act on it until it is resolved.

3.Subject matter of processing

• Subject matter: provision of the ALAbrish omnichannel messaging platform.
• Duration: the term of the Customer's subscription, plus the deletion period in the Retention section.
• Nature and purpose: receiving, routing, storing, analysing and delivering customer conversations and campaigns.
• Categories of data subject: the Customer's end customers, prospects, and the Customer's own users and agents.
• Categories of personal data: names, phone numbers, channel handles and profile identifiers, email addresses, message content and attachments, opt-in and opt-out status, segments and tags, and interaction metadata.
• Special category data: not requested or required. The Customer should not upload it, and does so at its own risk and responsibility.

4.Confidentiality and personnel

We limit access to personal data to staff who need it to deliver or support the service, bind them to written confidentiality obligations that survive the end of their engagement, and train them on their data-protection responsibilities.

5.Security measures

• Encryption of data in transit using TLS, and of data at rest using industry-standard algorithms.
• Role-based access control with least privilege, and audit logging of administrative actions.
• Network segmentation, managed secrets, and restricted production access.
• Continuous monitoring, alerting and routine backup with tested restoration.
• Secure development practices, dependency review and change control.

6.Sub-processors

The Customer gives general authorisation for us to engage sub-processors, which currently include our cloud hosting, database, storage and content delivery providers, the messaging channel providers required to send and receive messages, our AI model provider for assistant features, and our payment provider.

Each sub-processor is engaged under written terms imposing protection no less onerous than this DPA, and we remain liable for their performance. We will give the Customer at least 30 days' notice before adding or replacing a sub-processor, and the Customer may object on reasonable data-protection grounds; if we cannot resolve the objection, the Customer may terminate the affected service without penalty.

7.International transfers

Personal data may be processed outside its country of origin, including in the European Economic Area and the United States. Where it is, we rely on an adequacy decision, standard contractual clauses, or another lawful transfer mechanism, supported by encryption in transit and at rest.

8.Assistance to the Customer

• We will promptly forward any data-subject request we receive that relates to the Customer's data, and will not respond to it ourselves except to confirm it has been forwarded.
• We will provide reasonable assistance with data-subject requests, data-protection impact assessments and consultations with supervisory authorities, taking into account the nature of processing and the information available to us.
• Where the platform provides self-service export, correction or deletion, using those features is the fastest route and is deemed sufficient assistance.

9.Personal data breach

We will notify the Customer without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach affecting the Customer's data. The notification will describe the nature of the breach, the categories and approximate number of records affected so far as known, the likely consequences, and the measures taken or proposed. We will cooperate with the Customer's own notification obligations.

10.Audit

On reasonable written request, and no more than once in any 12 months unless required by a supervisory authority or following a breach, we will make available the information necessary to demonstrate compliance with this DPA. We may satisfy this through documentation, a completed security questionnaire, or a third-party report. On-site audits require reasonable notice, must not disrupt operations, and are subject to confidentiality.

11.Retention, return and deletion

We retain personal data for the term of the subscription. On termination, the Customer may export its data for 30 days. We will then delete or return it within 90 days of termination, except where retention is required by law. Backup copies are purged on their own cycle, which may extend deletion by a short, bounded interval, during which the data remains protected by this DPA.

12.Liability and execution

Liability under this DPA is subject to the limitations and exclusions in the Terms of Service.

This DPA is incorporated by reference into the Terms of Service and applies automatically to every customer; no signature is required. If your procurement process needs a countersigned copy, email ceo@alabrishtechnologies.com and we will arrange it.