Data Processing Addendum

1. Subject matter and duration

The subject matter is the provision of DATA platform services to the customer. Processing continues for the term of the master agreement and order form and ends with it, subject to the deletion and return provisions.

2. Nature and purpose of processing

• Hosting and storing data inside an isolated workspace.
• Processing uploaded data or data connected through authorised connectors.
• Producing dashboards, reports, analytics and AI outputs under customer instruction.
• Technical and operational support.

3. Categories of personal data

• Identification and work contact data.
• Employment and organisational data.
• HR data as connected or uploaded by the customer.
• Finance and commercial data as connected or uploaded by the customer.
• Usage and security log data.
• Any further category specified by the customer in the order form.

4. Categories of data subjects

• Customer employees and contractors.
• Customer clients and contacts.
• Workspace users.
• Any further category specified by the customer.

5. Roles of the parties

The customer is controller of its personal data and DATA is processor acting on its behalf under its documented instructions, subject to the cases where DATA acts as controller as described in the privacy policy.

6. Customer instructions

• Workspace configuration and use of the service constitute processing instructions from the customer.
• Additional instructions are given in writing by the customer's authorised contact.
• DATA will inform the customer if it considers an instruction to conflict with applicable law.

7. Confidentiality

DATA personnel access is limited to those who need it to perform their duties, is subject to confidentiality obligations, and operational access to customer data is logged.

8. Security measures

The measures described in the security statement apply and are updated as the service and risk assessment evolve.

• Access control and authentication
• Role-based permissions
• Tenant isolation at the database layer
• Encryption in transit
• Encryption at rest
• Audit logging of sensitive events
• Secret and key management
• Data export restrictions

9. Subprocessors

• The customer authorises the use of vetted subprocessors to deliver the service.
• The approved list is published on the subprocessors page.
• DATA undertakes to impose equivalent protection obligations on each subprocessor.
• The customer is notified of material changes as agreed between the parties.

10. International transfers

Processing, hosting or support may take place outside the Kingdom only where necessary and after applying the required regulatory, contractual and technical controls. Hosting regions: Data may be processed or hosted inside or outside the Kingdom of Saudi Arabia depending on customer configuration, the nature of the service and approved service providers, in line with applicable regulations and contractual obligations.. Transfer mechanism: Appropriate contractual and technical safeguards apply to any processing or transfer of data outside the Kingdom..

11. Assistance with data subject rights

DATA provides reasonable assistance to the customer in responding to data subject requests, through platform tools or support where needed. Responding to data subjects remains the customer's responsibility as controller.

12. Incident notification cooperation

DATA will notify the customer without undue delay after becoming aware of a personal data incident affecting customer data and provide the available information to enable the customer to meet its obligations.

13. Deletion or return of customer data

On termination of the service, customer data is deleted or returned as the customer requests within the agreed periods, taking account of backup cycles and legal obligations.

14. Audit rights

DATA provides the reasonable information needed to demonstrate compliance with this addendum. Any on-site audit is arranged in advance with an agreed scope and without compromising the security of other customers' data.

15. Contact points

DATA contact

info@data.sa

Customer contact

Specified in the order form.

16. Priority with the master agreement

This addendum supplements the master agreement and the order form with the customer; that agreement prevails in the event of conflict unless agreed otherwise in writing.