Data Processing Addendum

1. Roles of the parties

In respect of Customer Data (as defined in the Terms), you (the Customer) act as "controller" (or equivalent under applicable data-protection law) and SDV-FZ acts as "processor". Where applicable law treats you as a joint controller with an end-customer, this Addendum applies mutatis mutandis to the processing we perform for you.

2. Scope and instructions

We will process Customer Data only (a) to provide the Service described in the Terms, (b) as further instructed by you in writing from time to time, and (c) as required by applicable law. We will notify you if we believe an instruction breaches data-protection law.

3. Sub-processors

You consent to our use of the sub-processors listed in the Privacy Policy. We will give you reasonable prior notice of any new sub-processor. You may object on reasonable data-protection grounds; if the objection cannot be resolved, you may terminate the affected portion of the Service.

We remain responsible for each sub-processor's acts and omissions to the same extent we would be responsible if we performed the service ourselves, subject to the limitation of liability in the Terms.

4. Staff and confidentiality

We will ensure that personnel authorised to process Customer Data are bound by obligations of confidentiality and have received appropriate training on data protection and security.

Support access. Our support personnel may open your workspace only through a named, time-boxed support session that records who opened it and why. Support sessions are read-only by default and expire automatically within 60 minutes; write access requires a separate, separately recorded grant. Every support session, and every area it touched, is shown to you in your own workspace under Settings, Security and access, where you can end an active session immediately. We do not sign in as your users.

5. Security measures

We implement and maintain technical and organisational measures appropriate to the risk, including encryption in transit (TLS) and at rest, access controls and least-privilege, role-based authorisation, audit logging on sensitive actions, secure software-development practices, regular backups, vulnerability management, rate limiting, and incident response procedures. These measures evolve as the state of the art evolves; we may substitute measures that provide an equivalent or higher level of protection.

6. Personal data breach

We will notify you without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach affecting Customer Data. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We will support you in fulfilling your own notification obligations where applicable.

7. Data subject requests

Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures to respond to data subject requests to exercise their rights under applicable law. You are responsible for responding to such requests; we will provide reasonable assistance at no additional charge for the tooling we already offer in-app.

8. Audits

We will make available to you information reasonably necessary to demonstrate our compliance with this Addendum, including summary security reports and responses to reasonable written questionnaires. On-site audits may be conducted not more than once per 12-month period, on 30 days' prior notice, during business hours, at your cost, and subject to confidentiality and security restrictions. In lieu of on-site audits we may provide third-party attestations (e.g. SOC reports) where available.

9. International transfers

Where we transfer Customer Data internationally, we rely on the mechanisms described in the Privacy Policy (EU SCCs, UK IDTA, or equivalent). You authorise such transfers for the purpose of providing the Service.

10. Return and deletion

On termination or expiry of the Service, we will — at your choice — return or delete Customer Data in accordance with the 30-day grace period in the Terms, save where retention is required by law.

11. Liability

Our aggregate liability under this Addendum, together with our aggregate liability under the Terms, is subject to and capped by the Limitation of Liability clause in the Terms. Nothing in this Addendum establishes a separate or additional liability cap.

12. Precedence and governing law

In the event of conflict between this Addendum and the Terms, the Addendum prevails solely in respect of the processing of Customer Data. The Addendum is governed by the same law and dispute-resolution clauses as the Terms.