اتفاقية معالجة البياناتData Processing Agreement

This agreement forms part of the Terms of Service and applies automatically to any subscribing organization that enters personal data about its staff or others into the platform. No separate signature is needed. If you need a signed copy, ask at [email protected].

1. Parties and roles

The subscribing organization is the controller and determines the purpose and means of processing. Haykama, operated by Salem Jaafar Ababneh, Amman, the Hashemite Kingdom of Jordan is the processor. Terms carry the meaning given in Jordan's Personal Data Protection Law No. 24 of 2023.

2. Subject matter, duration and nature

• Subject matter: operating the Haykama platform for the controller.
• Duration: the subscription term, plus the deletion window in clause 9.
• Nature and purpose: storing operating model data, displaying it, generating documents from it, and backing it up.
• Data subjects: the controller's staff, its document approvers, its account users, and anyone named in its documents.
• Categories of data: name, job title, org unit, work email, and role in document approval. The platform does not ask for sensitive data.

3. Our obligations as processor

1. We process only on the controller's documented instructions. Using the platform is the instruction. If we consider an instruction unlawful we say so in writing.
2. Confidentiality: everyone with access is bound to confidentiality.
3. Security: we apply the measures set out in clause 7 of the Privacy Policy, which forms part of this agreement.
4. Data subject rights: we pass any request we receive directly to the controller and give technical help to answer it in time to meet the statutory deadline.
5. Breach notice: we notify the controller without undue delay and in any event within twenty-four hours of our discovery, with what they need to meet their own obligations.
6. Assistance: we give the controller the information we hold that it needs to assess the impact of processing or to answer the regulator.

4. Subprocessors

The controller consents to the providers listed in clause 5 of the Privacy Policy. We add a new one only on thirty days' prior notice. The controller may object within that period and may terminate without penalty if we cannot offer an alternative. Each subprocessor is bound to obligations no weaker than these, and we remain liable to the controller for their performance.

5. Cross-border transfer

Data is processed in Germany as set out in the Privacy Policy. For entities barred from letting data leave the Kingdom, the Sovereign self-hosted plan is available, and this agreement does not apply to it because the data never reaches us.

6. Audit

Once a year the controller may request information sufficient to demonstrate our compliance with this agreement, and we respond within thirty days. A controller whose own regulator requires an on-site audit may agree one with us in advance and in writing, at its cost, and without touching any other organization's data.

7. No secondary use

We do not use the controller's data for any purpose of our own: not to train models, not for cross-customer analysis, and not for marketing. Operational statistics we derive about the platform are aggregated and cannot be traced back to an organization or a person.

8. Liability

The limitations of liability in the Terms of Service apply to this agreement, without prejudice to the statutory rights of data subjects.

9. Deletion at the end

When the subscription ends: thirty days in which the controller can export everything, then deletion from live systems within a further thirty days, then from backups as their cycle expires. We provide written confirmation of deletion on request.

10. Governing law

The laws of the Hashemite Kingdom of Jordan, with the courts of Amman having jurisdiction.