Data Processing Agreement

In short

• You are the controller of the business data you put into Tarleaks. We are your processor. We handle that data only to provide the service to you and on your instructions.
• Your data is yours. You can export it in machine-readable formats at any time.
• We keep your data confidential and protect it with appropriate technical and organisational measures.
• We use sub-processors only where needed. They are listed at https://tarleaks.com/security/. We tell you about changes, and you can object.
• If we become aware of a personal data breach affecting your data, we tell you without undue delay, and in any case within 72 hours.
• We help you to answer data subject requests, to carry out impact assessments and to work with regulators.
• We never delete your data automatically. When the agreement ends, you can export it, and we delete it only after written notice to you, except for records that the law requires us to keep.
• For our own account, billing and website data, we are a controller. That is explained in our Privacy Policy.

This Data Processing Agreement ("DPA") is between Tarleaks ("we", "us") and the customer who accepted our Terms of Service ("you"). It is accepted together with the Terms of Service and forms part of them.

1. Definitions and scope

1.1 In this DPA:

• Terms of Service means the Terms of Service you accepted when you created your workspace, together with the documents they refer to.
• Data Protection Laws means the data protection laws that apply to the processing of your personal data under this DPA. Depending on where you and your data subjects are, these may include Federal Decree-Law 45/2021 on the Protection of Personal Data (the "PDPL") in the United Arab Emirates, the data protection laws of the DIFC and ADGM where they are relevant, and the Personal Data Protection Law of the Kingdom of Saudi Arabia for customers in KSA.
• Customer Personal Data means personal data that you or your users put into the service, or that we process for you through the service.
• Controller, processor, data subject, personal data, processing and personal data breach have the meanings given in the Data Protection Laws that apply to you.
• Sub-processor means a third party that we engage to process Customer Personal Data on your behalf.
• Account owner means the person who created your workspace or who was later named as owner.

1.2 This DPA applies to the hosted Tarleaks service. It applies to the self-hosted licence only for personal data that we access on your request, for example when you share a file with our support team.

1.3 Annex A describes the processing in more detail.

2. Our roles

2.1 For Customer Personal Data, you are the controller and we are the processor.

2.2 For the personal data of your account holders and billing contacts, and for visitors to our website, we are a controller in our own right. This DPA does not cover that data. It is covered by our Privacy Policy at https://tarleaks.com/privacy/.

2.3 You are responsible for the lawfulness of your use of the service. This includes having a valid legal basis for the personal data you put into the service, giving data subjects the notices they need (for example your employees) and keeping the data accurate.

3. Our instructions

3.1 We process Customer Personal Data only to provide the service to you, and in line with your documented instructions.

3.2 Your documented instructions are: the Terms of Service, this DPA, and the way you configure and use the service. You may give us further written instructions. We will follow them if they are reasonable and consistent with the service.

3.3 We will tell you if we believe an instruction breaches the Data Protection Laws. We may pause the instruction until you confirm or change it.

3.4 We do not sell Customer Personal Data. We do not use it for advertising, and we do not use it for any purpose of our own, except where the law requires it.

3.5 If a public authority asks us for Customer Personal Data, we will tell you first where the law allows, and we will disclose only what we are legally required to disclose.

4. Confidentiality and personnel

4.1 We keep Customer Personal Data confidential.

4.2 Only people who need access to the data to provide the service and support can have it. They are bound by written confidentiality duties.

4.3 Our staff access the content of your workspace only when needed, for example to answer a support request from you or to fix a fault, and only as far as needed for that purpose.

5. Security

5.1 We use appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, disclosure or access. We consider the nature of the data, the risks and the state of the art.

5.2 These measures include, at least:

• separation of each customer's data from other customers' data;
• access controls based on roles, with sign-in security for our staff and systems;
• encryption of data in transit;
• logging of access to systems that hold Customer Personal Data;
• regular backups and the ability to restore them; and
• confidentiality undertakings and security awareness for staff.

5.3 A summary of our security practices is published at https://tarleaks.com/security/. We may improve these measures over time. We will not reduce the overall level of protection.

5.4 You are responsible for the security of your own users: for example, choosing strong passwords, removing users who have left your business and giving each person only the access they need.

6. Sub-processors

6.1 You agree that we may use sub-processors to provide the service. The current list is published at https://tarleaks.com/security/.

6.2 We will update the list before a new sub-processor starts to process Customer Personal Data, and we will tell the account owner by e-mail or in the workspace.

6.3 You may object to a new sub-processor in writing, on reasonable data protection grounds, by writing to info@tarleaks.com. We will talk to you in good faith to find a solution. If we cannot find one, you may stop using the affected part of the service, or end the agreement, without penalty.

6.4 We bind each sub-processor by a written contract with data protection duties that are no less protective than this DPA. We remain responsible to you for what our sub-processors do.

7. Data location and transfers

7.1 The location of your data is as described in the Terms of Service. You may choose to have your data hosted by us. Where we have enabled it for your account, you may instead choose to use your own database.

7.2 Information about where Customer Personal Data is stored and which sub-processors handle it is published at https://tarleaks.com/security/.

7.3 We transfer Customer Personal Data outside the country where it was collected only where the Data Protection Laws allow it, and with the safeguards they require. Where the law of your country restricts transfers, please tell us, and we will work with you to find a compliant solution.

8. Helping you with data subject requests

8.1 Data subjects have rights under the Data Protection Laws. Depending on the law, these include access, correction, deletion, restriction, objection and portability.

8.2 If a data subject contacts us about Customer Personal Data, we will not answer the request ourselves. We will refer the person to you and tell you without undue delay.

8.3 We give you tools in the service to find, correct, export and delete personal data. If you need more help, we will help you, taking into account the nature of the processing. We may ask you to cover our reasonable costs if the help is substantial.

9. Personal data breaches

9.1 If we become aware of a personal data breach affecting Customer Personal Data, we will tell you without undue delay. We will do so in any case within 72 hours of becoming aware.

9.2 Our notice will go to the account owner. It will describe, as far as we know it: what happened, the categories and approximate number of data subjects and records affected, the likely consequences, and the steps we have taken or propose to take.

9.3 If we do not yet have all the information, we will give it to you in stages.

9.4 We will take reasonable steps to contain and fix the breach, and we will help you to meet your own duties to notify regulators and data subjects. Deciding whether and how to notify them is your responsibility as controller, unless the law requires us to notify directly.

10. Impact assessments and regulators

10.1 We will give you the information that we reasonably hold, and reasonable help, so that you can carry out data protection impact assessments and consult regulators where the Data Protection Laws require it.

10.2 We keep records of our processing activities as the Data Protection Laws require.

11. Export, return and deletion

11.1 You can export your data in machine-readable formats at any time while your workspace exists, including if it is in read-only mode or suspended for non-payment.

11.2 We never delete Customer Personal Data automatically. When the agreement ends, we keep your data and keep export available to the account owner. We delete it only after we have given the account owner(s) at least 14 days' written notice, after a person at Tarleaks has reviewed the account.

11.3 You may ask us in writing to delete your data earlier. We will do so once we have confirmed that the request comes from the account owner.

11.4 Once we delete data from the live service, copies in backups are removed in the normal backup cycle.

11.5 We may keep records that the law requires us to keep, for example invoices and tax records, for the legally required period. For tax records under UAE VAT rules this is 5 years. We protect those records under this DPA until they are deleted.

11.6 Section 7 of the Payment and Grace Period Policy sets out our promises on deletion if an invoice is unpaid. They apply in addition to this section.

12. Information and audits

12.1 On reasonable request, we will give you the information needed to show that we meet this DPA.

12.2 If that information is not enough, or if a regulator requires it, you may carry out an audit of our compliance with this DPA, or have an independent auditor do it. You must give us reasonable written notice, keep the audit confidential, carry it out in a way that does not disrupt our business, and not access other customers' data. You bear the cost of the audit.

12.3 We may satisfy an audit request, in whole or in part, by providing independent audit reports or certifications where we hold them.

13. Liability and order of precedence

13.1 The limits on liability in the Terms of Service apply to this DPA. Nothing in this DPA limits the rights of data subjects, or the powers of regulators, under the Data Protection Laws, or any liability that cannot be limited by law.

13.2 If this DPA conflicts with the Terms of Service about the processing of Customer Personal Data, this DPA prevails. In other matters, the Terms of Service prevail.

14. Term, governing law and language

14.1 This DPA starts when you accept the Terms of Service. It continues for as long as we process Customer Personal Data for you, including during the export and deletion steps in section 11.

14.2 This DPA is governed by the laws of the Emirate of Dubai and the federal laws of the United Arab Emirates applicable in it. The parties submit to the courts of Dubai, as set out in the Terms of Service.

14.3 This DPA is provided in English and Arabic. The language clause of the Terms of Service applies, so the Arabic version prevails if there is a difference.

14.4 We may update this DPA by giving you reasonable notice, as described in the Terms of Service, for example if the law changes. The latest version is always available at https://tarleaks.com/dpa/.

15. Contact

15.1 Questions about data protection and this DPA: info@tarleaks.com.

15.2 Formal notices: info@tarleaks.com, or United Arab Emirates.

Annex A. Details of the processing