Data Processing Addendum

This addendum applies where you use our service to process personal data about your own users, customers or staff. In that arrangement you are the controller and Drentova Group W.L.L is your processor. It forms part of our Terms of Service and takes effect automatically — you do not need to sign a separate copy, though we will countersign one on request to [email protected].

Where we determine the purposes of processing ourselves — for example your own account and billing data — we are the controller and our Privacy Policy applies instead.

We process Customer Personal Data to provide the service described in our Terms of Service, for as long as your account is active and for the retention period stated in our Privacy Policy afterwards. The categories of data subject and of personal data are determined by you, through what you choose to put into the service.

We will:

1. process Customer Personal Data only on your documented instructions, including as to transfers, unless required otherwise by law — in which case we will tell you first unless the law prohibits it;
2. ensure that people authorised to process it are bound by confidentiality;
3. take the technical and organisational measures set out below;
4. engage a subprocessor only under the conditions in the next section;
5. assist you, taking into account the nature of the processing, in responding to requests from data subjects exercising their rights;
6. assist you with data protection impact assessments and with any prior consultation or notification the PDPPL requires of you;
7. on termination, delete or return Customer Personal Data at your choice, and delete existing copies unless the law requires us to keep them;
8. make available the information needed to demonstrate compliance with this addendum, and allow and contribute to audits as set out below.

We take the measures below to protect personal data, as the Personal Data Privacy Protection Law requires. They are reviewed as the service changes, and we publish the current position in our Trust Centre rather than describing a state we hope to reach.

• Data in transit is encrypted using TLS. Data at rest is encrypted by our hosting and database providers.
• Access to production systems is restricted to the people who need it, protected by multi-factor authentication, and removed when it is no longer needed.
• Administrative access to customer data is limited to what is necessary to operate and support the service.
• Backups are taken by our database provider and restoration is tested.
• Changes to production go through review and automated checks before release.
• Third parties are assessed before they process personal data on our behalf, and are engaged under written terms that hold them to the standard the PDPPL requires of us.

No service can promise perfect security. If we become aware of a personal data breach we will assess it without undue delay, notify the competent authority as soon as the breach is found to be notifiable, and tell affected people directly where the breach is likely to result in a high risk to them.

You give general authorisation for us to engage the subprocessors listed below. We impose data protection obligations on each of them that are no less protective than those in this addendum, and we remain fully liable to you for their performance.

We will give at least 30 days’ notice before adding or replacing a subprocessor, by publishing the change here and notifying you by email if you have asked us to. If you have a reasonable objection on data protection grounds, tell us within that period; we will work with you to resolve it, and if we cannot you may terminate the affected part of the service without penalty and receive a refund for the unused period.

We are based in the State of Qatar and process personal data here wherever we can. Some of the providers we rely on operate outside Qatar.

Where personal data is transferred outside Qatar, we do so only on a basis the Personal Data Privacy Protection Law permits: the destination affords an adequate level of protection, the recipient is bound by contractual safeguards, you have given explicit consent, or a statutory exception applies. The basis applying to each provider is named in the subprocessor table, and we assess the risk of a transfer before relying on any of them.

You can ask us for a copy of the safeguards in place for a particular transfer by writing to [email protected].

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notification will describe the nature of the breach, the categories and approximate numbers affected, the likely consequences, and the measures taken or proposed. We will not notify your data subjects or a supervisory authority on your behalf unless you ask us to or the law requires it of us.

On reasonable notice, and no more than once in any twelve months unless a supervisory authority requires otherwise or a breach has occurred, you may audit our compliance with this addendum. In the first instance we will respond with our security documentation and a completed security questionnaire; where that is genuinely insufficient we will accommodate an audit, conducted during business hours, without unreasonable disruption, and subject to confidentiality. You bear your own costs.

Each party’s liability under this addendum is subject to the limitations in our Terms of Service, except where the PDPPL provides otherwise.