Data processing agreement

1. Subject of processing

• Nature and purpose: providing the platform to the customer (hosting, storage, calculation, display, reports, drafts and reminders).
• Duration: the subscription, then the export and deletion period in clause 9.
• Data subjects: the customer's employees, managers and account users, and candidates if entered.
• Data categories: work identity and contact details, structure and jobs, objectives, KPIs and reviews, pay and bonuses, training and succession, uploaded documents, and anything else the customer enters.

2. Controller's instructions

The processor processes data only on the controller's written instructions; the terms, this agreement and the customer's use of the platform's settings are written instructions. The processor tells the controller if it believes an instruction breaks the law. The controller authorises use of assessment results in aggregated benchmark averages that identify no company or person and are shown only from 20 or more companies.

3. Confidentiality

Everyone at the processor with access to the data is bound to confidentiality, and access is limited to those who need it to provide the service or handle an incident.

4. Security measures

• Per-customer isolation at database level, with an application connection that cannot bypass it.
• Encrypted connections and hashed passwords, encrypted daily backups and regular service monitoring.
• Role-based access inside the customer's account, and an audit log the application cannot alter.
• The platform administration team cannot sign in as a customer user or see employee data.

5. Sub-processors

The controller approves the sub-processors listed on the "Sub-processors" page. The processor gives 30 days' notice before adding or replacing one; the controller may object on reasonable data protection grounds and, if no solution is found, end the subscription with a refund of the unused period. The processor binds every sub-processor to protection duties no weaker than this agreement and remains responsible to the controller for it.

6. Transfers abroad

The controller acknowledges that data is stored in Europe and may be processed in the United States (AI features), as the sub-processor list shows. The processor follows the transfer rules of Egyptian law (Articles 14–16, including a licence or permit from the Personal Data Protection Center) and Saudi law (Article 29 and the Regulation on Personal Data Transfer outside the Kingdom, including standard contractual clauses where they apply), and limits transfers to the minimum needed. Both parties cooperate on any assessment or licence the law requires of the controller.

7. Assisting the controller

• The processor helps the controller answer data subject requests (access, correction, deletion, copies); the platform lets the controller do most of these directly.
• The processor gives the controller the information it needs for impact assessments and the processing records the law requires.

8. Breach notification

The processor notifies the controller without delay, and within 48 hours of becoming aware at the latest, of any breach affecting the controller's data, with the available description of the incident, the data and approximate number of people affected, and the steps taken and proposed, updating it as more is known. This lets the controller meet the 72-hour deadline for notifying the authority in Egypt (Article 7) and in Saudi Arabia (Article 20 and its regulation).

9. Return and deletion

When the subscription ends, data stays available for export for 30 days; the processor then deletes it from the database within 30 days, and it drops out of backups within 30 days of deletion, unless the law requires it to be kept. This applies the processor's duty to erase data or return it to the controller when processing ends (Article 5 of the Egyptian law).

10. Records and audit

The processor keeps a record of the processing it carries out and, on reasonable request, gives the controller evidence of compliance with this agreement. Once a year, with 30 days' notice, the controller may request an audit of agreed scope that does not affect other customers' data or the platform's security.

11. Acceptance

This agreement is accepted together with the terms, and the acceptance is recorded (version, date, user and IP address). This page can be printed or saved as PDF; a customer needing a signed copy can write to us.