Data Processing Agreement

Last updated: [[TODO: date the legal texts were last updated (YYYY-MM-DD)]]

1. Parties, scope and precedence

• This agreement is between the Customer as controller and [[TODO: legal entity name in English]] ("Sanadat", "we" or "us") as processor, and it is an annex to, and part of, the Terms of Service.
• It applies to the personal data that the Customer enters into the service or that is collected about the Customer while using it, and that Sanadat processes on the Customer's behalf ("Customer Data").
• Account, subscription and payment data, technical logs and the security log are controlled by Sanadat as controller, and are governed by the Privacy Policy.
• If this agreement conflicts with the Terms of Service on the processing of personal data, this agreement prevails.
• "Controller", "processor", "data subject" and "personal data" have the meaning given by the Personal Data Protection Law and its Implementing Regulations. [[TODO: counsel to confirm the citation of the Personal Data Protection Law and its Implementing Regulations]]

2. Subject matter, duration, nature and purpose of processing

The details of the processing are set out in Annex A. In short: its subject is providing the e-invoicing service to the Customer; its duration is the period the Customer uses the service, followed by the export and legal retention period; its nature is storing invoice data, signing it, submitting it to ZATCA, displaying it and exporting it; and its purpose is to enable the Customer to issue its invoices and meet its e-invoicing obligations.

3. Documented instructions

• We process Customer Data only on the Customer's documented instructions, which are this agreement, the Terms of Service, and the Customer's use of the service's features (such as issuing an invoice, exporting data or deleting it).
• We do not process Customer Data for our own purposes.
• We tell the Customer if we believe an instruction breaks the law.
• If the law requires us to process the data in another way, we tell the Customer before we do so, unless the law prohibits it.

4. Confidentiality

We bind our personnel who have access to Customer Data to keep it confidential, and we limit access to those who need it to provide the service. [[TODO: operator to confirm that confidentiality undertakings are in place for everyone with access]]

5. Security

We apply the technical and organisational measures described in Annex B to protect Customer Data, and we update them without lowering the level of protection.

6. Sub-processors

• The Customer gives a general authorisation to use sub-processors. The current list is in Annex A.
• We notify the Customer of any addition or replacement in the app or by email at least [[TODO: notice period for new sub-processors]] beforehand. The Customer may object within that period on reasonable data-protection grounds, and if we cannot agree, the Customer may end the service and export its data.
• We bind each sub-processor to data-protection obligations no less protective than this agreement, and we remain responsible to the Customer for its performance.
• ZATCA is not our sub-processor: we send invoices to it on the Customer's instructions and to meet the Customer's legal obligations. [[TODO: counsel to confirm how ZATCA's role should be described]]

7. Help with data-subject requests and legal obligations

• We help the Customer, by appropriate technical and organisational means, to respond to data-subject requests such as access, correction and destruction. The export tools in the app let the Customer obtain its data.
• If a data subject contacts us directly about Customer Data, we refer them to the Customer and do not answer on the substance except on the Customer's instructions.
• We help the Customer, given the nature of the processing and the information available to us, with impact assessments and with dealings with the competent authority where needed.

8. Notifying a personal data breach

• We notify the Customer without undue delay, and within [[TODO: counsel to confirm the notification period]], after we become aware of a personal data breach affecting Customer Data.
• The notice includes what we know about the nature of the breach, the categories of data and approximate number of people affected, the likely consequences, and the measures taken or proposed, and we provide updates as we learn more.
• We cooperate with the Customer in meeting its duties to notify the competent authority and data subjects.

9. International transfers

The current hosting location is [[TODO: hosting country and region in English]]. We do not transfer Customer Data outside the Kingdom except as the controls set by law allow. [[TODO: hosting decision pending; counsel to confirm the lawful mechanism for any transfer outside the Kingdom under the Personal Data Protection Law and its transfer regulations]]

10. Return and deletion on termination

• When the service ends or the account is closed, the Customer can export its data (invoices as XML in a zip file, and CSV files) for [[TODO: length of the read-only export period after closure]].
• After that we delete Customer Data or make it anonymous, except what the law requires us to keep, such as invoice records for the legal period. [[TODO: counsel to confirm the retention period required by VAT law and ZATCA e-invoicing rules]] What we keep, we protect and process only for that purpose.
• Signing keys and ZATCA connection credentials are deleted when the account is closed, and backups expire when their retention cycle ends. [[TODO: operator to confirm deletion of signing keys and credentials on closure, and the backup retention period]]

11. Audits

• We give the Customer the information needed to show that we comply with this agreement.
• On reasonable prior notice, the Customer may request an audit or review of our compliance with this agreement, provided it does not disrupt the service, does not expose other customers' data or the encrypted secrets, and is kept confidential. [[TODO: counsel to confirm audit scope, frequency, notice and cost allocation]]

12. Liability

The liability provisions and limits in the Terms of Service apply to this agreement.

13. Term and governing law

This agreement takes effect when the Customer accepts the Terms of Service and remains in force for as long as we process Customer Data. It is governed by the laws of the Kingdom of Saudi Arabia and by the jurisdiction set out in the Terms of Service. [[TODO: counsel to confirm whether a separate signature or acceptance of this agreement is required]]

Annex A: Details of the processing

Annex B: Technical and organisational measures

Data isolation

• Each company's data lives in its own separate database file.
• The company is determined from the authenticated session alone, never from client input, and the default is to deny access unless the user is signed in and tied to a company.

Encryption and key protection

• Signing keys and ZATCA connection credentials are encrypted with per-company data keys, using authenticated encryption (AES-256-GCM).
• Data keys are protected by a master key kept outside the database and its backups, and the ciphertext and its wrapped key are stored in two different files.
• Signing keys are not available for download, and secrets are never written to logs.
• The service is reached over HTTPS only.

Authentication and access control

• Email confirmation at sign-up, and only a password hash is stored.
• Sign-in attempts are rate limited, and an account is locked temporarily after repeated failed attempts.
• Other sessions end when a password is changed or reset.
• The session cookie carries the HttpOnly, Secure and SameSite attributes, and requests that change data are protected against request forgery.

Backup and continuity

• Databases are replicated continuously off the server. [[TODO: backup retention period, per the replication configuration]]
• [[TODO: operator to confirm that a restore drill has been run against the production backup store before launch]]

Operational and physical security

• [[TODO: operator to describe administrative access controls, staff access to production, patching and incident response]]
• Physical security of the data centres is provided by the hosting provider. [[TODO: operator to confirm the hosting provider's security certifications]]