Data Processing Agreement

Effective date: 1 May 2026 / 1 مايو 2026

This agreement is entered into between Asas Albahth Commercial Limited Company ("Processor" or "Jabr") and the User ("Controller") in accordance with the Saudi Personal Data Protection Law (PDPL).

1. Definitions

• Controller: The business entity subscribed to Jabr that determines the purposes and means of processing personal data
• Processor: Asas Albahth Commercial Limited Company, which processes data on behalf of the Controller
• Personal Data: Any information that directly or indirectly identifies a natural person
• Sub-processor: Any third party that processes data on behalf of the Processor

2. Scope of Processing

The Processor processes the following personal data: account data (name, email, phone), business data, financial data, and usage data. Processing purposes are defined exclusively in the Privacy Policy.

3. Processor Obligations (Jabr)

• Process data only on the Controller's documented instructions and within the scope of the service
• Not process data for any other purpose (including AI model training)
• Implement appropriate technical and organizational security measures (encryption, access control, backup)
• Not disclose data to third parties without prior authorization
• Ensure authorized personnel are bound by confidentiality
• Assist the Controller in responding to data subject requests under PDPL
• Notify the Controller of any security breach within 48 hours of discovery
• Delete or return data upon service termination (subject to legal retention obligations)
• Make available information necessary for the Controller to demonstrate compliance upon request

4. Controller Obligations (User)

• Ensure a valid legal basis exists for processing the personal data entered
• Obtain necessary consents from data subjects where required
• Inform Jabr of any changes affecting processing requirements
• Ensure the accuracy of data entered
• Not enter sensitive data as defined by PDPL (health data, biometric data, etc.) into the platform

5. Sub-processors

The Controller consents to the use of sub-processors listed in the Privacy Policy. The Processor shall:

• Notify the Controller of any addition or material change to the sub-processor list 30 days in advance
• Enter into data processing agreements with all sub-processors providing a level of protection no less than this agreement
• Remain liable to the Controller for the acts of sub-processors

6. International Data Transfers

Data is processed primarily in the Middle East region (Google Cloud me-central1). Jabr does not transfer your data outside the Middle East region on its own. If you connect an external AI account to your books via the MCP connector, data related to your queries is sent to whichever AI provider you use (which may be outside the Middle East region). This transfer is at your own initiative under the provider's terms of service.

7. Audit

The Controller (or its appointed auditor) may request sufficient information to verify the Processor's compliance with this agreement, subject to 30 days prior notice and without disrupting operations.

8. Duration and Termination

This agreement remains in force for the duration of the subscription. Upon termination, the Processor shall delete or return all personal data within 90 days, except data required to be retained by law.