Data Processing Agreement
Arabic is the legally binding version per Saudi law.
Effective date and last reviewed: 12 September 2026 / ١٢ سبتمبر ٢٠٢٦
This agreement applies when Asas Albahth Commercial Limited Company processes personal data for a business subscribed to Jabr. It supplements the Terms and Privacy Policy.
1. Roles and Scope
The business is controller and Jabr is processor for personal data the business places in its workspace. Processing includes hosting, organizing, retrieving, calculating, exporting, support, and requested synchronization for the service term and applicable retention periods.
2. Controller Instructions
- Jabr processes data under the Terms, user settings, and documented lawful requests.
- The controller is responsible for a lawful basis, required notices and consents, data accuracy, and authorization of its users and connected apps.
- Health, biometric, genetic, or other sensitive data must not be entered unless Jabr expressly supports it and the controller has a lawful necessity.
3. Jabr Obligations
- Limit processing to purpose and instructions and bind authorized personnel to confidentiality.
- Apply appropriate technical and organizational measures and reasonably assist with data-subject requests, impact assessments, and security duties.
- Notify the controller without undue delay after becoming aware of an incident affecting its data and provide available information needed for the controller's obligations.
- Not use workspace data to train models owned by Jabr.
4. Sub-processors and Connectors
The controller authorizes the service-provider categories in the Privacy Policy. Jabr imposes protections appropriate to their role and remains responsible for its contractual duties. Jabr announces material changes in the manner and period required by law or contract. Services the controller chooses to connect may act as independent controllers and are not always Jabr sub-processors.
5. International Transfers
Transfers may occur to the locations and categories described in the Privacy Policy, subject to applicable legal requirements and safeguards. Built-in AI, speech, and user-selected connectors may transfer data outside the Kingdom as disclosed and scoped.
6. Return, Deletion, and Retention
At service end, Jabr provides reasonable export tools or assistance, then deletes or de-identifies data when no longer needed, except where law or legal claims require retention. Commercial-book and VAT periods differ by record type as described in the Privacy Policy.
7. Compliance Information and Audit
Jabr provides reasonable information to demonstrate compliance. A necessary audit must be scoped, reasonably noticed, protect other customers' confidentiality and security, and avoid service disruption; unusual audit costs may be borne by the business.
Official Legal References
The following official sources were reviewed on 12 September 2026. The official source controls if the law changes.