Data Processing Agreement

1. Definitions

• "Controller" — the business operator who determines the purposes and means of processing personal data of customers and staff through the Platform.
• "Processor" — Alkfo, which processes personal data on behalf of and under the instructions of the Controller.
• "Personal Data" — any information relating to an identified or identifiable natural person processed through the Platform.
• "Data Subject" — the natural person to whom Personal Data relates (customers, business staff).
• "PDPL" — Saudi Arabia's Personal Data Protection Law (Royal Decree M/19 of 1443H) and its implementing regulations.

2. Subject matter and nature of processing

Alkfo processes Personal Data solely for the purpose of delivering the Platform services described in the Terms of Service, including:

• Receiving, routing, and storing customer orders.
• Processing payments and generating ZATCA-compliant e-invoices.
• Providing analytics and operational reporting to the Controller.
• Providing customer support at the Controller's request.

3. Types of personal data and data subjects

No special category data (health, biometric, etc.) is processed through the Platform. The Controller must not upload such data without prior written consent from Alkfo.

4. Controller obligations

The Controller warrants and undertakes that:

• It has a lawful basis under the PDPL (or other applicable law) for each processing activity performed through the Platform.
• It has provided Data Subjects with adequate privacy notices describing the use of the Platform.
• Its instructions to the Processor will at all times comply with applicable law.
• It will promptly notify the Processor of any Data Subject rights request that requires action on data held by the Processor.

5. Processor obligations

Alkfo commits to:

• Process Personal Data only on documented instructions from the Controller and not for any other purpose, unless required by applicable law.
• Ensure that personnel with access to Personal Data are bound by appropriate confidentiality obligations.
• Implement and maintain appropriate technical and organisational security measures (see Section 6).
• Assist the Controller in fulfilling obligations related to Data Subject rights (access, correction, deletion) to the extent technically feasible.
• Notify the Controller within 72 hours of becoming aware of a Personal Data breach affecting Controller data.
• Upon termination of the Terms, delete or return all Controller Personal Data within 30 days (financial records retained as required by ZATCA will be identified separately).

6. Security measures

Alkfo implements the following measures, which may be updated to reflect advances in technology:

• Encryption of Personal Data in transit (TLS 1.2+) and at rest (AES-256).
• Role-based access controls with principle of least privilege.
• Multi-factor authentication for Processor staff accessing production systems.
• Regular vulnerability assessments and penetration testing.
• Comprehensive audit logging of access to Personal Data.
• Business continuity and disaster recovery procedures.

7. Sub-processors

The Controller grants general authorisation to Alkfo to engage sub-processors. Current sub-processor categories include:

• Cloud infrastructure and hosting providers.
• Payment processing providers.
• Transactional email and SMS providers.
• Error monitoring and logging services.

We impose data protection obligations on sub-processors equivalent to those in this DPA. We will notify the Controller of any intended addition or replacement of a sub-processor with at least 14 days' notice, during which the Controller may object on reasonable grounds.

8. International transfers

Where Personal Data is transferred outside the Kingdom of Saudi Arabia by a sub-processor, Alkfo ensures that appropriate safeguards are in place as required by the PDPL, including contractual clauses that provide equivalent protection.

9. Audit rights

The Controller may, with 30 days' notice and no more than once per calendar year, request a summary of relevant audit reports or certifications to verify compliance with this DPA. On-site audits may be arranged by mutual agreement and are subject to reasonable cost-sharing.

10. Duration

This DPA remains in force for the duration of the Terms of Service and terminates automatically upon the effective termination of those Terms, subject to any retention obligations that survive termination.

11. Governing law

This DPA is governed by the laws of the Kingdom of Saudi Arabia, consistent with the Terms of Service.

12. Contact

For data protection enquiries, please contact:
support@alkfo.com