Data Processing Addendum

1. Definitions

• “Data Protection Law” means the Personal Data Protection Law of the Kingdom of Saudi Arabia and its Implementing Regulations and regulations on transfers outside the Kingdom; the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data; and any other data-protection law that applies to the processing.
• “Customer Personal Data” means personal data within Customer Data that Zaps processes on the Customer's behalf.
• “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• “Sub-processor” means a third party engaged by Zaps to process Customer Personal Data.
• “Authority” means the competent data-protection authority, including the Saudi Data and Artificial Intelligence Authority (SDAIA) and the UAE Data Office.
• Other capitalised terms have the meanings given in the Terms.

2. Roles and scope

The Customer is the controller of Customer Personal Data and Zaps is its processor. Where the Customer itself acts as a processor for another controller, Zaps acts as its sub-processor, and the Customer is responsible for obtaining any authorisations required from that controller. This DPA does not apply to data Zaps processes as a controller, which is covered by our Privacy Policy.

3. Details of the processing

Subject matter and duration

The provision of the Service under the Terms, for the duration of the subscription and the data-export and deletion periods that follow it.

Nature and purpose

Hosting, storage, organisation, retrieval, synchronisation, transmission, display, analysis (including AI-assisted processing and transcription), backup and deletion of Customer Personal Data, for the purpose of providing, securing and supporting the Service for the Customer.

Data subjects

• The Customer's employees, contractors and other Authorised Users;
• the Customer's clients, prospects, suppliers and their contact persons;
• participants in meetings recorded or transcribed at the Customer's request;
• other individuals whose data the Customer chooses to put into the Service.

Categories of personal data

• Identity and contact data: names, job titles, email addresses, phone numbers, business card details;
• Employment data: department, role, reporting lines, attendance and check-in records, leave requests and balances, targets and commissions;
• Location data: precise device location during working hours or while checked in, with the user's consent;
• Communications: emails and calendar events of connected accounts, call and WhatsApp logs, notes, voice notes, meeting recordings and transcripts;
• Commercial data: deals, quotations, orders, invoices and related records;
• Technical data: device identifiers, IP addresses, push tokens and logs.

Sensitive data

The Service is not designed for processing sensitive personal data. Leave records may include health-related reasons or documents; the Customer will limit these to what is necessary and configure access accordingly.

4. The Customer's obligations

The Customer will: give only lawful instructions; ensure it has a lawful basis for the processing and has given the notices and obtained the consents required by Data Protection Law (including employees' consent for location features and participants' consent for meeting recordings where required); ensure the accuracy of Customer Personal Data; and carry out any data-protection impact assessments required of it as controller.

5. Zaps's obligations

Instructions

Zaps processes Customer Personal Data only on the Customer's documented instructions, which are the Terms, this DPA, and the Customer's configuration and use of the Service, unless the law requires otherwise (in which case Zaps will inform the Customer before processing, unless the law prohibits it). Zaps will tell the Customer if it believes an instruction infringes Data Protection Law.

Confidentiality

Zaps ensures that everyone authorised to process Customer Personal Data is bound by confidentiality and accesses it only as needed to provide the Service.

Security

Zaps implements and maintains the technical and organisational measures described in section 11, appropriate to the risks of the processing.

Sub-processors

The Customer gives Zaps general authorisation to engage Sub-processors in the categories listed in section 12. Zaps will impose on each Sub-processor data-protection obligations no less protective than this DPA and remains responsible for its Sub-processors' performance. Zaps will notify the Customer's administrators at least 30 days before adding or replacing a Sub-processor. The Customer may object on reasonable data-protection grounds within that period; the parties will then discuss the objection in good faith, and if it cannot be resolved, the Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the remaining period.

Data subjects' requests

Taking into account the nature of the processing, Zaps assists the Customer in responding to requests from data subjects to exercise their rights, including through the tools available in the Service (such as export, correction and deletion). If Zaps receives such a request directly, it will forward it to the Customer without undue delay and will not respond to it except on the Customer's instructions.

Impact assessments and consultation

Zaps provides reasonable assistance with data-protection impact assessments and any prior consultation with an Authority that the Customer is required to carry out in relation to the Service.

Personal Data Breaches

Zaps notifies the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Zaps provides further information as it becomes available and assists the Customer in meeting its own notification obligations, including notification to SDAIA within 72 hours where required.

Deletion and return

At the end of the subscription, the Customer may export Customer Personal Data for 30 days. Zaps then deletes it from its live systems and removes it from backups within a further 90 days, unless the law requires it to be retained, in which case Zaps continues to protect it and processes it only for that purpose.

Records and audits

Zaps keeps records of its processing activities as required by Data Protection Law and makes available to the Customer the information reasonably necessary to demonstrate compliance with this DPA, including summaries of independent security assessments where available. If that information is not sufficient, or where an Authority requires it, the Customer may carry out an audit, no more than once a year, with at least 30 days' written notice, during business hours, at its own cost, by an auditor bound by confidentiality, and without access to other customers' data.

6. International transfers

The Customer authorises Zaps and its Sub-processors to transfer Customer Personal Data outside the country where it was collected to the extent needed to provide the Service. Zaps will ensure that each transfer complies with Data Protection Law — including the Saudi regulations on transferring personal data outside the Kingdom and the UAE requirements for cross-border transfers — by relying on adequacy decisions or appropriate safeguards such as standard contractual clauses, carrying out transfer risk assessments where required, and transferring only the minimum data needed.

7. Requests from authorities

If Zaps receives a request from a public authority for Customer Personal Data, it will refer the authority to the Customer where possible, notify the Customer unless the law prohibits it, disclose only the minimum data legally required, and challenge requests it reasonably considers unlawful.

8. Liability

Each party's liability under or in connection with this DPA is subject to the exclusions and limitations of liability in the Terms, except where Data Protection Law does not allow liability to be limited.

9. Term

This DPA applies for as long as Zaps processes Customer Personal Data, and its obligations continue until that data has been deleted or returned.

10. Order of precedence and changes

In the event of conflict on matters of personal data, this DPA prevails over the Terms. Zaps may update this DPA to reflect changes in Data Protection Law or the Service, without reducing the overall level of protection, with notice as described in the Terms.

11. Security measures

• Encryption of data in transit (TLS) and at rest.
• Logical separation of each customer's data through row-level tenant isolation in the database.
• Multi-factor authentication for administrators; passwords stored with secure one-way hashing; session controls.
• Role-based access control within each workspace; least-privilege access for Zaps personnel, granted only when needed and logged.
• Audit logs of significant actions in each workspace; monitoring and alerting of production systems.
• Regular, encrypted backups and tested recovery procedures.
• Secure development practices, dependency and vulnerability management, and timely patching.
• Confidentiality obligations and security awareness for all personnel.
• An incident-response process for detecting, containing, investigating and notifying Personal Data Breaches.

12. Authorised sub-processor categories

• Cloud hosting, database and storage
• Email delivery (Resend)
• Payments (StreamPay)
• Artificial intelligence (Anthropic)
• Maps and geocoding
• Meeting note-taker (Recall.ai)
• Push notifications (Expo, Apple Push Notification service, Google Firebase Cloud Messaging)
• Bot protection on sign-up (Cloudflare Turnstile)

The current list of sub-processors, with their locations, is available from privacy@heyzaps.com.