ملحق معالجة البيانات

1. Roles and scope

For processing carried out on the Customer's behalf, the Customer determines the purposes and means of processing and acts as controller, and EMteja acts as processor, except where applicable law or the actual activity makes a party a controller in its own right. EMteja processes that personal data on the Customer’s behalf and not for its own purposes.The subject matter, duration, nature and purpose of processing, data types and data-subject categories are those reasonably necessary to provide the services and described in the agreement or service documentation.

2. Customer instructions and obligations

The Customer is responsible for having a lawful basis to provide personal data to EMteja, providing required notices, ensuring instructions are lawful, and responding to data-subject requests except to the extent EMteja must respond directly by law.

3. EMteja obligations

EMteja will process personal data on documented instructions, unless required otherwise by law; ensure persons authorised to process it are subject to confidentiality duties; implement appropriate technical and organisational security measures; reasonably assist the Customer with data-subject requests, security obligations and impact assessments taking account of the nature of processing; and notify the Customer without undue delay after becoming aware of a personal-data breach affecting data processed under this DPA, providing information reasonably available.

4. Security measures

EMteja maintains security measures appropriate to the nature, scope and risks of processing. Relevant measures may include access controls, encryption, monitoring, vulnerability management, backup and incident response. The measures applicable to the service are described in the Security Schedule or other agreed documentation. No security measure guarantees that every incident will be prevented.

5. Sub-processors

The Customer authorises EMteja to use sub-processors reasonably necessary to provide the services. EMteja will impose data-protection obligations appropriate to the processing and remains responsible to the Customer for its sub-processors to the extent required by applicable law and the agreement. EMteja will provide notice of intended material additions or replacements by the agreed notification method or, where no method is agreed, by updating the published list and notifying the Customer where required by applicable law. The Customer may raise a good-faith, reasoned objection on data-protection grounds; the parties will work in good faith to address it.

6. International transfers

EMteja will make international transfers of personal data only in accordance with applicable law and any data-residency requirements applicable to the relevant service. The Customer acknowledges that competent authorities may access or require disclosure of data where authorised by law.

7. Return and deletion

After termination or expiry, EMteja will, on the Customer's written request and subject to the agreement, applicable law, technical feasibility and applicable retention obligations, return or delete personal data within a reasonable period. EMteja may retain copies where required by law or for legitimate security, audit, backup or dispute purposes, subject to appropriate protection and deletion under its retention cycle.

8. Audit and compliance information

On reasonable written request, EMteja will make available information reasonably necessary to demonstrate compliance with this DPA. Any audit must be agreed in advance, occur during normal business hours, protect confidential information and other customers, avoid unreasonable disruption, and not require disclosure of security-sensitive information beyond what is reasonably necessary. The Customer bears its audit costs unless otherwise agreed or required by law.

9. Order of precedence and law

If this DPA conflicts with the signed service agreement on data-processing matters, this DPA prevails to the extent of the conflict, unless the parties expressly agree otherwise in writing. Governing law and dispute resolution are as stated in the signed service agreement, subject to mandatory applicable data-protection law.

Contact: support@infocustechnologiesllcfz.com Infocus Technologies L.L.C-FZ (identified as EMteja) The Meydan Hotel, Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.

Website: https://emteja.com