Data Processing Agreement

Protected requests are authenticated and authorised. Important business operations are recorded in the audit trail.

Haviqo processes personal data on behalf of the Controller for the duration of the subscription agreement and for any legally required retention period thereafter. The subject matter is the provision of the Haviqo platform services as described in the Terms of Service.

Haviqo processes the following categories of personal data for the following purposes:

• Process personal data only on documented instructions from the Controller (as set out in the Terms of Service and this DPA).
• Ensure that persons authorised to process personal data are bound by confidentiality obligations.
• Implement appropriate technical and organisational security measures (see Section 7).
• Not engage sub-processors without prior written authorisation from the Controller (see Section 5).
• Assist the Controller in responding to data subject rights requests within the timeframes required by UAE PDPL and GDPR.
• Notify the Controller without undue delay (and within 72 hours) upon becoming aware of a personal data breach, as required by UAE PDPL Article 17.
• Delete or return all personal data to the Controller upon termination of the agreement (see Section 10).
• Make available all information necessary to demonstrate compliance with this DPA and allow for audits (see Section 11).

Haviqo currently uses the following approved sub-processors:

Haviqo will notify the Controller at least 30 days before adding or replacing a sub-processor. The Controller may object within 14 days.

Upon receiving a data subject rights request that relates to data processed by Haviqo on behalf of the Controller, Haviqo will promptly notify the Controller and provide reasonable assistance to enable the Controller to respond within the applicable deadline (15 days under UAE PDPL; 30 days under GDPR).

Haviqo implements the following technical and organisational measures, consistent with the requirements of UAE PDPL Article 11 and GDPR Article 32:

• HTTPS protection in transit and provider-managed protection at rest under the active hosting configuration.
• Multi-tenant row-level isolation enforced at the application and database layers.
• Role-based access control (RBAC) with principle of least privilege.
• Immutable audit logs for all data access and modification events.
• Regular penetration testing and vulnerability assessments.
• Incident response plan with defined escalation procedures.

In the event of a personal data breach, Haviqo will notify the Controller without undue delay and within 72 hours of becoming aware of the breach (UAE PDPL Article 17). The notification will include: (a) the nature of the breach; (b) categories and approximate number of data subjects affected; (c) categories and approximate number of records affected; (d) likely consequences; (e) measures taken or proposed to address the breach.

The Controller remains responsible for notifying the UAE Data Office within 72 hours and affected data subjects as required by UAE PDPL Article 14.

Core personal data is hosted in the European Union (Frankfurt, Germany) by Supabase (database, authentication, storage) and Render (backend API). Certain sub-processors are in the United States: Vercel Inc. (frontend hosting), Resend via Amazon SES (transactional email), Upstash (rate-limiting), and Groq Inc. (AI processing). Transfers to US-based sub-processors are governed by each provider's contractual terms and data processing agreements, being formalised under UAE Federal Decree-Law No. 45 of 2021 (PDPL). The Processor ensures that each sub-processor is bound by data protection obligations at least equivalent to those of this Agreement. The current list of sub-processors is set out in Section 5.

Upon termination of the subscription, Haviqo provides a separate 30-day export window. Tenant data then follows a 90-day deletion lifecycle. Document Templates content is subject to any active tenant-scoped legal hold; V6.1B does not activate an automated purge scheduler and execution remains service-controlled.

The Controller may, upon 30 days’ written notice and at its own cost, conduct an audit of Haviqo’s processing activities covered by this DPA, or commission a qualified third-party auditor to do so. Haviqo will cooperate fully with such audits and provide access to relevant documentation.

This DPA is governed by the laws of the United Arab Emirates. Disputes shall be resolved in accordance with the dispute resolution clause in the Terms of Service.