Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between the Customer identified in the applicable OAVOS agreement ("Customer") and Ollen Group FZCO ("OAVOS") governing Customer's use of OAVOS (the "Agreement").

1. Scope and roles

This DPA applies where OAVOS processes personal data on behalf of Customer in connection with the Service. For such processing, Customer acts as controller or processor, as applicable, and appoints OAVOS as processor or subprocessor. OAVOS remains an independent controller for personal data it processes for its own account administration, security, billing and legal obligations.

2. Applicable Data Protection Law

"Applicable Data Protection Law" means privacy and data-protection law applicable to the processing, including the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and, where applicable to a particular processing activity, GDPR, UK GDPR or other mandatory privacy law.

3. Processing instructions

OAVOS will process Customer Personal Data only on documented instructions from Customer, including instructions contained in the Agreement, Customer configuration and authorized use of the Service, unless processing is required by applicable law. OAVOS may notify Customer if it reasonably believes an instruction violates Applicable Data Protection Law.

4. Customer responsibilities

• Provide lawful instructions and ensure an appropriate legal basis for Customer Personal Data.
• Provide required notices and obtain consents where required.
• Use reasonable data minimization and appropriate account/permission configuration.

5. Confidentiality

OAVOS will ensure that persons authorized to process Customer Personal Data are subject to appropriate confidentiality obligations and access the data only as needed for their role.

6. Security

OAVOS will maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, taking into account the nature of processing and the risks involved. Current measures are summarized in Schedule 2.

7. Subprocessors

Customer authorizes OAVOS to engage subprocessors to provide the Service. OAVOS will impose appropriate data-protection obligations on subprocessors. OAVOS maintains a list of core subprocessors and will provide Customers with information about additional feature-specific subprocessors applicable to their use of the Service. Where an enterprise agreement provides for advance notice or objection rights, those agreed procedures apply.

8. International transfers

Where Customer Personal Data is transferred across borders and Applicable Data Protection Law restricts the transfer, the parties will use a lawful transfer mechanism and appropriate safeguards. OAVOS core production infrastructure is hosted in the European Union; subprocessors may process data in other countries as described in applicable provider information and the subprocessor schedule.

9. Data subject requests

Taking into account the nature of processing, OAVOS will provide reasonable assistance to Customer with requests by individuals to exercise rights under Applicable Data Protection Law. If OAVOS receives a request concerning Customer-controlled data, OAVOS may direct the requester to Customer unless law requires OAVOS to respond directly.

10. Security incidents

OAVOS will notify Customer without undue delay after becoming aware of a confirmed personal-data breach affecting Customer Personal Data where notification is required by Applicable Data Protection Law or the Agreement. OAVOS will provide information reasonably available about the nature, impact and mitigation of the incident.

11. Assistance and compliance

OAVOS will provide reasonable information necessary to demonstrate compliance with this DPA and reasonable assistance with data-protection impact assessments or regulator consultations where the processing performed by OAVOS makes such assistance necessary.

12. Audits

Customer may request reasonable audit information no more than once per year unless required following a material security incident or by a regulator. OAVOS may first satisfy the request using current reports, questionnaires or documentation. Any further audit must be reasonably scoped, protect other customers and confidential information, and avoid unnecessary disruption.

13. Return and deletion

At termination, OAVOS will delete or return Customer Personal Data in accordance with the Agreement, available export functionality and applicable retention obligations. OAVOS may retain data required by law, billing, security, backup cycles or legal claims, subject to continuing protection.

14. Government requests

Where legally permitted, OAVOS will notify Customer of a binding government request for Customer Personal Data before disclosure and will disclose only what OAVOS is legally required to provide.

15. Liability and precedence

The liability provisions of the Agreement apply to this DPA unless mandatory law requires otherwise. If this DPA conflicts with the Agreement regarding processing of Customer Personal Data, this DPA controls for that subject.

Schedule 1 - Processing details

Schedule 2 - Security measures

• Access controls and logical segregation appropriate to the Service.
• Encryption in transit and, where appropriate, at rest.
• Secure credential and secret management.
• Logging, monitoring and incident response processes.
• Backup and recovery measures appropriate to the production environment.
• Secure development, change-management and vulnerability-management practices.
• Personnel access controls and confidentiality obligations.

Schedule 3 - Subprocessors

The current OAVOS Subprocessor List identifies core subprocessors. Additional feature-specific subprocessors applicable to Customer use are available through OAVOS legal/trust documentation or on request and are subject to the notification rights agreed with Customer.