Data Processing Agreement

1. Parties and how this agreement applies

This agreement is between you, our client, as controller, and Business Opt L.L.C-FZ, trading as Business Opt, licence number 2653102.01, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E., as processor. It forms part of our Terms of Service and applies automatically whenever we process personal data on your behalf.

"UK GDPR", "personal data", "processing", "data subject" and "personal data breach" have the meanings given in the UK GDPR. "Data protection law" means the UK GDPR, the Data Protection Act 2018, and any other data protection law that applies to the processing, including UAE Federal Decree-Law No. 45 of 2021.

2. Details of the processing

• Subject matter and purpose: providing our local SEO, advertising, social media and website services to you.
• Duration: while we provide the services, and until the data is deleted or returned under section 10.
• Nature of the processing: collecting, storing, organising, analysing and publishing data, and replying to people, through the platforms and tools we use for you.
• Data subjects: your customers and enquirers, people who review your business, your staff and representatives, and visitors to websites we manage for you.
• Types of personal data: names, contact details, review and enquiry content, public profile names, and website analytics identifiers.
• Special category data: none intended. Please do not ask us to process it.

3. Your instructions

We process personal data only on your documented instructions, which are these terms, your package, and anything else you tell us in writing, including about transfers outside the UK. If the law requires us to process data in another way, we will tell you first unless the law forbids it. If we think an instruction breaks data protection law, we will tell you straight away.

4. Confidentiality

Everyone we authorise to process the data is bound by a duty of confidentiality.

5. Security

We take appropriate technical and organisational measures to protect the data, as required by Article 32 of the UK GDPR, including:

• encryption of data in transit, and encryption of stored platform access tokens;
• access limited to the people and systems that need it, with access removed when it is no longer needed;
• secure handling of the login details and access you give us;
• logging and monitoring for misuse, and a procedure for responding to incidents.

6. Sub-processors

You give us general authorisation to use sub-processors. We currently use:

We will give you at least 30 days' notice by email before adding or replacing a sub-processor. If you object on reasonable data protection grounds, we will try to address your concern; if we cannot, you may end the affected services without penalty. We put data protection terms in place with each sub-processor that are no less protective than this agreement, and we remain responsible to you for their work.

7. International transfers

We are based in the United Arab Emirates, and some sub-processors are in the United States. Where a transfer of personal data from you to us, or from us to a sub-processor, is a restricted transfer under the UK GDPR, we will only make it with a safeguard the UK GDPR allows: the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses (Module 2 for transfers from you to us, Module 3 for onward transfers to sub-processors), or the UK-US Data Bridge where the recipient is certified under it. We will sign the completed transfer documents with you on request.

8. Helping you meet your obligations

• We will tell you promptly if a data subject contacts us to use their rights, and help you respond.
• We will help you with security, breach notifications, data protection impact assessments and consultations with regulators, as far as our role allows.

9. Personal data breaches

We will tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data. We will give you the information you need to meet your own obligations to report it, and take reasonable steps to contain it.

10. Return or deletion

When our services end, we will, at your choice, delete or return the personal data we process for you, and delete remaining copies within 90 days, unless the law requires us to keep it.

11. Audits and information

We will give you the information you reasonably need to show that this agreement is being met, and allow for and contribute to audits or inspections by you or an auditor you appoint, on reasonable notice, no more than once a year unless a regulator requires it or there has been a breach.