Data Processing Addendum

The Customer is the controller of personal data in Customer Content and Mayeer is its processor. Each party will comply with the data protection law that applies to it.

Mayeer processes personal data only on the Customer's documented instructions, which are the Terms, this Addendum and the Customer's use and configuration of the Services, unless the law requires otherwise; in that case Mayeer will inform the Customer first where the law allows.

• Subject matter and duration: providing the Services for the term of the agreement and until deletion under section 9.
• Nature and purpose: hosting, storing, transmitting, displaying and securing Customer Content; sending documents and notifications; recording signing and viewing events.
• Data subjects: the Customer's users, recipients, signers and viewers, and people named in documents.
• Categories of data: names, contact details, identifiers in documents, signatures, verification results, audit-trail data and any personal data in documents the Customer uploads.

Mayeer ensures that people authorised to process the data are bound by confidentiality, and maintains appropriate technical and organisational measures, including encryption in transit and at rest, encrypted backups, access control by role, logging and monitoring, and secure development practices.

The Customer authorises Mayeer to use the sub-processors listed on the Sub-processors page. Mayeer will bind each sub-processor by written terms that protect the data at least as well as this Addendum, give notice of new sub-processors on that page at least fourteen days before they process Customer data, and remain responsible for them. The Customer may object on reasonable data-protection grounds, and the parties will discuss a solution in good faith.

Customer data is hosted outside the Kingdom of Saudi Arabia, as described in the Privacy Notice. Mayeer transfers personal data only to provide the Services and with the safeguards required by the law that applies to the transfer.

Taking into account the nature of the processing, Mayeer will help the Customer respond to requests from data subjects, with security, with breach notifications and with impact assessments, mainly through the tools in the Services (export, deletion and audit records).

Mayeer will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer data, with the information available, and will take reasonable steps to contain it and reduce its effects.

When the agreement ends, the Customer can export its data from the Services. Mayeer then deletes Customer data from active systems within thirty days and from backups as they expire, unless the law requires it to be kept.

Mayeer will make available the information reasonably needed to show compliance with this Addendum, and will answer reasonable security questionnaires once a year. On-site audits need prior agreement on scope, timing and confidentiality.

If this Addendum conflicts with the Terms on data protection, this Addendum prevails. Contact: privacy@mayeer.org.