Data Processing Agreement

Last updated: 19 October 2026

1. Parties and Scope

1.1. This Data Processing Agreement (“DPA”) forms part of the DigiPromise Subscription Terms & Conditions (“Terms”) between DigiPromise (“DigiPromise”, “Processor”) and the customer that has accepted the Terms (“Customer”, “Controller”). It applies automatically when the Terms are accepted and needs no separate signature. A signed copy is available on request.

1.2. This DPA applies to personal data that DigiPromise processes on behalf of the Customer in providing the Services, including through AI Employees, chat widgets, WhatsApp, Instagram, Messenger, Telegram, voice and phone channels, integrations and the client dashboard (“Customer Personal Data”).

1.3. This DPA is designed to meet the requirements of UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and, where they apply, Article 28 of the EU General Data Protection Regulation 2016/679 (GDPR), the UK GDPR, DIFC Data Protection Law No. 5 of 2020 and the ADGM Data Protection Regulations 2021 (together, “Data Protection Laws”).

1.4. Capitalised terms not defined here have the meaning given in the Terms or in Data Protection Laws. “Personal data breach”, “data subject”, “controller”, “processor” and “processing” have the meanings given in Data Protection Laws.

2. Roles and Instructions

2.1. The Customer is the controller of Customer Personal Data and DigiPromise is its processor. Where the Customer is itself a processor for a third party, DigiPromise acts as its subprocessor and the Customer confirms that its instructions are authorised by that third party.

2.2. DigiPromise shall process Customer Personal Data only on the Customer’s documented instructions, including with regard to international transfers, unless required to do so by applicable law; in that case DigiPromise shall inform the Customer of that legal requirement before processing, unless the law prohibits it. The Terms, the selected plan, the Customer’s configuration of the Services and any written instructions agreed by the parties are the Customer’s documented instructions.

2.3. DigiPromise shall promptly inform the Customer if, in its opinion, an instruction infringes Data Protection Laws.

2.4. The Customer is responsible for having a lawful basis for the processing, for giving end users the required privacy information (including that they are interacting with an AI system where required), and for obtaining any consents required by law or platform rules.

2.5. The details of the processing (subject matter, duration, nature, purpose, categories of data and data subjects) are set out in Annex 1.

3. Confidentiality

3.1. DigiPromise shall ensure that every person it authorises to process Customer Personal Data is bound by an appropriate duty of confidentiality and processes the data only as needed to provide the Services.

4. Security

4.1. DigiPromise shall implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing. The current measures are described in Annex 2.

4.2. DigiPromise may update the measures in Annex 2 provided the overall level of protection is not reduced.

5. Subprocessors

5.1. The Customer gives DigiPromise general written authorisation to engage the subprocessors listed in Annex 3.

5.2. DigiPromise shall give the Customer at least 30 calendar days’ notice before adding or replacing a subprocessor, by email to the Customer’s registered address or by updating Annex 3 on this page. The Customer may object on reasonable data protection grounds within that period. The parties shall then discuss the objection in good faith; if no solution is found, the Customer may terminate the affected Services and receive a refund of prepaid fees for the unused period of those Services.

5.3. DigiPromise shall impose on each subprocessor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, and remains liable to the Customer for the performance of its subprocessors’ obligations.

6. International Transfers

6.1. Customer Personal Data may be processed outside the country in which it was collected, including in the countries listed in Annex 3. DigiPromise shall transfer Customer Personal Data only where permitted by Data Protection Laws.

6.2. For transfers out of the UAE, DigiPromise relies on Articles 22 and 23 of the PDPL, including transfers to jurisdictions with adequate protection and transfers under contractual safeguards that bind the recipient to standards equivalent to the PDPL.

6.3. Where the GDPR applies to a transfer to a country without an adequacy decision, the parties agree that the EU Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module Two: controller to processor, or Module Three: processor to processor, as applicable) are incorporated into this DPA by reference, with Clause 7 (docking) included, Option 2 (general authorisation) under Clause 9 with the notice period in Section 5.2, the optional language in Clause 11 omitted, and Clauses 17 and 18 governed by the law and courts of Ireland. Annexes I and II of the Clauses are completed by Annexes 1 and 2 of this DPA.

6.4. Where the UK GDPR applies, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (version B1.0) is incorporated by reference, with the tables completed using the information in this DPA.

6.5. DigiPromise shall ensure that equivalent transfer safeguards are in place with each subprocessor that receives Customer Personal Data outside the UAE, the EEA or the UK.

7. Assistance to the Customer

7.1. Data subject requests: DigiPromise shall forward to the Customer, promptly and in any event within 5 business days, any request it receives from a data subject relating to Customer Personal Data, and shall not respond to it except on the Customer’s instructions or where required by law. Taking into account the nature of the processing, DigiPromise shall provide reasonable technical and organisational assistance (including export, correction and deletion tools in the client dashboard or by request) so that the Customer can respond to requests for access, correction, erasure, restriction, portability and objection, and requests concerning automated decision-making.

7.2. DigiPromise shall provide reasonable assistance with the Customer’s data protection impact assessments and prior consultations with competent authorities, to the extent they relate to the Services.

7.3. Assistance beyond the standard features of the Services may be charged at reasonable rates agreed in advance, except where the assistance is needed because of DigiPromise’s own breach of this DPA.

8. Personal Data Breaches

8.1. DigiPromise shall notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

8.2. The notice shall include, to the extent then known: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the name and contact details of DigiPromise’s contact point; the likely consequences; and the measures taken or proposed to address the breach and mitigate its effects. Information not available at first may be provided in stages without undue further delay.

8.3. DigiPromise shall take reasonable steps to contain and investigate the breach and shall cooperate with the Customer so that it can meet its obligations to notify the UAE Data Office or other competent authorities and affected data subjects. Notification of a breach is not an admission of fault or liability.

9. Return and Deletion

9.1. On expiry or termination of the Services, the Customer may request export of Customer Personal Data within 30 calendar days in an available standard format (such as CSV).

9.2. After that period, DigiPromise shall delete Customer Personal Data from its active systems within 30 calendar days and from backups within 90 calendar days, unless applicable law requires further retention. Retained data shall remain protected under this DPA and processed only for the purpose that requires its retention.

9.3. During the subscription, conversation logs are kept for up to 12 months, unless the Customer requests a shorter period. On request, DigiPromise shall confirm deletion in writing.

10. Audits and Information

10.1. DigiPromise shall make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA, including written answers to reasonable security questionnaires and a description of its security measures.

10.2. Where that information is not sufficient, or where a competent authority requires it, the Customer may carry out an audit, itself or through an independent auditor bound by confidentiality, no more than once in any 12-month period (except after a personal data breach or where required by an authority), with at least 30 calendar days’ written notice, during normal business hours and without unreasonable disruption. Each party bears its own audit costs.

10.3. Audits of subprocessors are carried out by relying on the audit reports, certifications and information those subprocessors make available.

11. Liability, Term and Precedence

11.1. Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Terms, except where Data Protection Laws or the EU Standard Contractual Clauses do not allow such limitation.

11.2. This DPA remains in force for as long as DigiPromise processes Customer Personal Data on the Customer’s behalf, and its obligations on deletion, confidentiality and security survive until the data is deleted.

11.3. If this DPA conflicts with the Terms on a matter concerning Customer Personal Data, this DPA prevails. If this DPA conflicts with the EU Standard Contractual Clauses or the UK Addendum, those Clauses prevail.

11.4. DigiPromise may update this DPA to reflect changes in Data Protection Laws or in the Services, giving at least 30 calendar days’ notice of any material change. Changes shall not reduce the level of protection for Customer Personal Data.

11.5. Except as provided in Section 6.3 and 6.4, this DPA is governed by the laws applicable to the Terms, and disputes are resolved as set out in the Terms.

12. Contact

Privacy and data protection requests: [email protected]

Phone / WhatsApp: +971 50 334 8392

Website: www.digipromise.com

Built in Dubai, Powered by AI, Designed for the World

Annex 1 – Details of Processing

Subject matter: providing AI Employees, automation, integrations, support and the client dashboard to the Customer under the Terms.

Duration: for the term of the subscription and the export and deletion periods in Section 9.

Nature and purpose: receiving, storing, analysing and responding to messages and calls from the Customer’s end users through AI; qualifying and recording leads, bookings and enquiries; sending notifications to the Customer’s team; syncing data with the Customer’s chosen tools (for example Google Sheets or a CRM); producing usage reports; providing support, security, troubleshooting and service improvement for the Customer.

Categories of data subjects:

• The Customer’s customers, prospects and website visitors who interact with the AI Employee.
• Contacts uploaded or connected by the Customer (for example, outbound call lists).
• The Customer’s staff and authorised users who receive alerts or use the dashboard.

Categories of personal data:

• Identity and contact data: name, phone number, email address, social media or messaging handle, company.
• Conversation content: chat messages, voice call audio and transcripts, attachments sent by end users.
• Enquiry data: property, product, booking, reservation or service preferences and related details.
• Technical data: session identifiers, page visited, referral codes, timestamps, approximate location derived from phone number or IP address.

Sensitive data: none intended. Sensitive personal data (including health data) is processed only where agreed in a signed statement of work that sets out additional safeguards and the hosting location.

Frequency of transfer: continuous, for as long as the Services are active.

Annex 2 – Technical and Organisational Measures

• Encryption in transit using TLS 1.2 or higher for the website, dashboard, APIs and webhooks; strict TLS between the CDN and origin servers.
• Encryption at rest where provided by the hosting and database providers.
• Role-based access control; client data separated by client identifier and database row-level security; access limited to personnel who need it.
• Multi-factor authentication on administrative accounts for hosting, database, email and payment systems.
• Credentials and API keys stored in provider credential stores, not in page code.
• Rate limiting and spam protection on public chat and form endpoints; requests accepted only from authorised domains.
• Logging of system errors with alerting to the DigiPromise team.
• Regular backups, stored separately from public web folders.
• Changes to production automations are tested on a copy before release.
• Confidentiality obligations for all personnel and contractors with access to Customer Personal Data.
• Breach response procedure in line with Section 8.
• Data minimisation: AI Employees are configured to collect only the data needed for the Customer’s use case.

Annex 3 – Subprocessors

DigiPromise uses the following subprocessors. Not every subprocessor is used for every Customer; use depends on the plan, channels and integrations selected. Locations show where the provider is established; data may be stored in other regions where the provider operates.

• Anthropic PBC (USA) – AI language model processing.
• OpenAI, L.L.C. (USA) – AI language model processing.
• ElevenLabs Inc. (USA) – voice AI, speech recognition and synthesis for voice calls.
• Meta Platforms Ireland Ltd / Meta Platforms, Inc. (Ireland / USA) – WhatsApp Business Platform, Instagram and Messenger messaging.
• Telegram Messenger Inc. (UAE) – Telegram messaging channel.
• Supabase, Inc. (USA) – database, authentication and storage for the client dashboard and conversation records.
• Contabo GmbH (Germany) – server hosting for automation workflows.
• Vercel Inc. (USA) – hosting for the client dashboard application.
• Namecheap, Inc. (USA) – website hosting.
• Cloudflare, Inc. (USA) – content delivery network, DNS and security.
• Google LLC (USA) – Google Workspace email and, where selected by the Customer, Google Sheets.
• Brevo SAS (France) – transactional email notifications.

Stripe processes payment data as an independent controller under its own terms and is not a subprocessor for Customer Personal Data. Third-party tools that the Customer connects and controls (for example the Customer’s own CRM) act under the Customer’s own agreement with that provider.

End of Data Processing Agreement