Data Processing Agreement

For the purposes of this Data Processing Agreement, the terms shall be used in the meaning specified below:

Controller is the User, as defined in the Agreement, a person who is a Personal Data Controller in terms of UAE Federal Decree Law No. 45/2021 on the Protection of Personal Data or Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR) (hereinafter collectively — the Law).
Processor is the Administration, as defined in the Agreement, processing Personal Data on behalf of the Controller and being a Processor in terms of the Law.
Personal Data subject is an individual to whom the Personal Data relates, as defined in the Law.
Personal Data is any data relating to an identified individual or an individual who can be identified directly or indirectly by linking the data by reference to an identifier such as his/her name, voice, image, identification number, electronic identifier, geographic location or one or more physical, physiological, cultural or social characteristics as defined in the Law and processed by the Controller using the Platform.
User Data is the information that may contain Personal Data, downloaded or processed by the Controller using the Platform.
Sensitive Personal Data is any information that directly or indirectly discloses the race, ethnicity, political or philosophical opinions, religious beliefs, criminal record, biometric data or any data relating to the health of such individual, such as his or her physical, psychological, mental, bodily, genetic or sexual condition, including any information relating to the provision of health care services to such individual that discloses his or her health status as defined in the Law.
Biometric Personal Data is any Personal Data obtained as a result of special technical processing relating to the physical, physiological or behavioural characteristics of the Personal Data Subject that identifies or confirms the unique identification of the Personal Data Subject, such as facial image or fingerprint data as defined in the Law.

The Data Processing Agreement may use other terms not defined above, that will be interpreted in accordance with the Agreement and the Law.

1.1. The Controller instructs, and the Processor assumes the obligation to carry out actions to process the Personal Data of clients (visitors of the Websites) of the Controller, which are processed or will be processed by the Controller using the Platform.

1.2. Basic provisions regarding Personal Data processing:

3.1. The Processor undertakes to comply with the purpose and limitations of Personal Data processing specified in the Data Processing Agreement.

3.2. The Processor undertakes to execute the Data Processing Agreement independently, as well as with the involvement of third parties specified on the Processor’s website in the Privacy Policy, remaining responsible to the Controller for the fulfillment of its obligations under the Data Processing Agreement.

3.3. The Processor shall be obliged to maintain confidentiality and ensure security of Personal Data in accordance with the requirements of the applicable law.

3.4. The Processor undertakes to cooperate in good faith with the Controller and provide it with reasonable assistance in considering and resolving requests (complaints, demands) regarding the Data Processing Agreement. In particular, the Processor, having received such a request, shall be obliged to notify the Controller thereof within five (5) business days from the occurrence of the specified event by sending a corresponding notification to the email address specified by the Controller when registering in the Personal Account.

3.5. The Processor shall be liable to the Controller for execution of the Data Processing Agreement, including for the actions (inaction) of its employees who gained access to the Personal Data processed under the Controller’s Data Processing Agreement, which resulted in the disclosure of such Personal Data, within the amount of actual damage confirmed by documents, but in any case, total property liability of the Administration to the Controller cannot exceed the amount of the cost of the Tariff paid by the Controller and valid during the period of occurrence of events that are the basis for the occurrence of property liability of the Administration.

4.1. The Controller shall be responsible to the Personal Data subject for the actions performed by the Processor when executing the Data Processing Agreement.

4.2. The Controller shall make its own decision and be responsible for determining whether the Platform is suitable for processing Personal Data in accordance with United Arab Emirates law, as well as for using the Platform in accordance with the Controller’s legal obligations.

4.3. The Controller shall, independently and at its own expense, develop and place on the Websites it uses all documents required by the applicable law regarding the collection and processing of Personal Data by the Controller, and shall be responsible for their correctness and completeness.

4.4. The Controller shall independently select service providers and data collection systems and services enabled by the Controller to the fields of web forms on the Websites and used by the Controller to collect Personal Data, and shall also be independently responsible for fulfilling the requirements of the Law when organizing the collection of Personal Data using such systems and services.

4.5. The Controller shall be entitled, no more than once a year, to request from the Processor documents and other information confirming the adoption of measures and compliance with the requirements established in the Data Processing Agreement for the purpose of executing the Controller’s Data Processing Agreement.

4.6. The Controller shall be responsible for the security of the means of protection of access to the Platform he/she has chosen, and also independently ensure their confidentiality.

4.7. The Controller shall be responsible for all actions, as well as their consequences, when using the Platform, while all actions performed in the Account shall be considered to have been carried out by the Controller themselves.

4.8. The Controller shall be responsible for responding to requests from Personal Data subjects and third parties regarding the Controller’s use of the Platform for the purpose of Personal Data processing.

4.9. The Controller shall be responsible for considering requests from Personal Data subjects related to the exercise of their rights, including in cases where the use of the Platform by the Controller affects the rights of these persons.

4.10. The Controller undertakes to provide the Processor with confirmation of the existence of legal grounds for processing Personal Data and the fact of proper notification of the Personal Data subject about their transfer, within five (5) calendar days from the date of receipt of the corresponding request from the Processor.

4.11. In the event that the Processor is presented with claims and demands from third parties, including from Personal Data subjects and authorized bodies, in connection with the execution of the Data Processing Agreement, including in the event of a claim about the unlawfulness of the Processor’s processing of Personal Data processed by the Controller using the Platform, the Controller shall be obliged to settle independently such claims on its own and at its own expense, to protect the Processor from possible losses and participation in the consideration of claims, demands and possible litigation. If it becomes necessary for the Processor to participate in resolving the above-mentioned claims and/or demands, the Processor shall be entitled to demand from the Controller compensation for losses and expenses incurred in connection with such participation, including, but not limited to, the costs of a representative, negotiations and other expenses.

4.12. In the event of claims being made against the Processor from third parties, including from Personal Data subjects and authorized bodies, in connection with the execution of the Data Processing Agreement, including in the event of a claim about the unlawfulness of the Processor’s processing of Personal Data processed by the Controller using the Platform, which will result in a court order on the collection of funds from the Processor, which has entered into legal force, the latter shall be entitled to demand from the Controller compensation to the Processor for expenses incurred in the process of resolving a legal dispute and in execution of a court decision, as well as all legal costs and losses incurred by the Processor in full.

4.13. The Controller shall bear the risk of being unable to use the Website and/or Platform arising as a result of the Processor’s fulfilling the obligation to stop processing the Personal Data on the basis of the Controller’s Data Processing Agreement.

5.1. The Controller undertakes to establish requirements for the protection of the processed Personal Data in accordance with the Law, upon that, this obligation applies exclusively to the Controller and should not be interpreted as establishing requirements for protection of the processed Personal Data determined by the Controller to the Processor.

5.2. The Processor shall take the necessary confidentiality and security measures when executing the Data Processing Agreement using automation tools in accordance with the requirements specified in the Law. More detailed information is provided in the Privacy Policy.

6.1. The Controller shall take necessary and sufficient measures, including monitoring and managing access to the Platform, in order to prevent breaches of information security when processing Personal Data using the Platform. Responsibility for choosing the necessary protection and safety measures, the sufficiency and reliability of these measures lies with the Controller. In the event of an Information Security Breach due to the actions or inaction of the Controller, the latter undertakes to immediately, but no later than forty-eight (48) hours from the date of detection of the event, notify the Processor, and the Processor shall be relieved of responsibility for the security and confidentiality of the data processed within the framework of the Data Processing Agreement.

6.2. If the Processor becomes aware of any security breach that leads to accidental or illegal transfer (provision, distribution, access) of Personal Data (hereinafter referred to as "Information Security Breach") and carries risks of privacy, confidentiality and security of Personal Data Subjects, whose Personal Data has been affected by a security breach (as defined in Article 34 of the Law), the Processor shall immediately upon becoming aware of it (1) notify the Controller of the Information Security Breach and (2) take reasonable measures to mitigate the consequences and minimize any or damage resulting from the Information Security Breach.

6.3. The Processor shall provide the Controller with necessary and sufficient information and support related to such an event that the Controller may need to fulfill its obligations under the Law, as well as to reduce the negative consequences that may arise as a result of such an event.

6.4. The Processor's obligation to report or respond to such Information Security Breach in accordance with this section shall not constitute an admission on the part of Processor of any fault or liability in connection with the Information Security Breach.

7.1. This Agreement shall be governed by and subject to interpretation in accordance with the law of the United Arab Emirates.

7.2. All disputes that may arise between the Parties in the course of execution of the Agreement shall be resolved through negotiations.

7.3. The Processor reserves the right to unilaterally amend and/or supplement the terms and conditions of the Data Processing Agreement by posting the amended text on the Internet at the following link: https://tilda.cc/dpa/. With each actual use of the Platform for processing of Personal Data, the Controller confirms its agreement with the terms and conditions of the Data Processing Agreement in the version in force at the time of actual use of the Platform for processing of Personal Data.