ALTE · Alternative Technologies

Data Processing Addendum (DPA)

Controller–processor terms for business customers · British English

1. Parties and scope

This Data Processing Addendum (“DPA”) forms part of the agreement between Customer and ALTE L.L.C-FZ (“ALTE”) where ALTE processes Personal Data on behalf of Customer in connection with the Services. Customer is the Controller (or a Processor authorised by another Controller) and ALTE is the Processor, except for personal data ALTE processes for its own account administration, billing, security or legal purposes.

2. Definitions

“Personal Data”, “Controller”, “Processor”, “Data Subject” and similar terms have the meanings given by applicable data-protection law, including UAE Federal Decree-Law No. 45 of 2021 where applicable. “Customer Personal Data” means Personal Data processed by ALTE on Customer’s behalf.

3. Customer instructions

ALTE will process Customer Personal Data only on documented Customer instructions, including instructions inherent in use and configuration of the Services, unless processing is required by applicable law. If ALTE believes an instruction infringes applicable data-protection law, ALTE may notify Customer and suspend the affected processing while the issue is resolved.

4. Customer responsibilities

• Customer will ensure that its instructions and use of the Services are lawful.
• Customer will provide required privacy notices and obtain required consents or other lawful bases.
• Customer will avoid uploading sensitive or specially regulated data unless expressly permitted by the Order and appropriate safeguards are agreed.
• Customer will configure access, users, retention and connected systems appropriately.

5. Confidentiality

ALTE will ensure that persons authorised to process Customer Personal Data are bound by confidentiality obligations and receive appropriate data-protection and security instructions.

6. Security

ALTE will implement appropriate technical and organisational measures proportionate to the risk, including the measures described in Schedule 2. ALTE may update security measures as technology and risk evolve, provided the overall level of protection is not materially reduced.

7. Subprocessors

Customer authorises ALTE to use subprocessors to provide the Services. ALTE will require subprocessors that process Customer Personal Data to provide data-protection obligations materially consistent with this DPA. ALTE will maintain a current subprocessor list and provide it on request.

8. International transfers

Where Customer Personal Data is transferred outside the UAE, ALTE will use a mechanism and safeguards permitted by applicable UAE law, which may include transfers to jurisdictions recognised as providing adequate protection, contractual safeguards or another lawful transfer basis. Customer authorises transfers necessary to provide the Services subject to these safeguards.

9. Data Subject requests

Taking into account the nature of processing, ALTE will provide reasonable assistance to Customer with requests from Data Subjects concerning access, correction, deletion, restriction, objection, portability or other applicable rights. If ALTE receives a request directly relating to Customer Personal Data, ALTE may refer the requester to Customer unless legally required to respond.

10. Security incidents

ALTE will notify Customer without undue delay after becoming aware of a confirmed Personal Data breach affecting Customer Personal Data, and will provide information reasonably available to support Customer’s legal assessment and notification obligations. Notification is not an admission of fault or liability.

11. Assistance and compliance

ALTE will provide reasonable information necessary to demonstrate compliance with this DPA and will assist Customer, taking into account the nature of the Services, with security, impact assessment and regulatory obligations where legally required. Any audit must be reasonable, proportionate, subject to confidentiality and not unreasonably disrupt ALTE’s operations.

12. Return and deletion

At the end of the Services, ALTE will keep Customer Personal Data rather than delete it, so that Customer does not lose data it may still need. ALTE will delete or return Customer Personal Data on Customer’s request, and will not delete it on a schedule of its own, unless retention or deletion is required by law. Backup copies may persist for a limited period under normal backup cycles and remain protected under this DPA.

13. Liability and precedence

Liability under this DPA is subject to the liability provisions of the main agreement unless mandatory law requires otherwise. If this DPA conflicts with the main agreement on processing of Customer Personal Data, this DPA prevails for that subject matter.

Schedule 1 — Processing details

Schedule 2 — Minimum security measures

• Role-based access and least privilege.
• Strong authentication and secure credential handling.
• Encryption in transit; encryption at rest where appropriate to the system and data.
• Secure storage of integration credentials and API tokens.
• Logging of security, access and billing-sensitive events.
• Reasonable vulnerability management, patching and environment separation.
• Backups and recovery processes proportionate to the product.
• Incident-response procedures and internal escalation.
• Vendor/subprocessor review proportionate to risk.
• Employee/contractor confidentiality and access removal when no longer required.

Schedule 3 — Subprocessors

The current list of subprocessors, including provider name, service, processing location and purpose, is available on request.