Data Processing Agreement

Contents

1. 1. Scope, roles and definitions
2. 2. Details of the Processing
3. 3. The Customer's instructions
4. 4. Confidentiality of authorised persons
5. 5. Security measures
6. 6. Sub-processors
7. 7. Data location and international transfers
8. 8. Assistance with Data Subject requests
9. 9. Personal Data Breach notification
10. 10. Impact assessments and consultation with regulators
11. 11. Information and audits
12. 12. Return and deletion of data
13. 13. Government requests
14. 14. Liability
15. 15. Term and precedence
16. 16. Data protection contact and record of processing
17. Annex 1: Details of the Processing
18. Annex 2: Technical and organisational measures
19. Annex 3: Sub-processors

Version: 1.2 · Published: 16 October 2026 · Effective: on acceptance for new Workspaces; for Workspaces that accepted an earlier Version, on the date STAK gives in its notice under clause 20 of the Customer Terms of Service · Governing text: English (clause 23.9 of the Customer Terms of Service)

Issued by: STAK Global, LLC, a limited liability company formed in the State of Delaware, United States of America (file number 10798493), which owns STAK (ستاك) and the Services. Contact: [email protected].

1. Scope, roles and definitions

1.1 This Data Processing Agreement forms an integral part of the Agreement under clause 3.1 of the STAK Customer Terms of Service (the "Terms"). It governs STAK's Processing of Customer Personal Data. Expressions defined in the Terms have the same meaning in this Data Processing Agreement.

1.2 The Customer is the Controller of Customer Personal Data, and STAK is a Processor that processes it on the Customer's behalf and on its instructions.

• Controller and Processor mean their equivalents under the Applicable Data Protection Law, such as the controlling entity and the processing entity in the Kingdom of Saudi Arabia.
• If the Customer processes the data as a processor on behalf of another controller, STAK processes it as a processor acting for the Customer, and is not a Sub-processor within the meaning of clause 1.3. The Customer ensures that its instructions are consistent with that controller's instructions.
• STAK processes Account Data as a Controller, as described in the Privacy Policy, and this Data Processing Agreement does not apply to it. Neither this reference nor the one in Annex 3 creates contractual obligations under clause 3.2 of the Terms.

1.3 The following expressions have the meanings given next to each:

• Customer Personal Data: Personal Data contained in Customer Data, including data about the Customer's End Customers, employees, suppliers and Users, other than Account Data.
• Sensitive Personal Data: health and clinical data, and any data that the Applicable Data Protection Law classifies as sensitive.
• Processing: any operation performed on Personal Data, such as collecting, recording, storing, retrieving, using, disclosing, transferring and deleting it.
• Sub-processor: any party STAK engages to Process Customer Personal Data for the purpose of providing the Services.
• Data Subject: the natural person to whom Personal Data relates.
• Security Incident: any event that threatens, or is suspected of threatening, the confidentiality, integrity or availability of the Services.
• Personal Data Breach: any breach of security leading to the accidental or unlawful destruction, loss or alteration of, or the unauthorised disclosure of or access to, Customer Personal Data.
• Backup: any copy of Customer Data made for recovery purposes, under clause 12.3 and Annex 2.
• Production environment: the systems and databases on which the Services run and which the Customer uses, excluding Backups.
• Applicable Data Protection Law: the personal data protection legislation that applies to the Processing, each as it applies, including the following:
  • in the State of Kuwait: Law No. 20 of 2014 concerning Electronic Transactions, and the Data Privacy Protection Regulation, the Cloud Computing Regulatory Framework and the Data Classification Policy issued by the Communication and Information Technology Regulatory Authority, each within its own scope;
  • the Personal Data Protection Law of the Kingdom of Saudi Arabia, issued by Royal Decree No. (M/19) dated 9/2/1443 AH, as amended, its Implementing Regulation and the Regulation on Personal Data Transfer outside the Kingdom;
  • in the United Arab Emirates: Federal Decree-Law No. (45) of 2021 on the Protection of Personal Data, Federal Law No. (2) of 2019 on the Use of Information and Communication Technology in Health Fields, and the data protection laws of the Dubai International Financial Centre and Abu Dhabi Global Market for those subject to them;
  • Law No. (30) of 2018 issuing the Personal Data Protection Law of the Kingdom of Bahrain;
  • Law No. (13) of 2016 on the Protection of Personal Data Privacy of the State of Qatar;
  • the Personal Data Protection Law issued by Royal Decree No. (6/2022) of the Sultanate of Oman;
  • the European Union General Data Protection Regulation (Regulation (EU) 2016/679), where it applies to the Customer;
  • the United Kingdom General Data Protection Regulation and Data Protection Act 2018; the Swiss Federal Act on Data Protection; the California Consumer Privacy Act as amended, and the other comprehensive state privacy laws of the United States of America; the Personal Information Protection and Electronic Documents Act of Canada and the provincial laws; Brazil's Lei Geral de Proteção de Dados (Law No. 13.709/2018); India's Digital Personal Data Protection Act, 2023; Turkey's Law No. 6698 on the Protection of Personal Data; Egypt's Law No. 151 of 2020; South Africa's Protection of Personal Information Act, 2013; Singapore's Personal Data Protection Act 2012; Australia's Privacy Act 1988; and any other personal data protection law that applies to the Processing.

2. Details of the Processing

Annex 1 sets out the subject matter, duration, nature and purpose of the Processing, the categories of Data Subjects and the categories of Personal Data.

3. The Customer's instructions

3.1 STAK Processes Customer Personal Data only on the Customer's documented instructions. Those instructions are:

• the Agreement;
• the Workspace settings;
• the actions Users take within the Services;
• any other written instructions the Parties agree.

3.2 STAK may Process the data otherwise than on these instructions where Applicable Law requires it. It notifies the Customer in advance unless the law prohibits notice.

3.3 STAK notifies the Customer if it considers that an instruction breaches the Applicable Data Protection Law. It may decline to carry out that instruction until the Customer changes it to remove the breach, or confirms it in writing with a statement of its legal basis that STAK reasonably accepts.

3.4 The Customer is responsible for the lawfulness of its instructions and for having a lawful basis to collect and Process Customer Personal Data. This includes informing Data Subjects and obtaining their consent where needed, including consent to the transfer of their data under clause 7.

4. Confidentiality of authorised persons

STAK limits access to Customer Personal Data to the employees and contractors who need it for their work, and binds them to confidentiality. STAK's employees and contractors access Customer Data only in the following cases, and the start of every such access to the Production environment is logged:

• (a) to provide support the Customer asks for;
• (b) to operate and maintain the Services and to restore them from Backups;
• (c) to investigate a Security Incident or a suspected breach of the Acceptable Use Policy;
• (d) where the law requires it.

5. Security measures

5.1 STAK applies appropriate technical and organisational measures to protect Customer Personal Data, taking into account the nature and risks of the Processing. These include at least the measures in Annex 2.

5.2 STAK may update these measures, provided the overall level of protection does not decrease.

5.3 The Customer is responsible for the security measures under its own control, such as managing Users and permissions, switching on two-step sign-in, securing its devices and equipment and keeping safe the data it exports.

6. Sub-processors

6.1 The Customer authorises STAK to engage the Sub-processors listed in Annex 3.

6.2 STAK must enter into a written contract with each Sub-processor. The contract must impose data protection obligations that provide a level of protection appropriate to the Processing and substantially equivalent to this Data Processing Agreement. STAK remains responsible to the Customer for the performance of its Sub-processors' obligations.

6.3 STAK notifies the Customer of any new Sub-processor at least 30 days before it starts Processing Customer Personal Data, within the Services or by email.

6.4 During the notice period, the Customer may object in writing to the new Sub-processor on reasonable data protection grounds. If the Parties cannot agree a solution, the Customer may terminate the affected subscription, or the Agreement, before the Processing starts and receive a refund of Fees prepaid for the remaining period.

6.5 Connected Providers that the Customer connects through its own accounts are not STAK's Sub-processors. They include Payment Service Providers, Meta in respect of the Customer's own WhatsApp Business account, and delivery platforms. Sending data to them on the Customer's instructions is a transfer made at the Customer's direction and on its behalf.

6.6 Data is sent to the provider of AI Features only when a User asks for one of those features, when a User uploads a document for one of them to read, such as a receipt, or when an automation a User has set up runs a step that uses AI, and only the data needed to carry out that request or step is sent. The provider may not use it to train its models. Sensitive Personal Data is sent to it only if the request or step itself contains it.

7. Data location and international transfers

7.1 The Services are hosted, and Customer Personal Data is primarily stored, in the Production environment of Amazon Web Services in the Frankfurt region, in the Federal Republic of Germany. Backups are kept in the same region, and copies of them are made to a separate Amazon Web Services region in the Republic of Ireland.

7.2 The Customer acknowledges the following, and expressly authorises the transfers that result:

• (a) hosting takes place in the European Union, which may be outside the country in which the Customer is established or does business;
• (b) Cloudflare processes network traffic through its global network at all times;
• (c) the other Sub-processors listed in Annex 3 Process data in other countries, including the United States of America, only when the service concerned is used;
• (d) STAK's employees may access the data from the State of Kuwait, only in the cases set out in clause 4.

7.3 For transfers of Customer Personal Data outside the country in which it was collected, STAK applies the following safeguards:

• (a) the contracts referred to in clause 6.2, including the standard contractual clauses STAK has in place with Sub-processors outside the European Union;
• (b) encryption in transit and at rest;
• (c) the transfer mechanisms recognised by the Applicable Data Protection Law where it requires them, including those in clause 7.6.

7.4 The Customer must obtain any consent or authorisation that the law of its country requires for transferring Customer Personal Data outside that country, whether from a regulator or from Data Subjects. STAK provides the information needed for this on request.

7.5 STAK may move the primary hosting or the Backups to another region after notifying the Customer at least 30 days in advance, and the Customer may object under clause 6.4, with any termination under that clause taking effect before the date of the move. Temporarily running the Services from the Backups in the Republic of Ireland after the loss of the primary hosting region is not a move under this clause, and STAK notifies the Customer of it without delay.

7.6 Transfer mechanisms required by law: without affecting clause 7.4:

• (a) Where the European Union General Data Protection Regulation applies to the Customer, the standard contractual clauses adopted by European Commission Implementing Decision (EU) 2021/914 (the "EU SCCs") are incorporated into this Data Processing Agreement by reference: Module Two (controller to processor) where the Customer is a controller, and Module Three (processor to processor) where it processes the data for another controller. The Customer is the data exporter and STAK the data importer. Clause 7 (docking clause) applies. Under Clause 9(a), Option 2 (general written authorisation) applies, with the notice period in clause 6.3. The optional wording in Clause 11(a) does not apply. Under Clauses 17 and 18, the law and courts of the Republic of Ireland apply. The competent supervisory authority is determined under Clause 13. Their annexes are completed by Annexes 1, 2 and 3. They prevail over the Agreement if the two conflict.
• (b) Where the Personal Data Protection Law of the Kingdom of Saudi Arabia applies to the Customer, the Standard Contractual Clauses for Personal Data Transfer issued by the Saudi Data and Artificial Intelligence Authority, Second Template (controller to processor), are incorporated into this Data Processing Agreement by reference. The Customer is the data exporter and STAK the data importer, and their appendices are completed by Annexes 1, 2 and 3. STAK gives the Customer the information it needs for the transfer risk assessment it must carry out under the Regulation on Personal Data Transfer outside the Kingdom. They prevail over the Agreement if the two conflict.
• (c) Where Federal Decree-Law No. (45) of 2021 of the United Arab Emirates applies to the Customer, STAK applies to the transferred data the provisions, measures and controls of that law, to the extent they apply to a processor.
• (d) Where the United Kingdom General Data Protection Regulation applies to the Customer, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0, in force from 21 March 2022, as later amended) is incorporated by reference. Tables 1 to 3 are completed with the Parties' details in the Agreement and Annexes 1 to 3. For Table 4, either Party may end the Addendum as its Section 19 allows.
• (e) Where the Swiss Federal Act on Data Protection applies to the Customer, the EU SCCs apply with these changes: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers governed by that Act; references to the GDPR include that Act; and "Member State" is read so that data subjects in Switzerland can bring claims in Switzerland.
• (f) Where another Applicable Data Protection Law requires a particular transfer instrument, such as the standard contractual clauses of Brazil's national data protection authority or the standard contract under Turkey's Law No. 6698, STAK signs or incorporates that instrument at the Customer's request, with its details completed from Annexes 1 to 3.
• (g) Where the California Consumer Privacy Act or a similar United States state privacy law applies, STAK acts as the Customer's service provider, contractor or processor. STAK does not sell or share Customer Personal Data. It does not retain, use or disclose it for any purpose other than providing the Services under the Agreement, or outside the direct business relationship with the Customer. It does not combine it with personal information from other sources except as those laws allow. It complies with those laws and gives the same level of privacy protection they require. It tells the Customer if it can no longer meet these obligations. The Customer may take reasonable steps to stop and remedy any unauthorised use. STAK certifies that it understands these restrictions.

7.7 Data that must stay in a particular country: the Customer must not keep in the Services data that Applicable Law requires to be stored or processed within a particular country, unless the Services show, under clause 9.5 of the Terms, that hosting in that country is available for the App concerned. This follows clause 13.4 of the Terms and clause 5.4 of the Acceptable Use Policy.

8. Assistance with Data Subject requests

8.1 The Services give the Customer tools to view, export and correct the Personal Data of its End Customers, a tool to erase it by replacing their identity with an alias while keeping the records the law requires to be kept, and tools to view and correct the data of its employees. The Customer uses these tools to respond to Data Subject requests, and STAK assists under clause 8.3 with anything they do not cover, including exporting and deleting employee data.

8.2 If STAK receives a request directly from a Data Subject concerning Customer Personal Data, it passes it to the Customer without delay and responds only on the Customer's instructions.

8.3 STAK gives the Customer reasonable assistance with anything the available tools do not cover.

9. Personal Data Breach notification

9.1 STAK notifies the Customer without undue delay after becoming aware of any Personal Data Breach affecting Customer Personal Data. It does so within 24 hours of becoming aware of it where feasible, and in any event within 48 hours.

9.2 The notice includes, as far as the information is available:

• (a) the nature of the breach;
• (b) the categories of data and of Data Subjects and their approximate number;
• (c) the likely consequences;
• (d) the measures taken and proposed to address the breach;
• (e) a contact point at STAK.

STAK provides further information as soon as it becomes available.

9.3 STAK immediately takes reasonable measures to contain the breach and limit its effects. It cooperates with the Customer in notifying regulators and Data Subjects where the Customer must do so, taking account of the deadlines the law sets for the Customer. Where Applicable Law requires STAK itself to notify a regulator of the breach, STAK does so within the required period and tells the Customer.

9.4 STAK's notice of a breach, or its cooperation in dealing with it, is not an admission of fault or liability.

10. Impact assessments and consultation with regulators

At the Customer's request, STAK provides the reasonable information needed to carry out a data protection impact assessment or to consult a regulator, to the extent it concerns the Services.

11. Information and audits

11.1 At the Customer's request, STAK provides the information reasonably needed to demonstrate its compliance with this Data Processing Agreement. This includes security documentation and answers to one security questionnaire a year.

11.2 The Customer may, at its own expense, carry out an audit, or have an independent auditor bound by confidentiality carry it out, in the following cases:

• (a) where a regulator requires it;
• (b) after a Personal Data Breach affecting its data;
• (c) where the information provided under clause 11.1 is not sufficient.

The audit is subject to these conditions:

• The Customer notifies STAK of the audit at least 30 days in advance.
• It takes place during business hours on Business Days.
• An audit under paragraph (c) takes place no more than once a year.
• No audit extends to the facilities of Sub-processors. Their certifications and independent reports suffice instead.
• No audit includes access to other customers' data or anything that affects their security.

12. Return and deletion of data

12.1 The Customer may export Customer Personal Data at any time, and for 30 days after the Agreement ends, under clause 19.5 of the Terms.

12.2 After the export period, STAK deletes Customer Personal Data from the Production environment within 30 days, unless Applicable Law requires it to be kept, and subject to the hold in clause 19.5 of the Terms while STAK has been notified of a court dispute, an investigation or a request from a competent authority.

12.3 Backups are kept for the following retention periods:

• (a) point-in-time recovery and daily Backups: 35 days from the date each Backup is made;
• (b) nightly logical Backups of the database (database dumps): 35 days;
• (c) monthly Backups: 12 months from the date each Backup is made;
• (d) earlier versions of uploaded files: 90 days from the date they are replaced or deleted.

Rules that apply to these Backups:

• Daily and monthly Backups and their copies are held in backup vaults whose policy prevents anyone, including STAK's own staff, from deleting a Backup before its retention period ends or changing that period, and whose lock in the hosting provider's compliance mode prevents the deletion of any Backup during at least its first 35 days.
• Nightly logical Backups are protected against alteration and deletion until their retention period ends.
• STAK does not delete any Backup before its retention period ends, even at the Customer's request.
• All Backups are put beyond use and are used only for technical recovery, subject to clause 12.4, or where the law requires it.
• All Backups containing deleted data expire when these periods end, that is within 12 months at most, and the deleted data is then destroyed permanently.
• On request, STAK tells the Customer the date on which the last Backup containing deleted data expires, so that the Customer can tell the Data Subject.

12.4 If STAK restores a Backup during those periods, it re-applies, before the data is made available, the erasures carried out under clause 8.1 and the deletions made under clause 12.2 after the date of that Backup, using the records it holds of those operations.

13. Government requests

If STAK receives a binding request from a government or judicial authority to disclose Customer Personal Data, it notifies the Customer unless the law prohibits notice. STAK limits disclosure to the minimum the request requires. It challenges requests that it reasonably considers unlawful, through the legal means available.

14. Liability

Each Party's liability under this Data Processing Agreement, including its liability to the other Party under the standard contractual clauses in clause 7.6, is subject to the limitation of liability provisions in clause 16 of the Terms, to the extent those clauses permit and without affecting Data Subjects' rights under them.

15. Term and precedence

15.1 This Data Processing Agreement applies for as long as STAK Processes Customer Personal Data.

15.2 Where this Data Processing Agreement conflicts with the Terms, it prevails in matters concerning Customer Personal Data.

15.3 Where the Applicable Data Protection Law imposes a mandatory obligation stricter than this Data Processing Agreement, that obligation applies within its scope.

16. Data protection contact and record of processing

STAK has appointed a data protection contact, who can be reached by email at [email protected]. STAK keeps a record of the processing activities it carries out on behalf of customers, and provides it to the competent regulator where the law requires.

Annex 1: Details of the Processing

• Subject matter: providing the Services to the Customer under the Terms.
• Duration: the term of the Agreement, the export and deletion period after it under clause 12, the Backup retention periods in clause 12.3, and the Sub-processors' retention periods set out in Annex 3.
• Nature and purpose:
  • storing and hosting Customer Data;
  • processing sales, orders, bookings and invoices;
  • managing inventory, accounting, human resources and payroll;
  • sending the messages the Customer requests through its own accounts with Connected Providers, or through the messaging providers STAK uses once they are listed in Annex 3;
  • providing AI Features when they are used;
  • Backups, security and Support.
• Categories of Data Subjects:
  • the Customer's End Customers, guests and patients;
  • its employees and job applicants;
  • Users;
  • its suppliers and their contacts;
  • drivers and couriers.
• Categories of Personal Data:
  • identity and contact data, such as name, phone, email, address and delivery location;
  • records of transactions, orders, bookings and invoices;
  • references linked to payments, without full card numbers;
  • loyalty data, preferences and consents;
  • data about the Customer's employees, such as civil ID number, residency details, salary, international bank account number (IBAN), attendance and leave;
  • photos and documents the Customer uploads;
  • message logs and the audit trail.
• Sensitive Personal Data: health and clinical data when the clinic Apps are used, subject to clause 7.7 and to clause 13.4 of the Terms, under which the patient-record features must not be used for patients receiving health services in the State of Kuwait or the United Arab Emirates; and health data in human resources files, such as sick notes. Clinical records and human resources files are encrypted with separate keys, and this data is visible only to Users who hold the roles authorised to see it. Diagnosis and procedure codes in insurance claims and prior authorisations, and images of insurance cards, are protected by the database and storage encryption in Annex 2.

Annex 2: Technical and organisational measures

1. Encryption:
   • Data in transit is encrypted with TLS version 1.2 or later, and the database server's identity is verified on every connection.
   • Data at rest in databases, disks, files, Backups and the secrets store is encrypted with AES-256, using keys managed through the AWS Key Management Service (AWS KMS) or by the hosting provider.
   • Human resources files and clinical records are additionally encrypted within the application with separate keys, and connection details for Connected Providers are kept in a separate secrets store encrypted with a separate key.
2. Isolation of each customer's data: every record of Customer Data carries the identifier of the Business it belongs to. Row-level security policies in the database apply to the application's role, and the application's role has no permission to bypass them. Composite-key constraints prevent records of one Business from being linked to records of another.
3. Access control:
   • Access is granted on the principle of least privilege.
   • Access to the Production environment is limited to named STAK employees, requires multi-factor authentication, and the start of every access is logged.
   • Administrative access to servers goes only through AWS Systems Manager, with no direct (SSH) login.
4. User sign-in security:
   • For Users, the Services offer passkeys, authenticator apps and verification codes sent to a verified phone.
   • For the Customer, they offer customisable roles and permissions, access restricted by Branch and, on the Plans that include them, session idle rules and alerts to Owners for sign-ins from new devices.
5. Audit trail: an audit trail of changes is kept that no User can alter or delete. It records the actor, time, source and IP address. When the Customer erases an End Customer's Personal Data under clause 8.1, the entries lose that person's identifying details but keep what was done, by whom and when. The audit trail is deleted with Customer Data under clause 12. Accounting entries are linked in a chain that reveals any tampering.
6. Backups and recovery:
   • automated, continuous Backups allow point-in-time recovery within 35 days;
   • daily Backups are kept for 35 days and monthly Backups for 12 months, and they are copied to a separate geographic region in the Republic of Ireland. The backup vaults' policy prevents their deletion before their retention period ends or any change to that period, and a compliance-mode lock prevents the deletion of any Backup during at least its first 35 days;
   • a logical Backup of the database is made every night and kept for 35 days in storage protected against alteration and deletion;
   • restoring the database from Backups is tested every month.
7. Payment data: the Services are designed so that STAK does not store full card numbers. Payments are made on pages hosted by Payment Service Providers or on their certified card acceptance terminals and apps. The Services' screens contain no fields for entering card data, and the Services let the Customer scan free-text fields for card numbers entered by mistake so that they can be removed.
8. Network and infrastructure: databases run in private networks that are not publicly reachable, behind firewalls. A web application firewall and protection against denial-of-service attacks are provided through Cloudflare.
9. Vulnerability management and secure development: code is reviewed and automated tests run before every release. Software libraries are checked, and security updates are applied without delay.
10. Monitoring and incident response:
    • the cloud infrastructure is monitored automatically around the clock, with immediate alerts;
    • every administrative action on the cloud infrastructure is logged, and threats and excess permissions are detected automatically through dedicated Amazon services (AWS CloudTrail, GuardDuty and IAM Access Analyzer);
    • documented procedures apply for responding to Security Incidents and for notification under clause 9.
11. Business continuity: continuity and recovery plans apply, in line with the recovery objectives in the Service Level Agreement.
12. Personnel: STAK's employees and contractors are bound by confidentiality and receive security awareness training.
13. Secure deletion: data is deleted under clause 12, and the hosting provider destroys media in accordance with its standards.

Annex 3: Sub-processors

Providers used only when switched on. STAK has the following providers set up but does not use them to Process Customer Personal Data today. It starts using any of them only after giving notice under clause 6.3, at least 30 days in advance, and the notice states where the provider Processes the data and how long it keeps it.

Once STAK switches on its own WhatsApp number, Meta sends from it sign-in codes to Users and verification codes to End Customers who verify their phone numbers on the Public Pages. In doing so it processes data that STAK processes as Controller under the Privacy Policy, not Customer Personal Data.

Apart from the providers above, STAK does not use text message, push notification, digital wallet, or address lookup, verification and mapping providers to Process Customer Personal Data.