This Data Processing Agreement ("DPA") forms part of the Terms of Service between Rafeeq ("Processor") and the Customer ("Controller"). It applies to personal data of End Users that Rafeeq processes on the Customer's behalf. It is designed to meet the UAE PDPL, the Saudi PDPL and, where applicable, Article 28 of the GDPR.
1. Scope of processing
- Subject matter & purpose: operating the AI assistant on WhatsApp, booking, lead tracking, dashboards and reports for the Customer.
- Duration: the subscription term plus the deletion period in section 8.
- Data subjects: the Customer's End Users (people who message the Customer on WhatsApp) and the Customer's staff.
- Data categories: WhatsApp number, profile name, message content and images, language, appointment details, lead profile notes, delivery metadata. Special-category data (such as health information) only where the Customer's business requires it and the Customer has a lawful basis.
2. Processing on instructions
The Processor processes personal data only on the Controller's documented instructions — these Terms, the Controller's configuration of the Service, and written requests — unless the law requires otherwise, in which case it will inform the Controller where legally permitted. The Processor will tell the Controller if it believes an instruction breaks the law.
3. Controller obligations
The Controller is responsible for the lawfulness of the processing, for giving End Users the required privacy information (including that an automated assistant may respond), for obtaining any consents, and for the accuracy of the data and instructions it provides.
4. Confidentiality & security
Everyone authorised to process the data is bound by confidentiality. The Processor maintains appropriate technical and organisational measures, including:
- TLS encryption in transit and AES-256-GCM encryption for access tokens and 2FA secrets at rest;
- logical tenant isolation, role-based access, two-step verification, lockout and rate limiting;
- audit logging of administrative actions; security alerts to account holders;
- hardened, least-privilege runtime; daily encrypted backups kept 14 days;
- automated abuse detection (floods, spam, prompt injection) and output filtering.
5. Sub-processors
The Controller authorises these sub-processors: Meta Platforms (WhatsApp Business Platform), Anthropic (AI model provider), our dedicated hosting provider, and Cloudflare (network security for the website). The Processor imposes data-protection obligations on each sub-processor no less protective than this DPA and remains responsible for them.
The Processor will give at least 14 days' notice of a new sub-processor by email or on this page. The Controller may object on reasonable data-protection grounds; if we cannot resolve the objection, the Controller may terminate the affected Service without penalty.
6. Assistance & data-subject requests
Taking into account the nature of the processing, the Processor will help the Controller respond to End Users exercising their rights (for example by exporting or deleting a contact's data) and with data-protection impact assessments and consultations with authorities. Requests received directly from End Users will be forwarded to the Controller.
7. Personal data breaches
The Processor will notify the Controller without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting the Controller's data, with the information reasonably available (nature, likely consequences, measures taken), and will cooperate in mitigating it.
8. Return & deletion
At the end of the Service, the Processor will, at the Controller's choice made within 30 days, return an export of the Controller's contacts and appointments and then delete the personal data from live systems within 30 days; backups are overwritten within a further 14 days, unless the law requires retention.
9. Information & audits
The Processor will make available information reasonably necessary to demonstrate compliance with this DPA, first through written answers to a security questionnaire. If that is insufficient, the Controller may conduct an audit at most once a year, with 30 days' notice, during business hours, at its own cost, under confidentiality, and without access to other customers' data.
10. Liability & precedence
Liability under this DPA is subject to the limitations in the Terms of Service. If this DPA conflicts with the Terms regarding personal data, this DPA prevails.