Data Processing Agreement (DPA)

1. Roles & Processing Details

Evnao (“Processor”) will process “Customer Data” on behalf of Customer (“Controller”). Each party will comply with applicable data protection laws (e.g. Jordan PDPL, GDPR, CCPA). The Processor will process Customer Data solely to perform the Services described in the Terms of Service. Categories of data include Customer account data and end-user support content; categories of data subjects include the Customer's employees and customers.

2. Customer Instructions

The Controller authorizes the Processor to process data as necessary to provide the Service. The Processor will follow written instructions from the Controller (e.g. configurations set in the admin panel). If a law requires the Processor to use data beyond these instructions, the Processor will notify the Controller unless legally barred.

3. Processor Obligations

• Confidentiality: Processor personnel are bound by confidentiality.
• Security: Processor will implement appropriate technical and organizational measures (e.g. encryption, access logs, intrusion detection).
• Data Subject Requests: If a data subject requests access or deletion of data, Processor will notify Controller and assist (but will not respond without instruction).
• Subprocessors: Controller authorizes existing subprocessors. Processor will contractually bind subprocessors to similar protections. Changes to the subprocessor list will be communicated to Controller with reasonable advance notice. If Controller objects to a new subprocessor, the parties will work in good faith to find a resolution.
• Breaches: Processor will report any confirmed personal-data breach to Controller without undue delay and within the time required by applicable law. Processor will provide available details and reasonable assistance for notifying regulators and data subjects as required by applicable data protection law.

4. Data Return/Deletion

Upon termination or expiration, Processor will delete or return all Customer Data as instructed by Controller, within 30 days. If law requires retention (e.g. accounting regulations), Processor will isolate such data until that law's requirements are satisfied.

5. International Transfers

Controller instructs Processor to transfer data as needed for the Services. Where a restricted international transfer requires a lawful transfer mechanism, Evnao will use an applicable mechanism, which may include the European Commission Standard Contractual Clauses and, where applicable, the UK International Data Transfer Addendum. The specific mechanism used will depend on the jurisdictions involved and the requirements of applicable law.

For personal data subject to the Jordan Personal Data Protection Law, transfers outside Jordan will be made in accordance with applicable requirements, including any adequacy determinations, appropriate safeguards, or regulatory approvals required under Jordanian law. Controller acknowledges that certain subprocessors may process data outside Jordan in order to deliver the Service, and authorizes such transfers subject to the safeguards described in this DPA.

6. CCPA/CPRA Provisions

If Controller's Customer Data includes California personal information, the parties agree that Processor is a “service provider” under CCPA. Processor will not sell or share Personal Information, will use it only for Business Purposes, and will comply with applicable requirements for handling Consumer requests.

7. Audit Rights & Liability

Controller may audit Processor's compliance once per year, subject to confidentiality, by providing reasonable notice. Where available, Processor may provide a relevant third-party audit or assessment report to demonstrate compliance in lieu of an on-site audit. Each party's liability is governed by the Terms of Service.