Data Processing Terms
Draft — the company registration details shown in [brackets] will be completed once the company's commercial registration is issued.
These terms apply when Muqawil processes personal data on behalf of a customer company, and they meet the requirements for controller–processor agreements in Article 8 of the Personal Data Protection Law (PDPL) and Article 17 of its Implementing Regulation. They form part of the Terms of Service (muqawil.app/terms). On data protection matters, these terms prevail over the Terms of Service.
1. Roles
The Customer is the controller of the personal data it or its users put into its Muqawil system ("Customer Data"). Muqawil is the processor: it processes Customer Data only to provide the Service and only on the Customer's documented instructions. If Muqawil processed Customer Data for its own purposes against these terms, it would be treated as a controller for that processing under the Implementing Regulation; Muqawil will not do so.
2. Details of the processing
| Item | Details |
|---|---|
| Subject and purpose | Hosting and processing Customer Data so the Customer can use Muqawil ERP, the Muqawil apps and Muqawil Mail |
| Duration | The subscription, plus the export and deletion period in section 12 |
| Nature | Storing, organising, displaying, calculating, sending and receiving, backing up, exporting and deleting, as the Customer's users do in the Service |
| Data subjects | The Customer's employees and workers, users, clients and their contacts, vendors and their contacts, and the people who exchange emails with the Customer's mailboxes |
| Types of personal data | Names and contact details; iqama, national ID or passport numbers and their expiry dates, nationality, photos and documents; job, sponsor, salary, allowances, bank IBAN, GOSI, attendance, leave, loans and end-of-service data; employee self-service sign-in data (company code, ID number, PIN hash); daily site reports with photos, time and location (if the Customer turns location on); invoices and payments; email contents and attachments |
| Sensitive data | Health information in documents the Customer uploads (for example sick leave). Attendance punch records from biometric devices, without the biometric templates, which stay on the device |
| Frequency | Continuous, while the Customer uses the Service |
3. Instructions
- Muqawil processes Customer Data only on the Customer's documented instructions. These terms, the Terms of Service, the settings the Customer chooses and the actions of its users in the Service are those instructions. Other instructions must be in writing and agreed.
- Muqawil does not use Customer Data for its own purposes, does not sell it and does not use it for advertising or to train AI models.
- If Muqawil believes an instruction breaks the PDPL, it will tell the Customer. If a law requires Muqawil to process Customer Data in another way, it will tell the Customer first, unless that law forbids it.
4. Confidentiality and staff access
Everyone at Muqawil who can access Customer Data is bound by confidentiality, and staff access is limited to what is needed to run the Service. To look inside a Customer's system, our support team needs a time-limited support code that the Customer gives; that access is read-only, ends automatically after at most 2 hours, can be ended by the Customer at any time, and is logged.
5. Security measures
Muqawil applies technical and organisational measures appropriate to the risk, using the National Cybersecurity Authority's controls as a reference where they apply, as Article 23 of the Implementing Regulation requires. They include:
- Tenant isolation: every Customer's data is separated in the database by row-level security policies, and isolation is checked with automated tests after each database change.
- Encryption in transit (HTTPS/TLS) for all traffic, and encryption at rest by our hosting providers.
- Access control: role-based permissions set by the Customer's admin, maker-checker approvals for money entries, sign-in lockout after repeated wrong attempts, one-way hashing of passwords and PINs, and two-step verification for Muqawil's own console.
- Audit logs of who created, changed or deleted records; financial records are protected from hard deletion.
- Daily backups kept for up to 7 days by our database provider.
- Bot protection and rate limits on public forms, and monitoring of the Service.
- Least-privilege access for staff and secrets stored outside the code.
6. Sub-processors
The Customer gives its prior written approval to the sub-processors below. Muqawil binds each of them to data protection terms that are at least as protective as these terms, checks them, and remains responsible to the Customer for them.
| Sub-processor | Service | Location |
|---|---|---|
| Supabase | Database, authentication, file storage, server functions, backups | Frankfurt, Germany (EU) |
| Cloudflare | Hosting, security, email receiving and sending for Muqawil Mail, attachment storage, call relay | Global network |
| AI model provider (currently Anthropic, PBC) | AI features — only when used; the import assistant only if the Customer switches it on, with identity numbers, IBANs and contact details masked | United States |
| Transactional email provider (Resend or ZeptoMail by Zoho) | Sending invoices and other emails the Customer sends from the Service — only when switched on | United States or the provider's other regions |
| Meta (WhatsApp Business) | WhatsApp messages — only if the Customer turns this channel on | Global network |
| Apple and Google | Push notifications to the mobile apps (message title and short text only) | Global |
| Moyasar | Card payments — only when online payment is switched on | Kingdom of Saudi Arabia |
Muqawil will tell the Customer about any new or replacement sub-processor at least 30 days before it starts, by email or inside the app, and update this list. The Customer may object within that period on reasonable data protection grounds; if we cannot resolve the objection, the Customer may end the affected part of the Service before the change and receive a refund for the unused prepaid period. If the Customer does not object, the new sub-processor is approved.
ZATCA is not a sub-processor: when the Customer issues e-invoices, Muqawil sends them to ZATCA's platform on the Customer's behalf because Saudi law requires it.
7. Transfers outside the Kingdom
Customer Data is stored in Frankfurt, Germany, and some sub-processors operate outside the Kingdom. By choosing the Service, the Customer instructs Muqawil to make these transfers. Muqawil makes them only as allowed by Article 29 of the PDPL and the Regulation on Personal Data Transfer outside the Kingdom:
- limited to the data needed for the purpose of the Service;
- under the safeguards in Article 4 of the Regulation where it requires them. Where the Regulation requires SDAIA's Standard Contractual Clauses between the Customer and Muqawil, the parties agree that the controller-to-processor model is incorporated into these terms by reference, unchanged, with section 2 and section 5 of these terms serving as its annexes, and it prevails over these terms if they conflict. Muqawil puts the appropriate safeguard in place with its sub-processors;
- after the transfer risk assessment required by Article 7 of the Regulation, which Muqawil keeps up to date and summarises for the Customer on request so the Customer can complete its own assessment;
- encrypted in transit and at rest;
- biometric templates are never transferred, because Muqawil does not receive them.
If Saudi law comes to require storage inside the Kingdom, or a safeguard stops being valid, Muqawil will tell the Customer promptly and agree the steps needed, which may include moving storage into the Kingdom. The Customer's own duties for tax records stored inside the Kingdom are set out in section 8 of the Terms of Service.
8. Foreign laws and requests from authorities
Because some sub-processors are outside the Kingdom, the laws of their countries may allow public authorities there to request data from them. Muqawil chose providers that publish how they handle such requests and that commit to disclose only what the law strictly requires. If Muqawil receives a request from any authority for Customer Data, it will refer the authority to the Customer where possible, tell the Customer promptly unless the law forbids it, disclose only the minimum legally required, and challenge requests that appear unlawful.
9. Personal data breaches
If Muqawil becomes aware of a breach affecting Customer Data, it will inform the Customer without undue delay and no later than 48 hours after becoming aware, so the Customer can meet its duty to notify SDAIA within 72 hours. The notice will describe what happened, the categories and approximate number of people and records affected, the likely consequences, the steps taken and proposed to limit the harm, and a contact person. Where information is not yet available, Muqawil will send it as soon as possible. Muqawil will help the Customer notify SDAIA and the people affected, and keeps a record of the breach and the corrective steps.
10. Helping the Customer
- Data subject requests: the Service gives the Customer tools to find, export, correct and delete data. If a person sends Muqawil a request about Customer Data, Muqawil passes it to the Customer within 5 business days and does not answer it alone, unless the Customer asks it to.
- Muqawil helps the Customer, with the information it has, with impact assessments (for example for health data, continuous attendance monitoring or location stamping), transfer risk assessments, and questions from SDAIA or other competent authorities.
- Muqawil has a privacy contact who can be reached at privacy@muqawil.app.
- Help that needs unusual effort may be charged at a reasonable, agreed rate.
11. Sensitive data, biometrics and location
- Biometric attendance devices: the fingerprint or face templates stay on the device. Muqawil receives only the attendance record (employee number, time, device). The Customer is responsible for the lawful basis, explicit consent where required, the impact assessment and an alternative way to mark attendance for workers who do not consent.
- Location: the apps capture location only at the moment of an attendance mark or site report, only while the app is in use and with the user's permission; there is no background tracking.
- Health data and identity documents are visible only to users with the permission the Customer grants.
12. Return and deletion at the end
When the subscription ends, the Customer has 30 days of read-only access to export its data, and Muqawil helps with a full export on request. After that, Muqawil deletes Customer Data from its live systems within 90 days; backups are overwritten within their normal cycle (up to 7 days). Muqawil keeps Customer Data after that only where Saudi law requires Muqawil itself to keep it, and keeps it protected. On request, Muqawil confirms the deletion in writing. The Customer is responsible for keeping its own records (for example tax invoices and books) for the periods the law requires before the deletion.
13. Records, information and audits
Muqawil keeps a written record of its processing activities as Article 33 of the Implementing Regulation requires, for the duration of the processing and 5 years after it ends, and gives the Customer the information needed to show compliance with these terms. The Customer may audit compliance once a year, at its own cost, with at least 30 days' notice, during business hours and under confidentiality, in a way that does not put other customers' data at risk; written answers, documents and reports will be used first where they are enough. SDAIA may receive the same information on request.
14. The Customer's duties
- Have a lawful basis for all Customer Data and give its employees, workers and other data subjects the information the PDPL requires, including that their data is stored outside the Kingdom.
- For sensitive data and monitoring (biometrics, health data, location, continuous attendance): collect only what is needed, get explicit consent where required, and do an impact assessment where the law requires one.
- Keep copies of official identity documents only where a law requires it or a competent authority asks for it.
- Give only lawful instructions, keep users and permissions under control, remove users who leave, and keep sign-in details safe.
- Answer requests from its own data subjects, using the tools in the Service.
15. Liability, term and changes
These terms last as long as Muqawil processes Customer Data. The limits of liability in the Terms of Service apply to these terms, except where Saudi law does not allow it. Muqawil may update these terms to follow changes in the law or in the Service, with notice as described in the Terms of Service. If there is any difference between the Arabic and English versions, the Arabic version prevails.
16. Contact
privacy@muqawil.app (privacy and Data Protection Officer) · [LEGAL ENTITY NAME], Commercial Registration No. [CR NUMBER], [REGISTERED ADDRESS]