Data Processing Agreement

Draft of September 14, 2026

Draft for review. This document has not yet been reviewed by a lawyer and is not in force. It is published so you can read what Hayatiq intends to offer; bracketed items are still to be settled, and the final text will be published before checkout opens.

This Data Processing Agreement (the DPA) is offered to organisations that use Hayatiq Financials to process personal data of their clients, their clients' people or their own staff, and that need a written processor agreement to do so. It supplements the Terms of Service and is explained in plain language by the Privacy Policy.

How to use this document. The DPA is available to customers on the Partner plan and [owner to decide: to Practice customers as well, or to any organisation on request]. To enter into it, print this page to PDF using the button above, complete Annex 4 and send it to hello@hayatiq.ai; Hayatiq countersigns and returns a copy. Until Hayatiq has countersigned, this page is a draft and the DPA is not in force between the parties. [Owner to decide whether the DPA instead takes effect automatically by acceptance of the Terms, in which case Annex 4 becomes an optional countersignature for customers who need a signed copy].

1. Parties

This DPA is between:

• Hayatiq: [registered name of the FZE that operates hayatiq.ai], a free zone establishment registered in Ajman, United Arab Emirates, at [registered address, Ajman, United Arab Emirates], the Processor; and
• Customer: the organisation named in Annex 4 that holds the Hayatiq Financials account, the Controller (or, where the Customer is itself a processor for its clients, a processor instructing Hayatiq as sub-processor; the term Controller is used for both below).

2. Definitions

Words defined in the Terms of Service have the same meaning here. In addition:

• Data Protection Law means every law that applies to the processing of Personal Data under this DPA, including the Saudi Personal Data Protection Law and its Implementing Regulations (PDPL), the EU General Data Protection Regulation and the UK GDPR (GDPR), and any other law the parties identify in Annex 4.
• Personal Data means any information relating to an identified or identifiable natural person that Hayatiq processes for the Customer through the Service; the categories are in Annex 1.
• Processing, Controller, Processor, Data Subject, Personal Data Breach and Supervisory Authority have the meanings given in Data Protection Law.
• Sub-processor means a third party engaged by Hayatiq to process Personal Data for the Customer; the current list is Annex 3.
• Engagement Data means the Customer Data in an engagement: canonical balance rows, the confirmed mapping, questionnaire answers, the cash-flow worksheet and note tables, and any names of people in them.

3. Scope, roles and precedence

1. This DPA applies to Personal Data that Hayatiq processes on the Customer's behalf in providing the Service, as described in Annex 1. It does not apply to data of which Hayatiq is the controller (account, billing, waitlist and support data), which the Privacy Policy covers.
2. The Customer is the Controller and Hayatiq is the Processor of Engagement Data. The Customer warrants that it has a lawful basis, and has given any notice and obtained any consent Data Protection Law requires, for entering Personal Data into the Service and for the transfers in section 12.
3. If this DPA conflicts with the Terms of Service, this DPA prevails for the processing of Personal Data. If it conflicts with standard contractual clauses incorporated under section 12, those clauses prevail.

4. Details of the processing

The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of Data Subjects are set out in Annex 1. The Service is built so that most processing happens on the Customer's own device: Hayatiq processes Engagement Data only at the four points where the Customer sends it — save, assistant, note narrative, export — as Annex 1 describes.

5. The Customer's instructions

1. Hayatiq processes Personal Data only on the Customer's documented instructions, which are: the Terms of Service, this DPA, the Customer's use of the Service's features (saving, exporting, the no-storage flag, deleting an engagement, and, once enabled, the assistant), and any further written instruction the parties agree.
2. Hayatiq will tell the Customer if, in its opinion, an instruction infringes Data Protection Law, and may suspend that instruction until it is resolved.
3. Hayatiq does not use Personal Data for any purpose of its own, does not sell it, and does not use it to train any model.

6. Hayatiq's obligations

Hayatiq will:

1. process Personal Data only as section 5 allows, and only for as long as the Customer's account and the retention rules in the Privacy Policy require;
2. ensure that people authorised to process Personal Data are bound by confidentiality (section 7);
3. implement the security measures in Annex 2 (section 8);
4. engage Sub-processors only under section 9;
5. assist the Customer with Data Subject requests (section 10) and, taking into account the nature of the processing and the information available to Hayatiq, with the Customer's obligations on security, breach notification, data protection impact assessments and prior consultation with a Supervisory Authority (sections 8, 11 and 13);
6. notify the Customer of Personal Data Breaches (section 11);
7. delete or return Personal Data at the end of the Service (section 14); and
8. make available the information needed to demonstrate compliance with this DPA and allow audits (section 13).

7. Personnel and confidentiality

Hayatiq is operated by a small team. Every person with access to Personal Data, including any contractor, is bound by a written confidentiality obligation that survives the end of their engagement, has access only to what their role needs, and accesses production data only for support, security or legal reasons and never for curiosity or testing. Development and testing use synthetic fixture data only; no Personal Data is copied into a development environment. [Owner to confirm who today holds production access and that a written confidentiality undertaking exists for each of them].

8. Security

1. Hayatiq maintains the technical and organisational measures in Annex 2, which separates the measures implemented at the date of this draft from those planned. Hayatiq does not represent a planned measure as in place. Hayatiq will not save Personal Data of real clients before the planned measures marked "before first real client data" in Annex 2 are in operation.
2. Hayatiq may update Annex 2 as the product develops, provided the overall level of protection does not fall. The current version is always at financials.hayatiq.ai/en/dpa with its date.
3. The Customer is responsible for the security of its own devices, browsers and accounts, for the drafts held in its browsers before saving, for who it invites to its organisation and the roles it gives them, and for the choices it makes in the Service (including whether to use the no-storage flag).

9. Sub-processors

1. The Customer gives Hayatiq general authorisation to engage the Sub-processors in Annex 3 and any replacement or addition under this section.
2. Hayatiq will give the Customer at least [thirty (30) days'] written notice (by e-mail to the account owner, and by updating Annex 3 at the URL above) before a new or replacement Sub-processor processes Personal Data. The Customer may object in writing, on reasonable data-protection grounds, within that period. If the parties cannot resolve the objection in good faith, the Customer may terminate the affected subscription with a pro-rata refund of prepaid fees for the unused period, as its sole remedy.
3. Hayatiq will impose on each Sub-processor, by written contract, data-protection obligations that are no less protective than this DPA, and remains liable to the Customer for the Sub-processor's performance.

10. Data Subject requests

If Hayatiq receives a request from a Data Subject relating to Engagement Data (at privacy@hayatiq.ai or otherwise), it will not answer it on the Customer's behalf, will tell the Customer within [five (5) business days], and will help the Customer answer it. Because the Customer can itself view, edit and delete every engagement in the Service, most requests can be met without Hayatiq's involvement; where that is not enough, Hayatiq provides reasonable assistance at no charge, and may charge [a reasonable fee — lawyer to set the basis] for assistance that is excessive or repetitive.

11. Personal Data Breaches

1. Hayatiq will notify the Customer without undue delay and no later than [forty-eight (48) hours — lawyer to set, noting the 72-hour deadline that applies to a Controller under the GDPR and the timing that applies under the PDPL] after becoming aware of a Personal Data Breach affecting the Customer's Personal Data.
2. The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point; information Hayatiq does not yet have follows as it becomes available.
3. Hayatiq will cooperate with the Customer's investigation and with any notification the Customer must make to a Supervisory Authority or to Data Subjects. Hayatiq's notice is not an admission of fault.

12. International transfers

1. Storage. Hayatiq stores Personal Data on Supabase in Frankfurt, Germany. Sub-processors in other countries receive only what Annex 3 describes.
2. Saudi Arabia. Where the Customer is established in the Kingdom, or the Personal Data relates to people in the Kingdom, the transfer to Hayatiq and its Sub-processors is a transfer outside the Kingdom under the PDPL. The parties enter into the SDAIA Standard Contractual Clauses for that transfer, which are incorporated into this DPA as [Annex 5 — lawyer to attach the current SDAIA SCC text with the parties and the processing details completed, and to confirm any transfer risk assessment and registration or representative obligation. At the draft date the SCCs are not yet executed and are on Hayatiq's launch checklist]. Where the clauses require it, the Customer as data exporter and Hayatiq as data importer complete the annexes to those clauses using Annex 1 and Annex 3 of this DPA.
3. EU and UK. Where the GDPR applies to the Customer, the transfer from the Customer to Hayatiq (established in the United Arab Emirates) and onward to Sub-processors outside the EEA or the UK relies on: [lawyer to select and attach — the European Commission's Standard Contractual Clauses (Module 2, controller to processor, or Module 3 where the Customer is a processor) with the UK International Data Transfer Addendum where relevant, completed with Annex 1 and Annex 3 — the United Arab Emirates holds no EU or UK adequacy decision as far as Hayatiq is aware at the draft date, lawyer to confirm]. Hayatiq relies on each Sub-processor's own transfer mechanism (EU SCCs, UK addendum or Data Privacy Framework certification) for the onward transfer, as recorded in Annex 3.
4. Hayatiq will tell the Customer if it can no longer comply with the clauses under this section, and the Customer may then suspend the transfer and terminate the affected subscription.

13. Audit and information

1. On written request, no more than [once in any twelve (12) months] unless a Supervisory Authority requires otherwise or a Personal Data Breach has occurred, Hayatiq will answer a reasonable written security questionnaire and provide the documentation listed in Annex 2 (including the results of the automated row-level-security suite for the current release) and the security documentation its Sub-processors publish.
2. Where that information is not enough to demonstrate compliance with this DPA, the Customer (or an independent auditor bound by confidentiality) may audit Hayatiq's processing, on [thirty (30) days'] notice, during business hours, at the Customer's cost, without access to other customers' data and without disrupting the Service. Hayatiq's infrastructure is operated by its Sub-processors; an audit of their facilities is limited to the reports and certifications they make available.

14. Return and deletion

1. The Customer can delete any engagement, and with it its Engagement Data, at any time in the Service. The no-storage flag, once the purge job is in operation (Annex 2), removes an engagement's snapshots, mappings, worksheets, answers, review notes and export files after generation while keeping the engagement record, upload metadata, export records and the mapping template.
2. On termination of the Service, Hayatiq will, at the Customer's choice made within [thirty (30) days], return the Customer's saved engagements as exported files and then delete them, or delete them without return. After that period Hayatiq deletes all Personal Data and existing copies, except what Data Protection Law or the Customer's billing history requires Hayatiq to keep, which remains subject to this DPA. Deleted rows may persist in database backups for the recovery window stated in Annex 2 and are then overwritten.

15. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, which apply in aggregate across the Terms and this DPA, [lawyer to confirm whether any liability under the standard contractual clauses in section 12, or towards Data Subjects, must be carved out of the cap under the applicable law].

16. Term and termination

This DPA takes effect on the date in Annex 4 (or, if the owner elects automatic effect, on the Customer's acceptance of the Terms) and lasts as long as Hayatiq processes Personal Data for the Customer, including the return-and-deletion period in section 14.

17. Governing law

This DPA is governed by the law and subject to the courts or arbitration chosen in the Terms of Service, [lawyer to confirm; the SDAIA SCCs and the EU SCCs carry their own governing-law clauses that prevail for the transfers they cover].

Annex 1 — Details of the processing

Annex 2 — Security measures

Hayatiq does not represent a planned measure as in place. Dated 14 September 2026.

Implemented today

Planned

Annex 3 — Sub-processors

Notice of changes: section 9. Dated 14 September 2026.

Each Sub-processor's published security and privacy documentation: Supabase, Vercel, Anthropic, Resend, Paddle, Cloudflare.

Annex 4 — Execution

[Annex 5 — SDAIA Standard Contractual Clauses (lawyer to attach; see section 12.2)]. [Annex 6 — EU Standard Contractual Clauses and UK Addendum, if selected (lawyer to attach; see section 12.3)].