Data Processing Agreement

You are the data controller. You decide what personal data goes into Tadbir ERP and why. Fast Resources and Management for Information Technology Company is the data processor: we hold and process it on your instructions, to provide the platform, and for nothing else.

The distinction matters because the obligations differ. Your employees' and customers' rights run against YOU, and we are obliged to help you answer them — which is what this agreement is for.

For a customer in Saudi Arabia, the statute that applies is Saudi Personal Data Protection Law (PDPL), and the authority is the Saudi Data & AI Authority (SDAIA).

We also act as controller for a narrow set of our own data — your account and billing contacts, and the records we are required to keep. That is covered by our Privacy Policy, not by this agreement.

Subject matter and duration: providing the Tadbir ERP platform, for as long as your subscription is active and for the retention period afterwards set out below.

Categories of data subject, in practice:

• your own staff — the people who log in, and the employees in your HR and payroll records;
• your customers and suppliers, as named on your quotations, invoices and contacts;
• anyone else you choose to record in the system.

Categories of personal data, in practice:

• identity and contact details — names, e-mail addresses, telephone numbers, addresses;
• employment data — job titles, salaries, leave, attendance, end-of-service calculations;
• government identifiers you choose to store, such as a national identity number;
• financial data — bank details you record, invoice and payment history.

The HR module has optional fields for religion, blood group and disability, which are off unless you enable them, and the attendance app can store a selfie with each check-in. If you use them you are responsible for having a lawful basis.

We will:

• process personal data only on your documented instructions, and only to provide the platform;
• never sell it, never rent it, and never use it to train a model;
• keep it confidential, and require the same of every member of staff who can reach it;
• tell you if we believe an instruction of yours would breach the law that applies to you, rather than simply carrying it out;
• help you answer a request from one of your people, and help you with an impact assessment if you have to do one.

These are the measures actually in place, not a list of intentions:

• every company gets its own separate database — your records are not in a shared table with another customer's;
• TLS/HTTPS on all traffic; identity numbers, bank account numbers (IBAN) and stored integration credentials are encrypted in the database with AES-256-GCM;
• role-based access control, so a member of your staff sees only what their role allows;
• an audit log of every create, update and delete — who, what, when, and the values before and after;
• daily backups, held in the same country as the live data;
• our staff open your workspace only to resolve a support request, and actions taken through our admin panel are logged.

You authorise us to use the sub-processors named in our Privacy Policy, which lists each one and what it receives. The list is the one we maintain; it is not a category description.

Your business records — every company database, uploaded document and backup — are stored on servers in Riyadh, Saudi Arabia, hosted by Alibaba Cloud (Saudi Cloud Computing Company). Saudi customers' data stays in the Kingdom, in line with the PDPL. A few supporting services (e-mail delivery, error monitoring, phone push notifications) operate outside the Kingdom and handle limited operational data; they are listed in our Privacy Policy.

We will update that list before adding a sub-processor that handles personal data. If you object to a new one, tell us and you may end your subscription under the refund policy; we will not add one and present it as a fact afterwards.

A sub-processor is bound to the same obligations we owe you, and we remain answerable to you for what it does.

Your business records — every company database, uploaded document and backup — are stored on servers in Riyadh, Saudi Arabia, hosted by Alibaba Cloud (Saudi Cloud Computing Company). Saudi customers' data stays in the Kingdom, in line with the PDPL. A few supporting services (e-mail delivery, error monitoring, phone push notifications) operate outside the Kingdom and handle limited operational data; they are listed in our Privacy Policy.

For a customer in Saudi Arabia, your business records are stored and processed inside the Kingdom. The supporting services named in our Privacy Policy that operate outside the Kingdom handle limited operational data only.

No adequacy finding, standard contractual clauses or transfer mechanism are claimed by this document. If your market requires one, ask us before you sign and we will put the actual position in writing.

If one of your employees or customers asks us directly for their data, we will not answer them on your behalf. We will tell them to approach you, and tell you that they asked.

The platform itself is the main way we help you answer them: you can search, export and correct any record in it without us. Where you need something the product cannot do, write to privacy@tadbirerp.com and we will help within the period your own law gives you.

If we become aware of a breach affecting personal data you have put into the platform, we will notify you without undue delay, with what we know at the time: what happened, which data and how many records are involved as far as we can tell, what we have done, and what we recommend you do.

Reporting to the authority is yours to do, because you are the controller — and the deadline for it is set by your own law, not by us. We will give you what you need to make that report.

We will not wait until we have a complete picture before telling you. A partial notice you can act on beats a complete one that arrives late.

You can export your data from the platform at any time while your subscription is active.

After a subscription ends, your business data is kept for 90 days so that you can export it, and is then deleted; backup copies are overwritten within a further 90 days.

After a free trial ends, the workspace becomes read-only and the data is kept so that you can subscribe or export it. You can ask us to delete it at any time.

Two things outlive that window, and both are deliberate. Financial documents are retained where the law requires it — in Saudi Arabia that is several years for tax records. And anonymised, aggregated usage figures that cannot identify anybody may be kept indefinitely.

Inside a live workspace, deleted contacts are removed permanently after 30 days; other records remain in the audit trail.

You may ask us, once in any twelve months, for the information you need to satisfy yourself that we are doing what this agreement says. We will answer in writing.

We will also allow and contribute to reasonable audits, including inspections, by you or an auditor you appoint, on reasonable notice.

We do not hold an ISO 27001 or SOC 2 certificate today. Saying so is more useful to you than implying one: if a certificate is a condition of your purchase, you need to know now rather than at the point of signing.

This agreement takes effect alongside our Terms of Use and Privacy Policy. Where it says something different from them about personal data, this agreement governs.

The data-protection law that applies to the personal data itself is Saudi Personal Data Protection Law (PDPL), or your own country's law where it applies to you as controller. That does not change with this clause.

This agreement is governed by the laws of the Kingdom of Saudi Arabia, and any dispute about it is subject to the exclusive jurisdiction of the competent courts of Saudi Arabia.