Data processing agreement

This agreement forms an integral part of the Terms and conditions and governs the processing of the personal data that the customer enters in its site on the Sahl service. It is made between the customer, as controller, and [the company's legal name], registered under commercial registration No. [the commercial registration number], with its national address at [the national address], as processor.

This agreement is written for the Personal Data Protection Law issued by Royal Decree No. M/19 dated 9/2/1443H and its amendments, and its Implementing Regulations. The customer accepts it by accepting the terms electronically at sign up, and that acceptance has the effect of a signature.

1. Definitions

The following words and expressions, wherever used in this agreement, have the meanings set out below:

1. The Law: the Personal Data Protection Law, its Implementing Regulations, the Regulation on Personal Data Transfer outside the Kingdom, and the rules and instructions issued under them.
2. The Authority: the Saudi Data and Artificial Intelligence Authority (SDAIA).
3. The customer: the entity subscribed to the Sahl service under the terms, which is the controller of the customer personal data.
4. Sahl: [the company's legal name], which is the processor of the customer personal data.
5. The terms: the terms and conditions published on the Terms and conditions page, and the subscription orders related to them.
6. The service: Sahl's cloud HR service, including the customer's site and the phone app.
7. The customer's site: the separate site and separate database assigned to the customer on the service.
8. Customer personal data: the personal data that the customer or its users enter in the customer's site, or that the service creates there while it is used.
9. Users: the people the customer allows into its site, including HR staff, managers and employees.
10. Sub-processor: any party that Sahl engages and that receives customer personal data in order to provide the service.
11. Breach: any incident that leads to the disclosure of, access to, destruction, loss or alteration of customer personal data without lawful authorisation.

The expressions controller, processor, data subject, processing and sensitive data have the meanings given to them in the Law.

2. Scope and duration

This agreement applies to all processing of customer personal data by Sahl, including during the free trial.

It starts on the date the customer accepts the terms and remains in force for as long as Sahl processes customer personal data. This includes the period during which the data is kept after the subscription ends or is suspended, until it is deleted under section 14. Obligations that by their nature continue, including confidentiality, survive after that.

This agreement does not apply to the data that Sahl processes as a controller, such as sign up data, billing data and the customer's contact persons. That data is governed by the Privacy policy.

3. Roles of the parties

The customer is the controller of the customer personal data. It determines the purposes and means of processing, and decides what it enters in its site, who can see it, and how long it is kept.

Sahl is a processor that processes this data on behalf of the customer and for its account only. Sahl does not determine the purposes of processing, does not use the data for its own purposes, does not sell it, and does not combine it with another customer's data.

Sahl counts the active employees in the customer's site every day to issue the invoice under the terms. This count is a total number and contains no personal data.

4. Nature and purpose of processing

The purpose of processing is to provide the service to the customer under the terms and under the settings the customer chooses in its site.

The nature of processing includes:

1. Hosting, storage, organisation and display.
2. Calculating leave, payroll, end of service, social insurance (GOSI) and deductions under the customer's settings.
3. Routing requests to the people with authority to approve them, and keeping the history of each request.
4. Sending sign-in codes and notifications to users.
5. Producing letters, reports and statements.
6. Export, backup and deletion.
7. Providing the technical support the customer asks for.

Processing is mostly automated through the service. Sahl's staff carry it out manually only to give support the customer asks for, or to keep the service running and secure.

5. Categories of data subjects and of personal data

The categories of data subjects are:

1. The customer's employees and former employees.
2. Candidates for jobs with the customer.
3. Employees' family members registered as dependants, including children.
4. Users of the customer's site.

The categories of personal data are:

1. Identity data: name, employee number, national ID, iqama and passport numbers and their expiry dates, nationality, gender and date of birth.
2. Contact data: mobile number, email and address.
3. Employment data: job, department, branch, manager, contract and its dates, performance reviews, training, letters, penalties, statements and end of service.
4. Financial data: salary and allowances, bank IBAN, GOSI details, advances and expenses.
5. Leave and attendance data: leave balances and requests, and check-in times.
6. Location data: the employee's location at the moment of check-in, and the signals used to detect fake GPS, only where the customer turns location on.
7. Documents and their files: ID, iqama, passport, contracts and certificates.
8. Custody, vehicle and housing data.
9. Insurance data: insured members and dependants, including family members' names and dates of birth.
10. Signatures: the picture of a signature that the person draws or uploads.
11. Recruitment data: CVs, contact details, interview notes, assessments and offers.

This data includes sensitive data under the Law, namely the health data in the medical notes attached to sick leave requests.

Some data needs particular care because its disclosure has a high impact, even where it is not sensitive data as the Law defines it. This includes ID, iqama and passport numbers, location, family members' data, in particular children's data, and financial data.

The customer alone decides which of this data it enters in its site, and whether to turn location on.

6. Processing on the customer's documented instructions

Sahl processes customer personal data only on the customer's documented instructions. The following count as documented instructions:

1. The terms and this agreement.
2. The settings the customer chooses in its site, including permissions, the features turned on and retention periods.
3. The use of the service by the customer and its users, including entering, importing, exporting and deleting data, and submitting and approving requests.
4. Written instructions sent to Sahl by a person with authority to do so at the customer, where they are consistent with the features of the service.

If Sahl considers that an instruction of the customer breaches the Law, it informs the customer, and it may decline to carry out the instruction until the customer amends it to comply with the Law.

If a law or a court decision requires Sahl to carry out processing the customer has not asked for, Sahl informs the customer before the processing, unless the Law prohibits it from doing so.

Sahl is not obliged to carry out instructions that require developing features that do not exist in the service, unless the parties agree in writing.

7. Confidentiality of staff

Sahl limits access to customer personal data to the members of its staff who need it, and only as far as their work requires.

Sahl's staff with access to this data are bound by confidentiality. They do not open the customer's site except to give support the customer asks for, or to keep the service running and secure.

Only the built-in Administrator account opens the underlying Frappe screens. All other users work inside the Sahl interface.

8. Security measures

Sahl applies appropriate organisational and technical measures to protect customer personal data, in proportion to its nature and to the risks of processing it. The main measures are:

1. A separate site and a separate database for each customer.
2. Encrypted connections using HTTPS across the whole service.
3. Passwords stored hashed, in a form that cannot be read.
4. Secret keys of the customer's own services stored encrypted and never shown again.
5. Permissions for HR staff for each section, set to none, view or manage, which can be limited to particular branches or departments.
6. Employee sign-in with a one-time code, and a separate key for each phone that the person or HR can remove.
7. A history for each request showing who sent it, who approved it and when, and a note on the person's record of changes made through the AI.
8. Automated daily backups kept off the main server and in the Kingdom, and a backup before every update.

Sahl may develop and update these measures, provided that the overall level of protection is not reduced. For more details, see the Security page.

9. Sub-processors

The customer agrees that Sahl may engage the parties listed in the table below. These are the parties that may receive customer personal data:

Sahl does not engage the last three parties on its own initiative. The customer decides to turn them on with its own key or account, and their processing is governed by the customer's own contract with them. Sahl sends them only what the feature the customer turned on requires.

Sahl imposes on the sub-processors it engages data protection obligations no less protective than those the Law requires. Sahl remains responsible to the customer for its obligations under this agreement.

Sahl gives the customer at least 30 days' notice by email before adding any sub-processor that receives customer personal data. The customer may object in writing within that period on reasonable grounds related to data protection. The parties will then consult in good faith to find a solution. If they cannot, the customer may end its subscription before the new sub-processor starts processing its data, and the provisions of the terms apply to the amounts already paid.

10. Transfers outside the Kingdom

Customer personal data is hosted on servers in Jeddah, Saudi Arabia, in Oracle Cloud's Jeddah region, and its backups are kept in the Kingdom. Sahl commits to keeping customer data in Saudi Arabia.

Customer personal data is transferred outside the Kingdom only in the following two cases:

1. Phone notifications: the notification's title and short text are sent through Google Firebase Cloud Messaging to be delivered to the user's phone. The transfer is limited to this and to what is technically needed to deliver it, and Sahl takes the steps required by the Regulation on Personal Data Transfer outside the Kingdom.
2. Services the customer turns on with its own keys: if the customer turns on Google Gemini, or connects an accounting system whose servers are outside the Kingdom, the decision to make that transfer is the customer's. The customer is responsible for assessing its lawfulness and for its contract with that party.

Sahl does not transfer customer personal data outside the Kingdom in any other case.

11. Assistance with data subject requests

If a request from a data subject about customer personal data reaches Sahl, Sahl passes it to the customer without undue delay. Sahl does not answer the substance of the request itself. It only directs the person to the customer, unless the customer instructs otherwise in writing.

Sahl helps the customer answer these requests with the tools the service provides, including:

1. Exporting a person's data and documents.
2. Correcting and updating data.
3. Erasing candidates' data under the retention period the customer sets.

Sahl gives reasonable further assistance at the customer's request where these tools are not enough. The customer remains responsible for answering requests within the periods the Law sets.

12. Personal data breaches

If Sahl becomes aware of a breach affecting customer personal data, it notifies the customer without undue delay and within 48 hours of becoming aware of it. The notice is sent to the email address registered in the customer's account.

The notice contains the following information, as far as Sahl has it:

1. A description of the breach and its nature, when it occurred and when it was discovered.
2. The categories of data subjects affected and their approximate number.
3. The categories of data affected and the approximate number of records.
4. The likely consequences of the breach.
5. The measures Sahl has taken or proposes to address the breach and reduce its effects.
6. The name of the person at Sahl who can be contacted for more information.

If not all of this information is available at the first notice, Sahl provides it in stages as soon as it becomes available.

The purpose of this period is to allow the customer to notify the Authority within the 72 hours set by the Implementing Regulations, and to notify the affected data subjects where required. The customer, as controller, makes both notifications. Sahl does not notify the Authority or the data subjects on the customer's behalf unless the customer asks in writing or the Law requires Sahl to do so.

Sahl takes reasonable steps to contain the breach and investigate its causes, and cooperates with the customer in doing so. Sahl's notice of a breach is not an admission of liability for it.

13. Assistance with impact assessments and Authority inquiries

Sahl gives the customer the reasonable information it needs to prepare a personal data protection impact assessment where the Law requires one. This includes a description of the processing, the security measures and the sub-processors.

Sahl cooperates reasonably with the customer in answering inquiries from the Authority about customer personal data. If the Authority contacts Sahl directly about this data, Sahl informs the customer, unless the Law prohibits it from doing so.

14. Return and deletion at the end of the service

The customer can export its data at any time while its site is active or read only. The export covers people, requests, payroll and reports in Excel format, and documents. Sahl advises the customer to export its data before its subscription ends.

After the subscription is terminated or suspended, Sahl keeps the customer personal data for at least 90 days. If the suspension is for late payment, the site opens again as soon as it is paid. After that period, Sahl may delete the data, after giving the customer notice by email.

Backups roll off on the hosting provider's regular schedule. Until they roll off, they remain protected by the same measures and are not used for any other purpose.

The above does not apply to what the Law requires Sahl to keep, which Sahl continues to protect under this agreement. Sahl confirms to the customer that deletion is complete when the customer asks.

15. Information and audit

At the customer's request, Sahl provides the reasonable information needed to demonstrate its compliance with this agreement. This includes this agreement, the Security page and answers to reasonable security questionnaires.

The customer may, at its own cost, audit Sahl's compliance with this agreement, or appoint an independent auditor bound by confidentiality to do so. The audit is subject to the following conditions:

1. Reasonable prior written notice to Sahl.
2. No more than once a year, unless it follows a breach affecting the customer's data or the Authority requires it.
3. It takes place during working hours and without disrupting the service.
4. It does not cover the data of any other customer.
5. For data centres and the hosting provider, it relies on the information and reports that the sub-processors make available.
6. Its results are treated as confidential.

16. The customer's obligations

As controller, the customer undertakes:

1. To have a legal basis for collecting and processing customer personal data, in particular sensitive data, location data and family members' data.
2. To inform its employees, its candidates and, where needed, their family members, of the processing of their data and its purposes, of its use of Sahl as processor, and of the location and AI features if it turns them on.
3. To check that the data it enters is accurate, complete and up to date.
4. To enter only the data it needs for its purposes.
5. To set suitable retention periods, including the retention period for candidates' data.
6. To set its users' permissions, keep their accounts safe, and remove the phone keys of people who leave. The customer is responsible for what its users do.
7. To manage its relationship with the parties it turns on with its own keys, and to bear responsibility for its decision to send data to them.
8. To answer data subject requests, and to notify the Authority and data subjects of breaches, where required.
9. To avoid sending its employees' personal data in support messages by email or WhatsApp, and to describe the problem instead, unless sending the data is necessary.
10. To meet all other obligations of a controller under the Law, including registration with the Authority and appointing a personal data protection officer where required.

17. Liability

Each party's liability under this agreement is subject to the liability provisions of the Terms and conditions. The cap on that liability is a single cap for the terms and this agreement together, not a separate cap for each.

Under the terms, Sahl's total liability does not exceed what the customer paid in the 12 months before the event. Sahl is not liable for indirect losses, including lost profit and lost data beyond restoring the latest backup. These limits do not apply in cases of wilful misconduct or gross negligence, or where the Law does not allow liability to be limited.

18. Precedence

This agreement forms part of the terms. If a provision of this agreement conflicts with a provision of the terms on a matter of personal data protection, this agreement prevails. On all other matters, the terms apply.

If any provision of this agreement or of the terms conflicts with a mandatory provision of the Law, the Law prevails.

19. Changes to this agreement

Sahl may change this agreement by giving the customer at least 30 days' notice by email before the change takes effect, as the terms provide. Continuing to use the service after the effective date means acceptance of the change. A customer who does not accept the change may cancel its subscription.

Updates to the list of sub-processors are subject to section 9.

20. Governing law and language

This agreement is governed by and interpreted under the laws of the Kingdom of Saudi Arabia. The parties will try to settle any dispute arising from it amicably within 30 days. If that fails, the competent courts in Riyadh have jurisdiction.

This agreement is made in Arabic and English. The Arabic text prevails in case of any difference.

Notices to the customer are sent to the email address registered in its account, and notices to Sahl are sent to [the email address].

This English text is a translation. The Arabic text prevails. العربية