Data Processing Agreement

1. Definitions

Capitalized terms not defined here have the meaning given in the Terms of Service.

• "Data Protection Laws" means all applicable laws relating to the processing of Personal Data, including, where applicable, the UAE Federal Decree-Law No. 45 of 2021 (PDPL) and, where a Customer's own obligations require it, the EU/UK GDPR.
• "Controller," "Processor," "Data Subject," "Personal Data," "Personal Data Breach," and "Processing" have the meanings given in applicable Data Protection Laws.
• "Customer Personal Data" means Personal Data contained in Customer Data that 2Capacity Processes on Customer's behalf in providing the Service.
• "Sub-processor" means a third party engaged by 2Capacity to Process Customer Personal Data.

2. Scope & Roles

This Data Processing Agreement ("DPA") applies to the extent 2Capacity Processes Customer Personal Data in the course of providing the Service under the Terms of Service or an applicable Order Form (the "Agreement"). The parties agree that, in relation to Customer Personal Data, Customer is the Controller (or, where applicable, processor acting on behalf of a further controller) and 2Capacity is the Processor. Nothing in this DPA affects the parties' relationship with respect to 2Capacity's own account, billing, and marketing data, for which 2Capacity acts as Controller under the Privacy Policy.

3. Processing on Instructions

2Capacity will Process Customer Personal Data only: (1) to provide, secure, and support the Service; (2) in accordance with Customer's documented instructions, which include the Agreement and Customer's ordinary use of Service features and configuration; and (3) as required by applicable law, in which case 2Capacity will inform Customer of that legal requirement before Processing, unless the law prohibits such notice. 2Capacity will promptly notify Customer if it believes an instruction infringes Data Protection Laws.

4. Confidentiality of Personnel

2Capacity will ensure that personnel authorized to Process Customer Personal Data are subject to a binding duty of confidentiality and receive appropriate training on handling Personal Data.

5. Security Measures

2Capacity will implement and maintain the technical and organizational measures described in Annex II, designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, appropriate to the risk.

6. Sub-processors

Customer provides general authorization for 2Capacity to engage the Sub-processors listed in Annex III, and any additional Sub-processors, provided 2Capacity imposes data protection obligations on each Sub-processor materially no less protective than this DPA and remains liable for their performance. 2Capacity will give Customer at least 15 days' notice (by email or in-product notice) before engaging a new Sub-processor, during which Customer may object on reasonable data-protection grounds; the parties will work in good faith to resolve the objection, failing which Customer may terminate the affected Service as its exclusive remedy.

7. Assistance with Data Subject Rights

2Capacity will provide reasonable technical and organizational assistance to help Customer respond to requests from Data Subjects (such as access, correction, deletion, or portability requests) relating to Customer Personal Data, through Service functionality or, where that is not sufficient, other reasonable means. If 2Capacity receives a Data Subject request directly and can identify Customer, it will redirect the request to Customer without responding, except as required by law.

8. Personal Data Breach Notification

2Capacity will notify Customer without undue delay, and in any case within 72 hours of becoming aware, of any confirmed Personal Data Breach affecting Customer Personal Data, and will provide information reasonably available to it to help Customer meet its own notification obligations, including the nature of the breach, likely consequences, and measures taken or proposed. 2Capacity will take reasonable steps to contain, investigate, and remediate the breach.

9. Data Protection Impact Assessments

2Capacity will provide reasonable cooperation to Customer, at Customer's expense for anything beyond standard documentation, in connection with any data protection impact assessment or prior consultation with a supervisory authority that Customer reasonably considers necessary in relation to the Service.

10. International Transfers

2Capacity may Process Customer Personal Data outside Customer's country, including in the United Arab Emirates and countries where Sub-processors listed in Annex III operate. Where Data Protection Laws require a specific transfer mechanism (such as Standard Contractual Clauses), the parties agree to execute or rely on the appropriate mechanism, which is incorporated into this DPA by reference to the extent required.

11. Audit Rights

On reasonable prior notice, and no more than once per 12-month period (unless required by a supervisory authority or following a Personal Data Breach), 2Capacity will make available information reasonably necessary to demonstrate compliance with this DPA, which may be satisfied by providing a summary of relevant security certifications, audit reports, or completed security questionnaires, or by permitting an on-site or remote audit conducted in a manner that minimizes disruption to 2Capacity's business and does not expose other customers' data.

12. Return & Deletion of Data

Following termination of the Agreement, 2Capacity will make Customer Personal Data available for export for 30 days, after which it will delete or anonymize Customer Personal Data within a further 60 days, except to the extent retention is required by applicable law, in which case 2Capacity will continue to protect it under this DPA for as long as it is retained.

13. Liability

Each party's liability arising out of this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service or MSA, as applicable.

14. Term

This DPA takes effect on the date Customer first accepts the Terms of Service or an Order Form referencing it, and remains in effect for as long as 2Capacity Processes Customer Personal Data on Customer's behalf.

Annex I — Details of Processing

Annex II — Technical & Organizational Measures

• Encryption: data encrypted in transit (TLS) and at rest.
• Access control: role-based access, unique credentials, and periodic access review for 2Capacity personnel.
• Network security: firewalled hosting environment with logging and monitoring of administrative access.
• Application security: secure development practices and periodic vulnerability review.
• Availability: regular backups and a documented disaster-recovery process.
• Incident response: a documented process for detecting, triaging, and notifying Personal Data Breaches per Section 8.
• Personnel: confidentiality obligations and security awareness training for staff with data access.

Annex III — Authorized Sub-processors

Third-party integrations (WhatsApp, Google, DocuSign) act as Sub-processors only with respect to data flows Customer actively enables; Customer's own use of those platforms is separately governed by their terms.