Data processing agreement

Contracting parties

This Data Processing Agreement ("DPA") is concluded between the customer identified in the account ("Customer", controller) and Alya Nexus Auditing, [[licence number]], [[registered address]], Dubai, United Arab Emirates ("Alya Books", "we"). ("Processor"). It forms part of the Terms of Service and applies to all personal data the Processor processes on behalf of the Customer.

01 · General

The Processor processes personal data only on the documented instructions of the Customer, in accordance with the PDPL and, where applicable, other data protection laws. The Terms, the settings the Customer makes in the application and API calls constitute instructions.

02 · Subject matter and duration

The subject matter is the provision of the Alya Books platform as described in the Terms. The DPA lasts for the term of the contract and until all personal data has been deleted or returned.

03 · Scope, nature and purpose

Categories of data subjects: the Customer's employees and members, its customers and suppliers and their contact persons, and other persons named in documents. Categories of data: identification and contact data, business data in invoices and documents, payment and bank transaction data, usage and log data. Purpose: creating, validating, submitting, receiving, storing and managing e-invoices and related documents, integrations and payments (Annex 1).

04 · Technical and organisational measures

The Processor implements the measures in Annex 2 and reviews them regularly. Changes may not reduce the level of protection.

05 · Rectification, restriction and erasure

The Customer performs rectification, restriction and erasure in the application. Where the Customer cannot, the Processor acts on instruction without undue delay. Documents subject to statutory retention are restricted rather than erased.

06 · Obligations of the Processor

• Confidentiality of all personnel with access to personal data.
• Support for the Customer's obligations regarding data subject rights, security, breach notification and impact assessments.
• Records of processing activities and cooperation with supervisory authorities.
• Information to the Customer if an instruction infringes data protection law.

07 · Sub-processors

The Customer authorises the sub-processors in Annex 3. The Processor informs the Customer of intended changes at least [[30]] days in advance; the Customer may object on reasonable grounds. Sub-processors are bound by obligations equivalent to this DPA.

08 · Audit rights

The Customer may verify compliance through the Processor's documentation and, where insufficient, through audits at reasonable intervals and on reasonable notice, at the Customer's cost, subject to confidentiality.

09 · Personal data breaches

The Processor informs the Customer of a personal data breach without undue delay and within [[48]] hours of becoming aware, with the information needed for the Customer's notifications to the authority and data subjects.

10 · Instructions

Instructions are given in writing or through the application. The Customer's contact for instructions is the organization owner.

11 · Support access

Support staff access Customer data only where necessary to resolve a request, on a least-privilege basis, and such access is logged. [[Describe impersonation/consent mechanism if implemented.]]

12 · Deletion and return

At the end of the contract the Customer exports its data through the application. The Processor deletes personal data [[30]] days after termination, except where retention is required by law, and confirms deletion on request.

13 · Remote work

Personnel working remotely use managed devices, encrypted connections and multi-factor authentication.

14 · Other provisions

Liability follows the Terms. The DPA is governed by the law that governs the Terms. In case of conflict, this DPA prevails over the Terms for matters of data protection.

Annex 1 · Personal data and purpose

Annex 2 · Technical and organisational measures

• Access control: authentication with email verification, role-based permissions, row-level security per organization, API keys with scopes and expiry.
• Encryption: TLS in transit; encryption at rest for database and storage; secrets stored encrypted.
• Integrity and traceability: audit log of financial actions, immutable issued documents, webhook signatures.
• Availability: daily backups, point-in-time recovery [[retention]], monitoring, incident response.
• Separation: production and test environments; test documents never reach the ASP.
• Organisation: confidentiality agreements, least privilege, regular review, secure development practices.

Annex 3 · Sub-processors