Data Processing Addendum

Parties: the customer ("Controller") and Kafu Technologies (Saudi limited liability company, Commercial Registration No. [CR-PENDING]) ("Processor"). Kafu acts as a "controller" only with respect to the customer team's account data (names, emails, passwords), and as a "processor" with respect to respondent and customer data the Controller inputs into the platform.

• Subject matter: operating surveys and market research initiated by the Controller.
• Duration: for the term of the agreement between the parties + the retention period in the Privacy Policy.
• Nature: storage, hosting, AI processing at the Controller's request, transmission to respondents, statistical aggregation.
• Categories of data subjects: survey respondents, the Controller's employees, the Controller's customers, verified panel members.
• Categories of personal data: whatever the Controller elects to collect via the survey (name, age, gender, region, free-text answers, etc.). Sensitive data only with explicit consent from the respondent.

The Processor processes personal data only on documented instructions from the Controller and the in-product survey configuration. If the Processor considers an instruction to violate PDPL, it notifies the Controller before proceeding.

The Processor is authorized to use the sub-processors listed below. Before adding a new sub-processor, the Controller is given at least 30 days notice, with a right to object on reasoned grounds. If no resolution is reached within 30 days, the Controller may terminate the agreement without penalty.

• AI model provider (United States) — running AI models.
• In-Kingdom cloud infrastructure provider (SCCC or equivalent) — database and object storage hosting.
• SAMA-licensed payment providers (Tap Payments, Moyasar, or equivalent).
• Email and SMS notification providers.

The Processor commits to applying the following technical and organizational controls as a minimum:

• Encryption at rest (AES-256) and in transit (TLS 1.2+).
• Role-based access control and environment separation (prod/test).
• Two-factor authentication available for administrative access, with full audit logging.
• Annual independent penetration testing, with an executive summary available to the Controller on request.
• Periodic personnel training on personal data protection and cybersecurity.
• Logical isolation of controller data (multi-tenant isolation) to prevent cross-tenant leakage.

The Controller may, once per year or upon reasonable suspicion of breach, request an audit of the Processor's operations. The audit is conducted by a mutually agreed independent third party, during business hours, without disrupting service. The Controller bears the audit cost unless a material breach is found.

In lieu of an on-site audit, a current SOC 2 report or the annual penetration test report may be provided to the Controller.

The Processor commits to notifying the Controller without undue delay — and in any case within 72 hours of discovery — of any breach affecting the Controller's personal data. The notification includes:

• Description of the incident, categories of affected data subjects, and approximate number.
• Likely consequences of the incident.
• Measures taken or proposed to mitigate.
• Contact details for the DPO or another point of contact for further information.

The duty to notify SDAIA and affected data subjects rests with the Controller as the responsible party. The Processor supports the Controller with the information required to perform these notifications.

Controller data is stored inside the Kingdom of Saudi Arabia by default. Any cross-border transfer (e.g. to our AI model provider) is governed by contractual safeguards equivalent to Standard Contractual Clauses, under PDPL Article 29 and SDAIA controls.

The Processor assists the Controller — with appropriate tools and within a reasonable timeframe — in responding to data subject requests (access, rectification, erasure, portability, objection). These tools are available in the tenant admin console (export, delete, restrict). If the Processor receives a direct request from a data subject, it forwards it to the Controller rather than responding directly.

Upon termination, the Controller may export all data within 30 days in a structured, open format. After that window, the Processor deletes all data copies from production and from rolling backups within the 35-day rotation cycle, unless the law requires longer retention.

The Processor provides a written certificate of deletion upon request.

The Processor ensures that every person authorized to process Controller data is bound by a written confidentiality agreement. This obligation survives the end of employment or the agreement.

This addendum takes effect when the customer accepts the terms of service, and continues until the agreement ends and all data has been deleted. All matters arising from it are governed by the laws of the Kingdom of Saudi Arabia, and the Commercial Courts in Riyadh have exclusive jurisdiction.

This addendum is accepted electronically when the customer accepts the terms of service and subscribes to a paid plan. Enterprise customers requiring a hand-signed copy may request one via sales@kafuapp.com.