Data Processing Addendum

This Addendum is entered into between the customer that has accepted the Terms of Service for business purposes (“Customer”) and Ajeeeb, a company established in the Sultanate of Oman (“Ajeeeb”). It governs personal information that Customer and its users submit to the service as inputs or receive from it as results (“Customer Data”). Customer is the controller of Customer Data and Ajeeeb is its processor.

Information that Ajeeeb collects to operate Customer's account — sign-in details, payments, credit history, security and usage information — is processed by Ajeeeb as a controller under the Privacy Policy and is not Customer Data.

Where Customer is subject to the Personal Data Protection Law of the Sultanate of Oman, the EU or UK General Data Protection Regulation, the California Consumer Privacy Act or another law that requires a processing agreement, this Addendum is that agreement. Customer may request a signed copy by writing to privacy@ajeeeb.com.

• “Data Protection Law” means the Personal Data Protection Law of the Sultanate of Oman and its executive regulation, the EU General Data Protection Regulation, the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act, and any other law that applies to the processing of Customer Data.
• “Controller”, “processor”, “data subject”, “personal data”, “processing” and “personal data breach” have the meanings given to them in Data Protection Law.
• “Sub-processor” means a third party engaged by Ajeeeb to process Customer Data on Ajeeeb's behalf.
• “Standard Contractual Clauses” means the clauses adopted by the European Commission under Decision (EU) 2021/914, and “UK Addendum” means the international data transfer addendum issued by the UK Information Commissioner.

• Ajeeeb processes Customer Data only on Customer's documented instructions, which are this Addendum, the Terms of Service and the actions that Customer and its users take in the service, such as uploading, running, sharing and deleting. Ajeeeb will inform Customer if, in its opinion, an instruction infringes Data Protection Law.
• Ajeeeb does not use Customer Data to train AI models, does not sell it, and does not process it for any purpose other than providing the service, complying with its legal obligations and protecting the service and its users.
• Ajeeeb may process Customer Data where required by a law to which it is subject; in that case Ajeeeb informs Customer before processing, unless the law prohibits it.

• Ajeeeb ensures that persons authorised to process Customer Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access is limited to those who need it to perform their duties.
• Ajeeeb implements and maintains the technical and organisational measures described in Annex 2 (section 12), taking into account the state of the art, the costs of implementation and the risks of the processing, and may update them over time provided that the overall level of protection is not reduced.

• Customer authorises Ajeeeb to engage Sub-processors in the following categories: hosting and infrastructure providers; AI model and compute providers; e-mail delivery providers; and security and monitoring providers. The payment processor is not a Sub-processor under this Addendum, because payment information is processed by Ajeeeb as a controller and is outside Customer Data. The current list of Sub-processors, with the name, purpose and country of each, is provided to Customer on request by writing to privacy@ajeeeb.com.
• Ajeeeb gives Customer at least 30 days' notice by e-mail before adding or replacing a Sub-processor. Customer may object on reasonable data-protection grounds within that period; if the objection cannot be resolved, Customer may terminate its account, and Ajeeeb refunds any unused purchased credits.
• Ajeeeb imposes on each Sub-processor data-protection obligations that are no less protective than those in this Addendum, and remains responsible to Customer for the performance of each Sub-processor.

• Ajeeeb provides self-service tools through which Customer can respond to most requests from data subjects, including deletion of items, export of data and erasure of accounts, and assists Customer within a reasonable time where a request requires more.
• If Ajeeeb receives a request from a data subject concerning Customer Data, Ajeeeb informs Customer and does not respond to the request itself unless the law requires it.
• Ajeeeb assists Customer, as far as it reasonably can, with data-protection impact assessments and with prior consultation of a supervisory authority concerning the processing.

If Ajeeeb becomes aware of a personal data breach affecting Customer Data, it notifies Customer without undue delay and no later than 48 hours after becoming aware, providing the information available to it about the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed, and updates Customer as further information becomes available. Ajeeeb cooperates with Customer in meeting Customer's own notification obligations.

• During the term, Customer may delete items from the service at any time and may request an export of its data, one export every seven days, as described in the Privacy Policy.
• Upon erasure of Customer's account, Ajeeeb erases Customer Data after the 30-day waiting period described in the Terms of Service, except for records that Ajeeeb is required by law to retain, which are kept with identities removed, and except for stored files, which are marked as deleted and remain in Ajeeeb's private storage until Ajeeeb removes them on Customer's request.
• Content transmitted to a Sub-processor to perform a run is retained by that Sub-processor under its own terms for as long as it needs to deliver the result. Where a feature depends on an artifact the Sub-processor keeps for reuse (for example the voice profile behind a custom voice), that artifact is retained until the feature is removed and its deletion is confirmed with the Sub-processor. Ajeeeb does not instruct Sub-processors to retain Customer Data beyond that.

On request, Ajeeeb makes available the information reasonably necessary to demonstrate compliance with this Addendum, including a description of its security measures and the results of any independent assessment that it holds. Where that is insufficient to meet a legal requirement of Customer, Ajeeeb allows an audit by Customer or by an independent auditor bound by confidentiality, no more than once in any twelve-month period unless a breach or a supervisory authority requires otherwise, on at least 30 days' notice, during business hours, and without disrupting the service or exposing the data of other customers.

• Ajeeeb is established in the Sultanate of Oman and its Sub-processors process Customer Data in other countries, including the United States, Europe and Asia. Where Customer is subject to the EU or UK GDPR, transfers to countries without an adequacy decision are made under the Standard Contractual Clauses (module two, controller to processor) and the UK Addendum, which the parties enter into by accepting this Addendum, with Annex 1 and Annex 2 of this Addendum serving as the annexes to those clauses. Where Customer is subject to the law of the Sultanate of Oman, Customer confirms that it holds any authorisation that the law requires for transferring Customer Data abroad, and Ajeeeb provides the information Customer needs for that purpose.
• Each party's liability under this Addendum is subject to the limitations set out in the Terms of Service, except where Data Protection Law does not permit a limitation.
• This Addendum applies for as long as Ajeeeb processes Customer Data. In the event of a conflict between this Addendum and the Terms of Service concerning personal data, this Addendum prevails; in the event of a conflict between the Standard Contractual Clauses and this Addendum, the Clauses prevail.
• This Addendum is governed by the law specified in the Terms of Service. To obtain a signed copy, to object to a Sub-processor or to report a breach, write to privacy@ajeeeb.com.

• Encryption: data is encrypted in transit between users, the service and Sub-processors, and at rest where the underlying platform supports it.
• Access control: access to Customer Data is limited to authorised personnel and systems on a need-to-know basis, protected by individual credentials, and reviewed periodically; passwords and access keys are stored in hashed form.
• Workspace separation: each customer's content is logically separated from that of other customers, and the service enforces that one workspace cannot access another's data.
• Abuse prevention: automated checks on sign-in and registration, fair-use limits, and automated content review on the runs it covers.
• Integrity of transactions: every paid request is protected against duplicate charging, and the credit history is the single record of charges and returns.
• Backups and availability: regular backups through the underlying platform, with procedures for restoring service.
• Erasure: account erasure runs in recorded stages after the 30-day waiting period; a stage that cannot complete is recorded and retried until it completes, and the systems that hold personal data are checked for completeness of their erasure rules.
• Monitoring and incident response: errors and security events are monitored, incidents are investigated, and affected customers are notified in accordance with section 8.
• Personnel: staff and contractors are bound by confidentiality obligations and receive guidance on handling personal data.
• Change management: changes to the service are reviewed before deployment, with independent review for changes that affect payments, authentication, tenant separation or data erasure.