Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement between you (“Customer”, the controller) and MENAVerify FZ-LLC (the processor). It applies where MENAVerify processes personal data on your behalf while providing the validation Service. In the event of a conflict, this DPA prevails over the Terms of Service with respect to data protection.

Subject matter. Validation of identifiers submitted through the API.

Duration. For the term of the agreement.

Nature and purpose. Transient processing to determine whether an identifier is valid and to return associated metadata.

Categories of data. Phone numbers, national identity numbers (e.g. Emirates ID), tax registration numbers and IBANs, together with request metadata.

Data subjects. Your end users whose identifiers you submit.

MENAVerify processes personal data only on your documented instructions, including the instructions embodied in your use of the Service, unless required to do otherwise by law, in which case we will inform you where legally permitted.

Personnel authorized to process personal data are bound by appropriate confidentiality obligations and access data on a least-privilege, need-to-know basis.

We implement appropriate technical and organizational measures, including encryption in transit, access controls, network isolation and monitoring. Identifiers submitted for validation are processed in memory and are not retained after a response is returned.

You authorize MENAVerify to engage sub-processors (for example, infrastructure providers in the UAE and Bahrain) to support the Service. We impose data protection obligations on sub-processors no less protective than this DPA and remain responsible for their performance. We will give notice of new sub-processors and a reasonable opportunity to object.

Where processing involves a cross-border transfer of personal data, we apply appropriate safeguards consistent with applicable law. Primary processing occurs within the United Arab Emirates.

Taking into account the nature of the processing, we provide reasonable assistance to help you respond to data subject requests and to meet your obligations regarding security, breach notification and, where applicable, data protection impact assessments.

We notify you without undue delay after becoming aware of a personal data breach affecting your data, with information reasonably available to us to help you meet any notification obligations.

On termination, and at your choice, we delete or return the personal data we process on your behalf, except where retention is required by law. Because validated identifiers are not retained, deletion primarily concerns account and request metadata.

We make available information reasonably necessary to demonstrate compliance with this DPA and allow for audits, subject to reasonable notice, confidentiality and frequency limits, and in a manner that does not compromise the security of other customers.

To request a signed copy of this DPA or to raise a data protection matter, email [email protected].