Data Processing Agreement

Outhentik Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of the agreement between the Customer ("Controller") and the Processor (as defined below) for the use of the Outhentik platform.

This DPA is entered into pursuant to Article 28 of the General Data Protection Regulation (Regulation (EU) 2016/679) ("EU GDPR"), the UK General Data Protection Regulation as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 ("UK GDPR"), and applicable national data protection laws.

Effective date: This DPA takes effect on the date the Controller first accepts the Outhentik Terms of Service or signs this document, whichever is earlier.

Last updated: 10 October 2026 Version: 1.10

Parties

The Processor:

Dahi Alttatbiqat Establishment, trading as Outhentik Commercial Registration Number: 7024055480 Alsafa, Jeddah, 23453, Saudi Arabia Contact for data protection inquiries: [email protected]

The Controller:

The customer entity that has accepted the Outhentik Terms of Service, signed this DPA, or otherwise entered into a service agreement with the Processor (as identified in the Processor's account records).

1. Subject matter, term, personal data processed, and categories of Data Subjects

1.1 Subject matter

The subject matter of this DPA consists of the appointment of the Processor by the Controller and the provision of instructions for the processing of personal data. The processing activities the Processor carries out are strictly limited to those necessary to fulfil the scope of the main service agreement between the parties (the Outhentik Terms of Service published at outhentik.app/terms or, where applicable, an executed Master Services Agreement or Service Level Agreement).

The Processor provides a platform through which the Controller's customers send it messages, typed, as a voice recording or as a video. The Controller reads every message, works a case for each customer who asks to be contacted, and sees issues that recur across its branches. Google review invites and public video sharing are optional features, off until the Controller turns them on. Processing activities carried out on behalf of the Controller include:

• Receiving and storing messages: typed text, voice recordings and video recordings
• Generating a text transcript of each voice and video message through a speech-to-text sub-processor
• Analysing the text of each message automatically, through an AI sub-processor, to sort what customers say into topics and issues, and to keep short quotes as evidence for each issue
• Processing the names, email addresses, phone numbers and star ratings of the Controller's end-customers, each only where the end-customer gives it
• Recording each end-customer's choices and the exact privacy notice they were shown
• Passing each request to be contacted to the Controller as a case, and recording the history of that case
• Where the Controller has turned Google review invites on, sending one email with a Google review link to each end-customer who asks for it. This is the only email the Processor sends to end-customers
• Generating reports, and findings that the Controller can share through a private, expiring link with short quotes from messages. A quote is the end-customer's own words, verbatim, so a name spoken in them is shown as said; the name the end-customer entered in the form is not shown
• Where the Controller uses public sharing, displaying a video on the Controller's Wall of Love and website embed, only if the end-customer allowed it and the Controller approved it
• Storing the Controller's branding (logos, brand colours) and Google place IDs
• Processing access tokens, case history and authentication events for the Controller's authorised users

1.2 Term

This DPA commences on the Effective Date and remains in effect for as long as the Processor processes personal data on behalf of the Controller under the main service agreement, including any post-termination retention period required to fulfil the obligations set out in Section 11.

1.3 Categories of personal data processed

The Processor processes the following categories of personal data on behalf of the Controller:

End-customers of the Controller (Data Subjects who send messages):

• Identifiers: name, email address and phone number, each only where provided
• Message content: typed message text, voice recordings and video recordings
• Transcript data: the transcript of a voice or video message. Message text and transcripts may contain names of the Controller's staff and personal data the Data Subject volunteers unprompted
• Analysis data: the topics and issues found in a message, and short quotes from it
• Feedback data: star ratings, where given
• Consent data: the privacy notice and wording shown, the Data Subject's answers, the time of submission, IP address and browser details
• Choices and follow-up: whether the Data Subject asked to be contacted or for a Google review link, the history of any resulting case, and the delivery and unsubscribe status of a Google review invite

Authorised users of the Controller (the Controller's staff who access the Outhentik dashboard):

• Personally identifiable information: name, email address
• Authentication data: hashed passwords and session tokens
• Account activity: login timestamps, and the case actions they take (assigning, contacting, resolving, reopening)
• Acceptance data: the version of the Terms of Service in force when their account was created, and the time

Audit data retained after erasure:

Where a consent record is erased on instruction, the Processor writes a record that the erasure took place. That record contains only the identifier of the erased message, the timestamp of the erasure, the role that carried it out, the written instruction reference relied on, and the number of consent records destroyed. It contains no name, no email address, no phone number, no transcript, and no other data identifying the Data Subject.

The Processor does not knowingly process special categories of personal data (as defined in Article 9 GDPR) including health, biometric, genetic, racial, ethnic, political, religious, trade union, or sexual orientation data. Where end-customers voluntarily disclose such information in their messages, the Controller bears responsibility for ensuring lawful basis under Article 9 GDPR.

1.4 Categories of Data Subjects

The personal data processed under this DPA relates to:

• The Controller's customers and end-users who send it messages
• The Controller's authorised staff and account administrators
• Internet users who open the Controller's message links or QR codes

2. Data transfer abroad

2.1 Disclosed transfers

The Controller acknowledges and authorises the following sub-processors and the international data transfers they involve, as of the Effective Date. This is the same list published at outhentik.app/sub-processors.

Legal basis for each transfer:

• European Union (Cloudflare R2, Speechmatics processing, Sentry): processing takes place within the EEA, so no Article 44 transfer arises for the processing itself.
• United Kingdom (Paddle, and Speechmatics as contracting entity): UK adequacy decision, Article 45 GDPR.
• Switzerland (UptimeRobot): adequacy decision, Article 45(3) GDPR.
• United States (Vercel, Google Places, OpenAI, Pinecone, Resend): Standard Contractual Clauses, Article 46(2)(c) GDPR, and the EU-US Data Privacy Framework where the recipient is certified.
• Singapore (Supabase): Standard Contractual Clauses, Article 46(2)(c) GDPR.
• Global, no regional commitment (Google Gemini API): under Google's data processing terms for the paid Gemini API.

Where UK personal data is involved, the UK International Data Transfer Addendum supplements the Standard Contractual Clauses.

In addition, the browser of a person using the platform, including an end-customer on a message page, loads files directly from these providers, which therefore receive that person's IP address and browser details:

2.2 Access from Saudi Arabia

The Processor's authorised personnel access systems from Saudi Arabia for product operations, technical support, and security administration. Such access is governed by:

• The Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by the UK International Data Transfer Addendum (IDTA) where UK personal data is involved
• The technical and organisational measures described in Section 3 and the accompanying Technical and Organisational Measures document, including encryption in transit and at rest, multi-factor authentication, access controls, and contractual confidentiality obligations
• The principle of data minimisation: access is limited to the minimum necessary to fulfil the purpose

The Processor's compliance posture under EU GDPR and UK GDPR is independent of the country from which authorised personnel access systems. The Processor accepts the same data protection obligations regardless of personnel location.

2.3 Sub-processor changes affecting transfers

The Processor will notify the Controller of any changes to the list of sub-processors involving new international transfers, in accordance with Section 6.

3. Technical and organisational measures

3.1 Adoption of measures

Prior to the execution of this DPA, the Processor has adopted the technical and organisational security measures described in detail in the Outhentik Technical and Organisational Measures (TOMs) document, available at outhentik.app/security and incorporated by reference into this DPA.

3.2 Compliance with Article 32 GDPR

The Processor warrants that it has implemented appropriate security measures in accordance with Article 28(3)(c) and Article 32 GDPR, taking into account the state of the art, implementation costs, the nature, scope, context, and purposes of processing, as well as the likelihood and severity of risks to the rights and freedoms of natural persons.

These measures include:

• Encryption of personal data in transit (TLS 1.2 or higher)
• Encryption of personal data at rest where supported by sub-processors
• Multi-factor authentication enforced on all production infrastructure accounts
• Access controls limiting production data access to authorised personnel
• Regular backup procedures
• Incident response procedures with defined notification timelines
• Pseudonymisation and access logging where applicable

3.3 Evolution of measures

The technical and organisational measures are subject to technical progress and development. The Processor may adopt alternative measures that are equivalent or superior in security level. The Processor will not reduce the overall protection level. Material changes to the TOMs document will be reflected at outhentik.app/security and notified to the Controller where they materially affect the Controller's data.

4. Data Subjects' rights

4.1 Cooperation obligation

The Processor will provide reasonable cooperation and assistance to enable the Controller to respond to requests from Data Subjects exercising their rights under Articles 15 to 22 GDPR (right of access, rectification, erasure, restriction of processing, data portability, objection, and rights related to automated decision-making).

4.2 Communication of requests

The Processor will, without undue delay, communicate to the Controller any request received directly from a Data Subject concerning the exercise of their rights, where such request relates to data processed on behalf of the Controller. The Processor will not respond to such requests directly unless instructed in writing by the Controller.

4.3 Technical assistance

Where feasible and proportionate, the Processor will enable the Controller to design and deploy technical and organisational measures necessary to fulfil Data Subjects' requests. The dashboard allows the Controller to delete and to export Data Subject records directly.

The consent record itself cannot be edited, by the Controller or by the Processor. It is an append-only record of what a Data Subject was shown and agreed to at a given moment, and altering it after the fact would destroy the evidence it exists to preserve. A correction is therefore made by adding a further record that supersedes the earlier one, so that both the original and the correction remain visible, and by erasure where the Data Subject asks for the record to be removed. Erasure is carried out by the Processor on the Controller's written instruction under Section 11.3, not from the dashboard.

4.4 Direct fulfilment

The Controller bears primary responsibility for responding to Data Subjects' requests. Where the Controller instructs the Processor in writing to fulfil specific requests directly, the Processor will do so provided such fulfilment does not require disproportionate effort.

5. Further duties of the Processor

In addition to the provisions of this DPA, the Processor commits to comply with applicable obligations under Articles 28 to 33 GDPR, including:

5.1 Data Protection Officer

The Processor is not required to appoint a Data Protection Officer under Article 37 GDPR. The Processor designates the following Contact Person for data protection matters:

Data protection contact, Outhentik Email: [email protected]

5.2 Article 27 Representative

The Processor is established in Saudi Arabia. At the date of this Agreement, the Processor's processing of personal data of Data Subjects in the European Union and United Kingdom is occasional and does not include large-scale processing of special categories of data within the meaning of Article 27(2)(a) GDPR. Should the Processor's processing activities subsequently require designation of a representative under Article 27 EU GDPR or Article 27 UK GDPR, the Processor will designate such representative and update this DPA accordingly.

5.3 Confidentiality

Processing activities under this DPA are performed only by individuals who have been instructed by the Processor on appropriate data handling and have been contractually subjected to confidentiality obligations consistent with Articles 28(3)(b) and 32 GDPR. The Processor and any person acting under its authority will not process personal data except on the documented instructions of the Controller, unless required by Union or Member State law.

5.4 Technical and organisational measures

The Processor implements and maintains the technical and organisational measures set out in Section 3 and the accompanying TOMs document, periodically reviews their adequacy, and grants the Controller verifiability of these measures in accordance with Section 7.

5.5 Cooperation with supervisory authorities

The Controller and the Processor will cooperate, on request, with competent supervisory authorities. The Processor will inform the Controller without undue delay of any inspection, investigation, or enforcement action by a supervisory authority that relates to the personal data processed under this DPA. The Processor will assist the Controller in responding to inquiries, claims, or proceedings brought by Data Subjects, supervisory authorities, or third parties in connection with the processing.

6. Sub-processors

6.1 General authorisation

The Controller authorises the Processor to engage sub-processors to assist in providing the services. Sub-processors are subject to the same data protection obligations as set out in this DPA, in accordance with Article 28(4) GDPR, by means of a written contract or equivalent legal instrument.

6.2 Current sub-processors

The Processor engages the sub-processors listed in the table in Section 2.1. That table and the list at outhentik.app/sub-processors are generated from the same source and are always identical.

6.3 Notification of sub-processor changes

The Processor maintains an up-to-date list of sub-processors at outhentik.app/sub-processors. The Processor will notify the Controller of any intended addition or replacement of sub-processors at least fourteen (14) days in advance, giving the Controller the opportunity to object on reasonable data protection grounds. If the Controller objects, the Processor may either (a) propose an alternative sub-processor or arrangement that resolves the objection, or (b) where no resolution is reached, terminate the affected service component, with the Controller entitled to a pro-rata refund for any pre-paid amounts unused.

6.4 Personal data transfer to sub-processors

Personal data is transferred to sub-processors only after the conditions of Section 6.1 have been met, including binding contractual obligations consistent with Article 28(4) GDPR.

6.5 Liability for sub-processors

The Processor remains fully responsible to the Controller for the acts and omissions of its sub-processors as if they were the Processor's own.

6.6 International transfers via sub-processors

Where a sub-processor processes personal data outside the European Economic Area or the United Kingdom, the Processor ensures compliance with the rules on international data transfers as described in Section 2.

7. Audits

7.1 Right to audit

The Controller has the right to verify the Processor's compliance with this DPA. Audits may be carried out by the Controller directly or by an independent auditor appointed by the Controller, subject to confidentiality obligations.

7.2 Notice and frequency

Audits require at least thirty (30) days' written notice and may not be conducted more than once per twelve (12) month period, except where required following a confirmed personal data breach affecting the Controller's data or where required by a supervisory authority.

7.3 Demonstrable evidence

The Processor will demonstrate compliance with its Article 28 obligations by providing on request:

• The current Technical and Organisational Measures document
• Sub-processor contracts or relevant excerpts (with confidential commercial terms redacted)
• Records of processing activities relevant to the Controller's data
• Logs and audit trails relevant to the Controller's data
• Where available, third-party certifications or audit reports of sub-processors (such as SOC 2 reports of Supabase, Vercel, Cloudflare)

7.4 Audit fees

The Processor will not charge the Controller for cooperation with reasonable audits conducted in accordance with this Section 7.

8. Assistance to the Controller

8.1 Security and breach notification

The Processor will assist the Controller in complying with its obligations under Articles 32 to 36 GDPR, including:

• Maintaining adequate protection standards through technical and organisational measures
• Detecting personal data breaches affecting the Controller's data
• Notifying the Controller of confirmed personal data breaches without undue delay, and in any event within seventy-two (72) hours of the Processor becoming aware of the breach
• Providing information sufficient for the Controller to fulfil its own breach notification obligations to supervisory authorities and Data Subjects
• Assisting in data protection impact assessments and prior consultations with supervisory authorities, where required

8.2 Breach notification content

Personal data breach notifications from the Processor will include, to the extent known:

• The nature of the breach
• The categories and approximate number of Data Subjects affected
• The categories and approximate volume of personal data affected
• The likely consequences of the breach
• Measures taken or proposed to address the breach and mitigate adverse effects

8.3 Fees for assistance

The Processor will provide breach notification and basic assistance with Articles 32 to 36 obligations at no charge. The Processor reserves the right to charge a reasonable fee for support services that fall outside the scope of the standard service description and that are not attributable to the Processor's misconduct, negligence, or breach of this DPA.

9. Directive powers of the Controller

9.1 Documented instructions

The Processor will process personal data only on the Controller's documented instructions, including those set out in this DPA, the main service agreement, and any subsequent written instructions, unless required to do otherwise by Union or Member State law to which the Processor is subject. Where such legal requirement applies, the Processor will inform the Controller of the legal requirement before processing, unless prohibited by law on grounds of public interest.

9.2 Notification of unlawful instructions

If the Processor considers that an instruction from the Controller would infringe applicable data protection law, the Processor will inform the Controller without undue delay and may refrain from carrying out the instruction until clarified or withdrawn.

10. Liability

10.1 Mutual indemnification

Each party will indemnify the other party for damages or expenses resulting from its own culpable infringement of this DPA, including infringements committed by its legal representatives, sub-processors, employees, or other agents.

10.2 Article 82 GDPR

Article 82 GDPR (right to compensation and liability) remains unaffected by this Section.

10.3 Limitation of liability

The parties' aggregate liability under or in connection with this DPA is subject to the limitation of liability provisions set out in the main service agreement between the parties, except where such limitation is prohibited by applicable law.

11. Deletion and return of personal data

11.1 No unauthorised copies

The Processor will not create copies or duplicates of personal data without the Controller's knowledge and consent, except for backup copies necessary to ensure correct processing and where retention is required by law.

11.2 Post-termination handling

Cancelling or not renewing a subscription does not by itself delete the Controller's data. The account and its data are kept, the Controller's message pages stop accepting new messages, and the Controller can export its messages from the dashboard, or delete them, at any time.

When the Controller requests deletion of its account, from the dashboard or in writing, the Processor will:

• Lock the Controller's account and sign all sessions out at once
• Keep the Controller's data for a grace period of thirty (30) days, during which signing in again cancels the deletion and restores the account
• After the thirty (30) day grace period, permanently delete from production systems all personal data processed on behalf of the Controller, including voice and video files in object storage, database records, consent records, authentication records and associated metadata
• Purge personal data from backup systems within ninety (90) days of the deletion request

11.3 Deletion on Data Subject request

Where the Controller instructs the Processor to delete specific Data Subject records (in response to a Data Subject erasure request), the Processor will delete the specified records from production systems within thirty (30) days and from backups within ninety (90) days.

Where the records erased include the Data Subject's consent record, a record that the erasure occurred is retained. It is described in Section 1.3 and contains nothing identifying the Data Subject beyond an opaque identifier. It is retained so that the Processor can demonstrate the erasure was carried out and on what instruction, which Sections 7.3 and 11.5 require. It cannot be edited or removed once written.

11.4 Retention required by law

Notwithstanding Sections 11.2 and 11.3, the Processor may retain personal data beyond the deletion timelines where retention is required by applicable law (for example, tax, accounting, or anti-money-laundering requirements applied to billing data via Paddle.com Market Ltd). Such retained data will be:

• Limited to what is strictly required by the applicable law
• Subject to the same technical and organisational measures as live data
• Deleted as soon as the legal retention obligation expires

11.5 Documentation retention

The Processor may retain documentation necessary to demonstrate compliance with this DPA (such as audit logs, sub-processor lists, and DPA versions) beyond termination, in line with applicable retention periods.

11.6 Retention while the account exists

Voice and video files are kept for as long as the Controller keeps its Outhentik account, so the Controller can play them back when handling a case or reviewing a recurring issue. Messages, their transcripts and their consent records are kept for the same period. The Controller can delete any message at any time, and its voice or video file is deleted with it. All of it is deleted when the account is deleted, under Section 11.2.

12. Miscellaneous

12.1 Order of precedence

In the event of conflict between this DPA and the main service agreement, this DPA prevails for matters relating to the processing of personal data.

12.2 Severability

If any provision of this DPA is held invalid or unenforceable, the remaining provisions will continue in full effect. The parties will replace the invalid provision with a valid provision that reflects the original intent as closely as possible.

12.3 Governing law

This DPA is governed by the laws of England and Wales, aligned with the Outhentik Order Form and Terms of Service, without prejudice to the mandatory application of UK GDPR, EU GDPR, and any other data protection laws of competent jurisdiction. Where a Data Subject or supervisory authority asserts rights under EU or UK GDPR, those laws prevail to the extent required. The Standard Contractual Clauses and UK Addendum are governed by the law each specifies.

12.4 Amendments

This DPA may be amended only in writing. The Processor may update this DPA from time to time to reflect changes in applicable law, sub-processor arrangements, or operational practice. Material amendments will be notified to the Controller at least thirty (30) days in advance and will take effect on the stated effective date unless the Controller objects on reasonable data protection grounds.

12.5 Acceptance

This DPA may be accepted by:

• Acceptance of the Outhentik Terms of Service when creating an account. The signup page states that creating an account accepts the Terms of Service, which incorporate this DPA, and the Processor records the version of the Terms in force and the time
• Counter-signature of a PDF copy of this DPA, exchanged by email with the Processor
• Any other written acceptance recognisable under applicable law

Where the Controller has accepted the Outhentik Terms of Service, the Controller is deemed to have accepted this DPA as the data processing component of that agreement.

13. Signatures

For Controllers requesting a counter-signed copy of this DPA, the Processor will provide an executed PDF on request to [email protected].

Processor:

Dahi Alttatbiqat Establishment, trading as Outhentik Commercial Registration Number: 7024055480 Alsafa, Jeddah, 23453, Saudi Arabia

Signed by: __________________________ Name: __________________________ Title: __________________________ Date: __________________________

Controller:

Company name: __________________________ Commercial registration / VAT number: __________________________ Registered address: __________________________ Contact for data protection: __________________________

Signed by: __________________________ Name: __________________________ Title: __________________________ Date: __________________________

This DPA is published at outhentik.app/dpa. The Technical and Organisational Measures document referenced herein is published at outhentik.app/security. The current sub-processor list is published at outhentik.app/sub-processors.

Effective from the date stated above.