Data Processing Agreement

Version 1, 5 November 2026

Datlay is not open yet. This Data Processing Agreement is version 1, published ahead of the launch in 2027 so that you can read it early. It applies from the day your company first accepts it, in the beta or after launch. The text may still change: the version that binds your company is the one it accepts.

This Data Processing Agreement (the "DPA") is made under Article 28 of the GDPR between the company that accepts the Datlay Self-Serve Terms ("you", the "customer") and Rteam FZE LLC, Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates ("we", "us"). You accept it online, together with the Terms, in electronic form as Article 28(9) of the GDPR allows. It forms part of the Terms and takes effect when your acceptance is complete, before any personal data enters your workspace. Words defined in the GDPR have the same meaning here, and words defined in the Terms have the meaning given there.

1. Roles and scope

1.1 You are the controller and we are the processor for all personal data processed in your workspace: the personal data that Datlay reads from your connected systems, that your users enter, and that Datlay produces from them, including when we give support ("customer personal data").

1.2 For your company's account with us (the sign-up, the acceptance records, the administrators and billing contacts, invoices and payments), we are a controller. Our Privacy page covers that data.

1.3 Where the UK GDPR, the Swiss Federal Act on Data Protection, the UAE Personal Data Protection Law or the DIFC Data Protection Law applies to you, this DPA applies with references to the GDPR read as references to that law, and section 11 sets the terms for transfers.

2. Details of the processing

The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex I.

3. Instructions

3.1 We process customer personal data only on your documented instructions, including with regard to transfers, unless we are required to do so by Union or Member State law to which we are subject. In that case we inform you of that legal requirement before the processing, unless that law prohibits it on important grounds of public interest. Other law that applies to us is dealt with under Clauses 14 and 15 of the standard contractual clauses (section 11).

3.2 Your instructions are the Terms, this DPA, the settings your administrators choose in your workspace, and the changes your users confirm.

3.3 We tell you without delay if, in our opinion, an instruction infringes data protection law.

4. Confidentiality

We ensure that every person authorised to process customer personal data, including our subcontractors, is committed to confidentiality by contract or by law.

5. Security

5.1 We implement and maintain the technical and organisational measures required by Article 32 of the GDPR, including at least the measures in Annex II. The Security page describes them in more detail.

5.2 We may change the measures as technology and threats change, but we will not reduce the overall level of protection during your subscription.

6. Sub-processors

6.1 You give us a general authorisation to engage sub-processors. The sub-processors on the day you accept are those on the sub-processors page (Annex III).

6.2 We tell you of any intended addition or replacement of a sub-processor at least 30 days before it starts processing customer personal data, by email to your administrators and on the sub-processors page.

6.3 You may object on reasonable data protection grounds within 10 business days of our notice. If we cannot resolve the objection within 30 days, you may end the subscription, or the affected part of the service, by written notice, and we refund the fees you prepaid for it for the rest of the period.

6.4 We impose on each sub-processor, by written contract, data protection obligations no weaker than this DPA, and we remain fully liable to you for its performance.

6.5 No AI provider processes customer personal data as our sub-processor. Adding one would be a change under this section.

7. Assistance

7.1 Taking into account the nature of the processing, we assist you with appropriate technical and organisational measures in responding to requests from data subjects. Your administrators can find and export a person's records in the workspace, and we correct or delete a person's records in Datlay at your request. Much of the data comes from your connected systems: a correction you make there reaches Datlay at its next read.

7.2 If a data subject's request reaches us directly, we pass it to you without delay and do not answer it ourselves unless you instruct us to.

7.3 At your reasonable request, we assist you in complying with Articles 32 to 36 of the GDPR: security, notification of personal data breaches, data protection impact assessments and prior consultation of a supervisory authority.

8. Personal data breach

8.1 We notify you of a personal data breach affecting customer personal data without undue delay, and at the latest within 72 hours of becoming aware of it, by email to your administrators.

8.2 The notice gives the information you need for Articles 33 and 34 of the GDPR, as far as it is available: the nature of the breach, the categories and approximate numbers of data subjects and records concerned, its likely consequences, and the measures taken or proposed. Where not all of it is available at once, we send it in phases without further undue delay.

8.3 We document every such breach and its remediation.

9. Return and deletion

9.1 At the end of the processing, you can take customer personal data out through the exports described in section 15 of the Terms, during the 30 days after the trial or subscription ends.

9.2 We then delete it as section 15 of the Terms describes: the workspace is deleted at the end of those 30 days, every copy of the key of its backups is destroyed at the same time so that the backups can no longer be read, and backups run out on a rotation of at most 35 days. We confirm the deletion with a certificate signed by Rteam FZE LLC.

9.3 We delete sooner at your written request, once you confirm that you have your export or that you do not want one. We keep customer personal data after the end only where Union or Member State law to which we are subject requires it.

10. Audits

10.1 We make available to you the information necessary to demonstrate compliance with Article 28 of the GDPR, including this DPA, the Security page and answers to your reasonable written questions.

10.2 We allow and contribute to audits, including inspections, by you or by an auditor you mandate who is bound by confidentiality: once per calendar year, on reasonable prior notice, during business hours, at your cost, unless the audit reveals a breach of this DPA, in which case we bear its reasonable cost. More frequent audits are allowed where a supervisory authority requires them or after a personal data breach.

10.3 An audit covers your own workspace and the processing for it. Where an audit concerns infrastructure shared with other customers, we meet it with documents, reports and a supervised review that gives no access to other customers' data.

11. International transfers

11.1 Your workspace is hosted in the region shown in it; at launch, the European Union (Germany), with its backups in the European Union. We do not move customer personal data out of that region except as Annex III shows or with your administrators' written consent. We are established in the United Arab Emirates, a third country for which the European Commission has made no adequacy decision. Our authorised staff and contractors reach the workspace remotely, from the United Arab Emirates and from the other countries where they work; we give you the current list on request. Making customer personal data available to us is therefore a transfer from a controller to a processor.

11.2 EU standard contractual clauses. Where the GDPR applies to the transfer, the parties make it under the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), which are incorporated into this DPA by reference, with you as data exporter and us as data importer, and with these choices:

Clause 7 (docking clause): included.
Clause 9(a): Option 2, general written authorisation, with the notice period in section 6.2 of this DPA.
Clause 11(a): the optional wording is not used.
Clause 13: the competent supervisory authority is the one designated under Clause 13(a), as Annex I.C states.
Clause 17: Option 2. The clauses are governed by the law of the EU Member State in which you are established. Where that law does not allow for third-party beneficiary rights, or you are not established in an EU Member State, they are governed by the law of Ireland.
Clause 18(b): the courts of the EU Member State in which you are established or, if you are not established in an EU Member State, the courts of Ireland.
Annexes I, II and III of the clauses are completed by Annexes I, II and III of this DPA.

11.3 In case of conflict, the clauses prevail over this DPA and over the Terms. Where a competent authority requires the clauses to be signed as a separate document, we sign it on your request. We give you the information you reasonably need for your assessment under Clause 14 of the clauses.

11.4 Onward transfers. Customer personal data is transferred onward to, or accessed from, a country outside the EEA only by the sub-processors in Annex III, under an adequacy decision (including the EU-US Data Privacy Framework for certified recipients) or the EU standard contractual clauses, Module Three, and in accordance with the conditions for onward transfers in the clauses under section 11.2.

11.5 United Kingdom. Where the UK GDPR applies to the transfer, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force from 21 March 2022, or the version the Information Commissioner issues in its place) is incorporated into this DPA. Its Tables 1 to 3 are completed by section 11.2 and Annexes I to III. In Table 4, neither party may end the Addendum under its Section 19.

11.6 Switzerland. Where the Swiss Federal Act on Data Protection applies to the transfer, the clauses under section 11.2 apply with these adaptations: the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority insofar as that Act applies; the term "Member State" in Clause 18(c) does not exclude data subjects in Switzerland from bringing claims where they habitually reside; and references to the GDPR are read as references to that Act.

11.7 United Arab Emirates. Where you are established in the UAE outside the financial free zones and the UAE Personal Data Protection Law applies, the transfers out of the UAE are made on the basis of this DPA, which obliges us and, through their own written contracts, each sub-processor to apply measures and safeguards no weaker than those of that law and of this DPA. When regulations or a decision of the competent authority set further conditions for such transfers, the parties apply them. Where you are established in the Dubai International Financial Centre, the transfers out of the DIFC are made under the standard contractual clauses issued by the DIFC Commissioner of Data Protection, which are incorporated by reference, with you as exporter and us as importer. Where you are established in the Abu Dhabi Global Market, tell us before you accept: the ADGM Data Protection Regulations 2021 need terms that this DPA does not yet contain.

11.8 Other countries. Where the law of another country that applies to you requires its own instrument for the transfer, we sign the standard contract or other instrument that law prescribes, in the version then in force, on your request.

12. Anonymous aggregated figures

12.1 You allow us to compute, from the process data in your workspace, aggregated figures about how processes run: how long the steps of a process take (for example the number of days from a won deal to a paid invoice), the share of documents in a given state (for example the share handled without a person), and counts of documents. Each figure is grouped by industry, company size and pair of connected systems. The industry is the one given at sign-up; the size is the one Datlay counts.

12.2 For deriving and using these figures, we act as a controller in our own right, not as your processor. Before any figure is computed, the identity of whoever took a step is replaced by its class (for example a person, a system or an assistant), so no figure is computed from the identity of a person.

12.3 A figure combines the data of many companies. It contains no name of a company, person, customer or supplier, no personal data, no document or content of a document, and no amount of money. A figure is shown or published only when enough companies contribute to it that no single company can be identified from it.

12.4 We use these figures only to show customers of Datlay how their processes compare with those of companies like theirs, and to publish anonymous medians, which name no company, about how such processes run.

12.5 Figures are computed from the first day of a workspace. Comparisons appear only once enough companies take part. A figure already computed holds no personal data and nothing that identifies you, so it is not deleted with your data.

13. Disclosures you direct

Personal data that you or your users make available through the AI assistant connection, the API, personal tokens or exports, to tools and recipients you choose, is disclosed on your instruction. Those tools and recipients, and their providers, are not our sub-processors, and their processing is your own responsibility. The provider of an AI assistant you connect is your choice and acts as your processor under your own terms with it. Our duty for these interfaces is to provide them as documented and to secure them as Annex II provides.

14. Liability and precedence

Liability under this DPA is subject to section 19 of the Terms, including section 19.4. For the processing of personal data, this DPA prevails over the rest of the Terms, and the clauses under section 11 prevail over this DPA.

15. Changes

We change this DPA only as section 21 of the Terms describes. No change reduces the protection that the clauses under section 11 give.

Annex I: Details of the processing

A. The parties

Data exporter: The customer: the company named at sign-up, at the address given there. Contact: the administrators named in its workspace. Activities: use of Datlay for its own business. Role: controller. Signature and date: the online acceptance recorded under section 2 of the Terms.
Data importer: Rteam FZE LLC, Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates. Contact: Oleksandr Azariyev, Manager, support@datlay.com. Activities: providing Datlay under the Terms. Role: processor. Signature and date: this DPA, published by us and accepted by the customer online.

B. Description of the processing and of the transfer

Categories of data subjects: The customer's employees and other users of Datlay. People who appear in the documents of the connected systems: the customer's customers, suppliers and business contacts, and the customer's employees who appear as the authors of steps in those systems.
Categories of personal data: Names, roles and contact details (such as email addresses, phone numbers and addresses) as they appear in documents and user lists; tax and registration numbers of business partners where these are personal data; the steps each document took, with the time and, where the connected system records it, the user who took each step; the document fields the process X-ray shows, such as the customer, the amount, dates and status; Datlay user accounts and sign-in data (name, email address, roles, two-factor setting, sign-in times and IP addresses); the log of prepared and confirmed changes; and support correspondence.
Data Datlay does not read: Datlay does not read payroll or HR records, such as payroll journals and the details of employees' expenses. Each connection reads a defined list of document types and fields.
Sensitive data: None is intended. You will not direct Datlay to read special categories of personal data without our prior written agreement.
Frequency: Continuous, while the trial or subscription runs.
Nature of the processing: Reading from the connected systems through their interfaces (on first connection up to 90 days of history, then what changed since the last read); storage; structuring; matching documents across systems; computing process timings and counts; display; export; preparing changes and making the changes that users confirm; sending the service's email; backup; monitoring; support; and deletion.
Purpose: Providing Datlay to the customer under the Terms. Separately, as a controller in our own right, deriving and using the anonymous aggregated figures under section 12.
Retention: For the trial or subscription and the 30 days after it ends, then deletion as section 9 describes.
Transfers to sub-processors: To the sub-processors in Annex III, for the purposes and in the locations stated there, for the duration above.

C. Competent supervisory authority

The supervisory authority responsible for the data exporter's compliance as regards the transfer, as Clause 13(a) of the clauses designates it: where the customer is established in an EU Member State, the authority of that Member State; where it is not, but has appointed a representative under Article 27(1) of the GDPR, the authority of the Member State where the representative is established; and otherwise the authority of the Member State in which the data subjects concerned are located.

Annex II: Technical and organisational measures

Area	Measures
Location	Each workspace hosted in the region shown in it; at launch, the EU (Germany). Backups kept in the same region, in a different location from the workspace.
Separation	Each customer's workspace has its own database, its own secrets and its own network. Trials run on servers separate from those of paying customers.
Access to connected systems	Reading with the least rights the system allows, read-only where the system offers it. Each connection reads a defined list of document types and fields. Payroll and HR records are not read.
Changes in connected systems	Made only after a person confirms them in Datlay, with two-factor sign-in required for everyone who confirms. The document is read again at confirmation and the change is refused if it changed. A change with an unknown outcome is never repeated automatically. Changes can be paused for one workspace or for all.
Rights of users	Each user has a personal account; no shared accounts. Where a connected system checks each person's rights, Datlay acts with the person's own login. Where it gives company-wide access, roles in Datlay decide who may see and change what. Rights are checked on the server.
Connection tokens	Encrypted with a key of the workspace that is kept outside its database and outside its backups. The connection service keeps no customer tokens. Disconnecting a system deletes its tokens and stops reading.
Encryption	Encrypted connections (TLS) in transit. Connection tokens and backups encrypted at rest.
Backups	Continuous, encrypted with the workspace's own key before they leave its server, kept for at most 35 days, in storage from which the production server cannot delete them, and restored automatically in a weekly test. Destroying the key makes a workspace's backups unreadable at once.
Logging	Every change made through Datlay is logged: which person or tool asked, with whose rights, who confirmed, and what the system answered. Staff access to servers is logged.
Staff access	Only authorised staff, only through our private network, with each session on a workspace's server recorded. Work for a customer inside its workspace is done through roles in Datlay, not through direct database access.
Monitoring	Every workspace and every connection is monitored, with alerts when a workspace stops answering or a connection stops reading.
Incidents	An incident response procedure; notice to the customer within 72 hours of becoming aware of a personal data breach (section 8).
Development	Signed releases of code that runs in customers' systems, protected code branches, two-factor sign-in on code and publisher accounts, and an automatic check that refuses secrets in code. Development tools, including AI tools, work on test systems with test data. No AI provider is given your data: none is on our list of sub-processors.
Testing	Automated security scans. Before launch, an independent firm runs a penetration test on a staging copy with demo data only. After launch we repeat external tests.
Workstations	Full-disk encryption and screen lock on our workstations. No customer data on unmanaged devices.
Vulnerabilities	Security fixes applied within a time reasonable for their severity. Reports received at security@datlay.com.
No AI of ours on customer data	Datlay itself sends customer data to no AI provider of ours and does not use it to train any model. Customer data reaches an AI provider only through an assistant or tool the customer connects (section 13).

Annex III: Sub-processors

The sub-processors are listed, with their purpose and the location of the data, on the sub-processors page. On 5 November 2026 they are: Hetzner Online GmbH, Backblaze, Inc., Google Cloud EMEA Limited (Google Workspace) and Plus Five Five, Inc. (Resend). Stripe, which processes only the billing data of your company's account, is not a sub-processor: for that data we are the controller (section 1.2). Changes follow section 6.