اتفاقية معالجة البيانات | Data Processing Agreement

1. Parties and Scope

This agreement is between:

• The customer (the "controller"), the account holder who determines the purposes and means of the processing.
• EgyHosting for Information Technology Services, commercial register no. 208919 (the "processor"), which processes the data on the customer's behalf.

The terms personal data, processing, controller, processor and the Centre have the meanings given to them in Personal Data Protection Law no. 151 of 2020 and its executive regulations. Where this agreement conflicts with the Terms of Service in respect of personal data, this agreement prevails.

2. Details of the Processing

3. The Processor's Obligations (EgyHosting)

• To process the data only on the customer's instructions. The Terms of Service, the customer's own settings for their services, and their requests through support tickets count as documented instructions.
• Not to use the data for any purpose of its own, not to sell it, and not to look at its content except as needed for support or security or at the customer's request.
• To inform the customer if it believes any of their instructions breaches the law.
• To bind its authorised staff to confidentiality, and to limit access to those who need it to do their job.
• To apply the security measures set out in Annex 1.
• To assist the customer, to a reasonable extent, in responding to data subjects' requests and in meeting their obligations towards the Centre.
• To forward to the customer any request it receives directly from a data subject, without answering it itself.
• To notify the customer of any request from an official authority to access their data, unless the law prevents it.
• To appoint a data protection officer, keep a record of processing activities, and hold the licences required for its role as a processor.

4. The Controller's Obligations (the Customer)

• To make sure there is a legal basis for collecting and processing the data, including obtaining data subjects' consent where required.
• To publish a clear privacy policy for their website or application, and to obtain the licences it requires from the Centre.
• To choose the service level and security settings appropriate to the sensitivity of their data, especially sensitive data such as health data, financial data and children's data.
• To secure what is under their control: passwords, application and plugin updates, and user permissions on their account.
• To ensure their instructions to the processor comply with the law.

5. Sub-processors

• The customer agrees to EgyHosting's use of the sub-processors listed in Annex 2.
• EgyHosting undertakes to impose equivalent protection obligations on every sub-processor, and remains responsible to the customer for its performance.
• EgyHosting will notify the customer of any new sub-processor 15 days before engaging it. The customer may object on reasonable grounds, and if no solution is agreed, the customer may terminate the affected service and obtain a refund for the remaining period.

6. Place of Processing and Transfers Outside Egypt

• Data of services hosted in Egypt, and their backups, are processed inside Egypt and are not transferred outside it without the customer's written consent.
• If the customer chooses a service in a data centre outside Egypt, that service's data is processed in the country of the chosen data centre.
• Each party obtains the licences and permits that its role in the transfer requires under the law.

7. Data Breaches

• EgyHosting will inform the customer of any breach affecting their data without delay, and within 48 hours at most of confirming it, so that they can meet their obligations towards the Centre.
• The notification includes whatever is available of: the nature of the breach, the data and services affected, the likely consequences, and the measures taken to contain it.
• EgyHosting will cooperate with the customer in the investigation and in notifying the Centre and the data subjects where required.
• EgyHosting is not responsible for breaches resulting from vulnerabilities in the customer's applications, passwords or settings, but will inform them of such issues if it discovers them.

8. Review and Audit

• On request, EgyHosting provides the customer with the information needed to demonstrate its compliance with this agreement, including its data centres' certifications.
• The customer may carry out an audit once a year, with 30 days' prior notice, at their own cost, and in a way that does not affect other customers' data or the security of the platform. An additional audit may be carried out after any material breach or at the Centre's request.

9. End of Service and Deletion of Data

• The customer can export their data before the service ends, and EgyHosting will assist them on request.
• After the service ends, hosted data is deleted within 30 days and removed from backups within 60 days. Where termination is due to non-payment, the periods in the Terms of Service apply.
• EgyHosting may retain only what the law requires it to retain, and continues to protect it.

10. Liability and Governing Law

The limitations of liability set out in the Terms of Service apply to this agreement to the extent permitted by law. It is governed by Egyptian law, and the courts of Cairo have jurisdiction over any dispute arising from it.

Annex 1: Security Measures

Annex 2: Sub-processors

This list is updated in accordance with clause 5, and the version published on our website is the authoritative one.