Data Processing Agreement

1. Purpose and Scope

This Data Processing Agreement forms part of the agreement between SwiftNinePay and the merchant or business using our services.

It applies wherever SwiftNinePay processes personal data on behalf of that customer in connection with the services.

2. Definitions

Controller means the party that determines the purposes and means of processing Personal Data.

Processor means the party that processes Personal Data on behalf of a Controller.

Personal Data means information relating to an identified or identifiable individual that is processed under this DPA.

Personal Data Breach means a security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data.

Sub-Processor means a third party engaged by SwiftNinePay to process Personal Data on behalf of the Controller.

Data Protection Law means the laws applicable to processing under this DPA, including UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and, where applicable, the EU and UK General Data Protection Regulation.

3. Roles of the Parties

For Personal Data processed on the customer's instructions, the customer is the Controller and SwiftNinePay is the Processor.

Where SwiftNinePay determines the purposes and means of processing independently, including processing required to meet our own legal, regulatory, fraud-prevention, or payment-scheme obligations, we act as an independent Controller for that processing. Cardholder data handled under Payment Card Industry Data Security Standard requirements falls into this category.

Each party is responsible for the obligations attaching to its role.

4. Processing Instructions

When acting as Processor, SwiftNinePay processes Personal Data only as needed to provide the agreed services, in line with the customer's documented instructions, or where required by Data Protection Law.

Where the law requires us to process outside those instructions, we will tell the customer beforehand unless the law prevents us from doing so.

5. Confidentiality and Personnel

Confidentiality obligations bind personnel authorised to access Personal Data. Access is limited to those who need the information to perform their role.

6. Security

SwiftNinePay maintains the technical and organisational measures designed to protect Personal Data against unauthorised access, loss, alteration, disclosure, or destruction.

Measures are reviewed as systems, services, and risks change. Any replacement measure will offer a comparable or higher level of protection.

7. Sub-Processors

The customer gives general authorisation for SwiftNinePay to engage Sub-Processors.

We impose data-protection obligations on each Sub-Processor that are no less protective than those in this DPA, and we remain responsible for their performance.

We will give the customer at least 30 days' notice before adding or replacing a Sub-Processor. The customer may object on reasonable data-protection grounds within that period, and the parties will work to find a solution. Where none is available, the customer may terminate the affected services.

8. Data Subject Rights and Compliance Assistance

Where we receive a request from an individual relating to Personal Data processed for a customer, we will direct that request to the customer rather than respond to it ourselves.

Taking account of the nature of the processing and the information available to us, we will give the customer reasonable assistance with access, correction, deletion, restriction, objection, and other applicable rights, and with data-protection impact assessments and any required consultation with a supervisory authority.

9. Personal Data Breaches

Where SwiftNinePay becomes aware of a Personal Data Breach affecting Personal Data processed for a customer, we will notify that customer without undue delay and in any event within 72 hours of becoming aware.

The notification will set out the information available to us on the nature of the incident, the categories and approximate volume of data affected, the likely consequences, and the steps taken or proposed. Where full information is not available at the time, we will provide it in stages as it becomes known.

10. International Transfers

SwiftNinePay operates across several markets, so Personal Data may be processed or transferred outside the country where it was collected.

Where Data Protection Law requires safeguards for a transfer, the parties will put an appropriate lawful mechanism in place, including Standard Contractual Clauses where the GDPR applies. SwiftNinePay will meet the conditions applying to cross-border transfers under UAE Federal Decree-Law No. 45 of 2021.

11. Return and Deletion

On termination of the relevant services, SwiftNinePay will delete or return Personal Data processed for the customer at the customer's request, unless continued retention is required by law. Backup copies are overwritten on our standard backup cycle and deleted within 60 days of termination.

12. Audit and Compliance Information

SwiftNinePay will make available the information reasonably necessary to demonstrate compliance with this DPA.

Where Data Protection Law gives the customer an audit right, an audit may be carried out on reasonable notice, no more than once in any 12 months unless a Personal Data Breach or a regulator requires otherwise, and subject to confidentiality obligations and reasonable measures to limit disruption to our operations.

13. Customer Responsibilities

The customer is responsible for ensuring that Personal Data is collected and shared lawfully, that appropriate privacy notices are given, that a lawful basis exists for the processing, that its instructions to us comply with Data Protection Law, and that only Personal Data reasonably required for the services is provided to us.