Personal data processing agreement

This agreement is entered into between the subscribing center (the "Controller") and Khuwarizm Technology, owner of the Mutrafa platform (the "Processor"). It is accepted electronically together with the Terms of use and forms part of them. It was prepared in line with Article 8 of the Personal Data Protection Law and Article 17 of its Implementing Regulation.

1. Roles

1. The center is the controller: it determines the purposes and means of processing, ensures there is a legal basis for it, and gives its clients the privacy notice.
2. Mutrafa is the processor: it processes data for the benefit of the center and on its behalf, and only under its documented instructions, including this agreement and the center's settings on the platform.
3. If Mutrafa considers that an instruction breaches the law, it informs the center in writing and may refuse to carry it out.

2. Processing details

• Purpose: managing bookings, the calendar, client files, payments, reviews, reports, ready-made message lists, and technical support.
• Data subjects: the center's clients and staff.
• Data categories: name, mobile number, appointments and services, payment status and amount (without card data), reviews, and the center's notes about the client.
• Booking verification code: sent to the client's email to confirm her booking. The email is not stored with the booking; an irreversible fingerprint of it is kept for 48 hours only, to prevent abuse, and then deleted.
• Booking page statistics not linked to the visitor's identity (optional, depending on the plan): a temporary random visit identifier from the visitor's browser, the booking step she reached, and the referring site. No name, mobile number, or IP address, and deleted after 13 months. The center uses them only to improve its booking page.
• Sensitive data: the center's notes may include health information or skin sensitivities, which are sensitive. The center must obtain the client's explicit consent and record only the minimum needed.
• Duration: the subscription term, then a period to allow export, then destruction.

3. Mutrafa's obligations

1. Processing only for the stated purposes, and not using the data for its own purposes, to market its services to clients, to train artificial intelligence models, or selling it.
2. Confidentiality: limiting access to those whose duties require it, and binding them to confidentiality.
3. Security: applying appropriate technical and organizational controls, and additional controls for sensitive data under Article 26 of the Regulation.
4. Rights: providing tools to export, correct, and delete a client's data, and forwarding any requests it receives to the center without answering them unless authorized.
5. Compliance: helping the center with the information needed for impact assessments, the record of processing activities, and replies to inquiries from the competent authority.

4. Incidents

1. Mutrafa notifies the center without undue delay on becoming aware of any leak, damage, or unlawful access to data, so that the center can notify the Saudi Data and Artificial Intelligence Authority within 72 hours where harm is likely, and the Ministry of Commerce within 3 days where applicable.
2. The notice includes: a description of the incident and its time, the categories of data affected, the likely consequences, the measures taken, and a contact point.
3. Mutrafa takes immediate containment measures and cooperates in the investigation.

5. Mandatory disclosure

Mutrafa does not need the center's prior consent for a disclosure required by Saudi law, and it informs the center of it. Mutrafa is subject to Saudi law.

6. Sub-processors

1. The center agrees that Mutrafa may use sub-processors to provide the service, including: the hosting provider, and the payment gateway once enabled (coming soon).
2. Mutrafa undertakes to publish to the center the list of sub-processors and their processing locations, and to notify it before adding or replacing a sub-processor, with sufficient notice, and the center may object for a reasonable cause.
3. Mutrafa imposes on each sub-processor protection obligations no less than those in this agreement, and remains responsible to the center for its performance.

7. Transfers outside the Kingdom

Mutrafa does not transfer client data outside the Kingdom except to the published sub-processors, for the necessary purpose, at the minimum level, and in line with Article 29 of the Law and the transfer regulation, including the standard contractual clauses issued by SDAIA where required. The restrictions on sensitive data in the transfer regulation are observed.

8. Audit

On reasonable request, Mutrafa provides evidence of its compliance (a summary of its security controls or a security questionnaire), so the center can periodically verify its compliance.

9. End of processing

When the subscription ends, Mutrafa makes data export available in a common format, then destroys the data, including backups, once the purpose has ended, and confirms this in writing on request, except for anything the law requires it to keep.

10. The center's obligations

1. Having a legal basis for every processing it requests, and obtaining the necessary consents for promotional messages and health data.
2. Making the privacy notice available to its clients at the point of collection. Mutrafa creates it automatically in the center's account and shows it on the booking page (see WhatsApp messages and consent), and the center remains responsible for its content and for receiving and answering its clients' requests.
3. Not giving instructions that breach the law.
4. Registering with the competent authority and appointing a data protection officer if required.
5. Protecting its login details and its staff's permissions.

11. Liability and precedence

Each party is liable to the other for its own breach of the law or of this agreement. In case of conflict with the Terms of use on data protection matters, this agreement prevails.