Data Processing Addendum

Roles of the parties

This Data Processing Addendum ("DPA") forms part of the agreement between you ("Customer") and AuthOwl. For personal data relating to your end-users that we process through the service, you act as the controller and AuthOwl acts as the processor. Each party will comply with its obligations under applicable data protection law, including Egypt’s Personal Data Protection Law (Law No. 151 of 2020, the "PDPL").

Scope and purpose

AuthOwl processes end-user personal data only to provide the authentication service, including account creation, sign-in, multi-factor authentication, session management, and related support and security functions. The categories of data typically include identifiers, credentials, contact details, and authentication and device metadata, relating to your end-users.

Processing instructions

We process end-user personal data only on your documented instructions, including those in the agreement, this DPA, and your use of the service’s configuration options, unless required to act otherwise by law. If we believe an instruction conflicts with applicable law, we will inform you.

Confidentiality

We ensure that personnel authorized to process end-user personal data are bound by appropriate confidentiality obligations and access that data only as needed to perform their duties.

Security measures

We implement technical and organizational measures appropriate to the risk, including encryption of data in transit, access controls, network protection, logging, and regular review of our controls. We maintain measures designed to protect end-user personal data against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure or access.

Subprocessors

You authorize AuthOwl to engage subprocessors to help deliver the service, such as cloud hosting, communications, and payment providers. We impose data protection obligations on each subprocessor that are no less protective than those in this DPA and remain responsible for their performance. We will make our current subprocessor list available and give notice of material changes so you can object on reasonable grounds.

Data subject requests

Taking into account the nature of the processing, we will provide reasonable assistance to help you respond to requests from data subjects to exercise their rights. If we receive such a request directly, we will advise the individual to contact you, unless legally required to respond ourselves.

Personal data breach notification

We will notify you without undue delay after becoming aware of a personal data breach affecting end-user personal data, and will provide information reasonably available to help you meet your own notification obligations under the PDPL and other applicable law.

Return and deletion

On termination or expiry of the service, we will, at your choice, delete or return end-user personal data and delete existing copies, unless retention is required by law. Deletion from backups occurs in the ordinary course of our backup cycle.

Audits

We will make available information reasonably necessary to demonstrate our compliance with this DPA and will allow for and contribute to audits, subject to reasonable confidentiality, security, and scheduling arrangements. Where available, we may satisfy audit requests by providing relevant reports or documentation.

International transfers

Where processing involves transferring end-user personal data outside Egypt, we will implement the safeguards required by the PDPL and other applicable law, including appropriate contractual protections, so that the data continues to receive an adequate level of protection.

Term

This DPA takes effect when you begin using the service to process end-user personal data and continues for as long as AuthOwl processes such data on your behalf.

Governing law

This DPA is governed by the laws of the Arab Republic of Egypt. Where the main agreement and this DPA conflict on data protection matters, this DPA prevails. Questions can be sent to dpo@authowl.dev.