tijariq Data Processing Addendum (DPA)

Between:

• the business that uses tijariq (the "Business", the controller); and
• Cyberstream Solutions and Trading SPC, CR No. 1664225, Al Sooq, Al Seeb Al Jadidah, Al Seeb, Muscat Governorate, P.O. Box 635, P.C. 112, Sultanate of Oman ("Cyberstream", the processor).

This DPA is part of the tijariq Subscription Terms. The Business accepts it when it accepts those terms.

Each side will comply with Oman's Personal Data Protection Law (Royal Decree 6/2022) and its Executive Regulation as they apply to it.

1. What this DPA covers

1.1This DPA covers personal data that the Business, its users or its customers put into tijariq, where the Business decides why and how it is used. Examples: the Business's customers, patients, guests, leads, WhatsApp contacts, staff and suppliers.

1.2It does not cover personal data Cyberstream uses for its own purposes as a controller, such as the account details of the Business's users, billing records and support messages. The tijariq Privacy Policy covers those.

1.3Annex 1 lists the data, the people it is about, and the purpose, by module.

2. Roles

2.1The Business is the controller. Cyberstream is the processor and processes the data on the Business's behalf.

2.2The Business is responsible for:

• having a lawful basis, and any consent needed, for the data and for each message it sends;
• any permit the law requires, for example for sensitive data such as health data;
• giving its customers and staff the privacy information the law requires;
• the accuracy of the data it enters;
• the instructions it gives through its settings.

3. Processing only on instructions

3.1Cyberstream processes the data only to provide tijariq to the Business, following the Business's documented instructions. The Subscription Terms, this DPA and the Business's settings and actions in tijariq are those instructions.

3.2Cyberstream does not sell the data, does not use it for its own marketing, and does not use one business's data to serve another business.

3.3If the law requires Cyberstream to process the data in another way, Cyberstream tells the Business first, unless the law forbids that.

3.4If Cyberstream thinks an instruction breaks the law, it tells the Business and may refuse to follow it.

4. Confidentiality of people with access

Only Cyberstream staff and contractors who need access to provide, support or secure tijariq can reach the data. Cyberstream requires each of them to keep the data confidential.

5. Security

5.1Cyberstream keeps technical and organisational measures that fit the risk. Annex 2 lists the main ones.

5.2Cyberstream may update the measures, but will not reduce the overall level of protection.

6. Sub-processors

6.1The Business gives a general authorisation for Cyberstream to use the sub-processors in the Sub-processor List.

6.2Cyberstream binds each sub-processor by a written contract to data-protection duties no weaker in substance than this DPA, as far as each provider's standard terms allow. Cyberstream stays responsible to the Business for its sub-processors.

6.3Cyberstream gives at least 30 days' notice before adding or replacing a sub-processor, by updating the list and emailing account owners. Urgent replacements (for example after a provider fails) may be made sooner, with notice as soon as possible.

6.4The Business may object on reasonable data-protection grounds within the notice period. If we cannot resolve the objection, the Business may stop using and cancel the affected module and receive a refund of any prepaid period it cannot use.

7. Where data is stored and transferred

7.1tijariq's main database and file storage are in Frankfurt, Germany (Supabase), and the application runs in Frankfurt (Vercel, region fra1).

7.2Some processing happens elsewhere: email is sent and received through Ireland (Resend); the networks of Cloudflare and Meta are global; some AI features use providers in the United States; some providers may process data in the EU or the United States; the iq assistant reaches its AI model through OpenRouter, which passes each request to the company that hosts the model; iq Pro runs on servers in the UAE. The Sub-processor List gives each location.

7.3For each transfer outside Oman, Cyberstream uses contract terms with the provider, encryption in transit, and limits the data to what the feature needs.

7.4Cyberstream will meet any condition the law sets for these transfers, including any permit or notice the competent authority requires. On request, Cyberstream gives the Business the details it needs to tell its own customers and staff where their data goes.

8. Helping with data-subject requests

8.1tijariq gives the Business tools to answer requests from its customers and staff. Today these include:

• Clients: export a client's data and erase a client;
• Connect: delete a contact, with all conversations, messages, files and notes;
• Team: erase a staff member;
• POS: export the business's POS data.

8.2The Clients tools keep working for the owner even when a Clients plan has lapsed (export by owner or admin, erase by owner). Where a module has no tool for a request, or its plan has lapsed or paused, Cyberstream carries out the request on the Business's written instruction, at no charge.

8.3If a person sends a request to Cyberstream about data the Business controls, Cyberstream passes it to the Business without undue delay and does not answer it directly, unless the Business asks us to or the law requires it.

8.4Where the tools are not enough, Cyberstream helps the Business in time for it to answer within 30 days, or sooner if the law requires.

9. Personal-data breaches

9.1Cyberstream tells the Business without undue delay, and within 72 hours after Cyberstream confirms it, of a breach affecting the Business's data.

9.2The notice says, as far as known: what happened, the kinds and rough number of people and records affected, the likely effects, what Cyberstream has done and will do, and a contact person. Cyberstream sends more information as it learns it.

9.3Cyberstream helps the Business meet any duty it has to notify the competent authority and the people affected, including by giving the information in §9.2.

9.4Telling the Business about a breach is not an admission of fault.

10. Help with assessments and the authority

Cyberstream gives the Business reasonable information and help for any impact assessment, prior consultation or request from the competent authority about the processing.

11. Deletion or return at the end

11.1When the Business's plans end, it can export its data for 90 days.

11.2After those 90 days, Cyberstream deletes the data within 30 more days, unless the law requires it to keep some of it. Backup copies are overwritten on their normal cycle and are kept for no more than 30 days.

11.3The Business can ask Cyberstream to delete the data sooner.

11.4On request, Cyberstream confirms in writing that the data has been deleted.

12. Audits and information

12.1On written request, once a year, Cyberstream answers a reasonable security and privacy questionnaire and gives the Business the information needed to show compliance with this DPA.

12.2If that is not enough, or the competent authority requires it, the Business may audit Cyberstream's compliance, with at least 30 days' notice, during business hours, without access to other businesses' data, under confidentiality, at the Business's cost. An audit cannot include the sub-processors' own premises; their reports or certifications are used instead.

13. Liability, order and language

13.1Each side's liability under this DPA is subject to the limits in the Subscription Terms, except where the law does not allow a limit.

13.2For personal data, this DPA prevails over the Subscription Terms.

13.3This DPA lasts as long as Cyberstream processes the Business's data.

13.4This DPA is written in English. The Arabic version is a translation provided for convenience. If they differ, the English version prevails.

Annex 1: processing details

Nature of processing: storing, organising, showing, searching, sending, analysing (including with AI to draft answers), exporting and deleting, as needed to run each module.

Duration: while the Business uses tijariq, plus the export and deletion periods in §11.

Sensitive data: the Business may choose to keep health data (for example clinics in Bookings or Clients) or identity documents (Business documents). The Business is responsible for the legal basis, any permit and any consent these need (§2.2).

Annex 2: main security measures

1. Each business's data is kept apart by row-level security in the database. Every table outside the database provider's own system schemas has row-level security switched on.
2. Data is encrypted in transit (HTTPS with HSTS) and at rest by the database provider.
3. Access tokens for connected services (for example WhatsApp) and payment-provider keys are stored encrypted, in a vault, and are readable only by server code.
4. Links sent to customers (quote, upload) use long random tokens; only a hash of the token is stored; links expire and can be revoked.
5. Webhooks from Meta and payment providers are checked with signatures before use.
6. Traffic to the apps passes through Cloudflare's network protection or the hosting provider's own network protection.
7. Logs are kept to a minimum; we do not log customer messages, takings or invoice contents on purpose.
8. People who opt out of WhatsApp marketing are blocked from business-initiated messages; after a contact is deleted, only a one-way keyed code of the number is kept, so the opt-out still works.
9. Production access is limited to the people who need it.
10. We review security regularly. The last full review was in October 2026.

Annex 3: sub-processors

See the tijariq Sub-processor List (separate document), which forms part of this DPA.