Data Processing Addendum

This Data Processing Addendum (“DPA”) is between the business customer (the “Customer”, as controller) and The Captain International Investment SPC, a company registered in the Sultanate of Oman, with its address at Muscat, Sultanate of Oman (the “Processor”, “we”), and forms part of the Terms of Service for PharmaERP Corporate. It applies to personal data contained in Customer Data that we process on the Customer’s behalf (“Customer Personal Data”). It is accepted together with the Terms and needs no separate signature.

Words such as personal data, processing, controller, processor, data subject and breach have the meaning given in the Personal Data Protection Law (Royal Decree 6/2022, as amended, the “PDPL”) and its Executive Regulation (Ministerial Decision 34/2024, as amended). For Customer Personal Data, this DPA prevails over the Terms if they conflict.

• The Customer is responsible for the lawfulness of the processing it instructs, including having a lawful basis (such as explicit consent or another basis the PDPL allows) for each category of data, giving notices to data subjects, and obtaining any consent needed for transfer of their data outside Oman.
• The Customer is responsible for obtaining any permit from the Ministry the PDPL requires, appointing its own data protection officer, keeping its own record of processing, and handling data subject requests and breach notifications to the Ministry and data subjects as controller.
• The Customer’s use of the Service, its settings, and the actions of its users are its documented instructions to us. The Customer will not instruct processing that breaks the law.

• Process Customer Personal Data only on the Customer’s documented instructions (including as set out in the Terms and given through the Service), unless the law requires otherwise, in which case we will tell the Customer first where the law allows. We will tell the Customer if we believe an instruction breaks the PDPL.
• Make sure that our staff and contractors who can access Customer Personal Data are bound by confidentiality and access it only as needed.
• Apply the technical and organisational measures in the Security Annex below.
• Not sell Customer Personal Data, not use it for our own purposes such as advertising, and not use it to train AI models.
• Keep records of our processing activities as the Executive Regulation requires.
• Provide the Customer with the information reasonably needed to show compliance with this DPA, and cooperate with the Ministry when it asks.

The Customer gives general authorisation for us to use sub-processors. The current list is:

• We bind each sub-processor by written terms with data protection obligations not less protective than this DPA, and remain responsible to the Customer for its performance.
• We will give at least 30 days’ notice (by email to the account owner or in the app) before adding or replacing a sub-processor that handles Customer Personal Data. The Customer may object on reasonable data protection grounds within that time. If we cannot address the objection, the Customer may terminate the affected Service and receive a refund of the unused prepaid fees for it, as its only remedy.
• Email providers that the Customer connects to send emails from its own mailbox act for the Customer and are not our sub-processors.

The Customer acknowledges that Customer Personal Data is stored and processed in Saudi Arabia (Google Cloud me-central1), the Netherlands (Google Cloud europe-west4) and other locations used by the sub-processors listed above. We have assessed the protection offered by these providers, use providers bound by written data protection terms offering protection not lower than the PDPL, and encrypt data in transit and at rest. The Customer is responsible for obtaining any consent of data subjects the PDPL requires for these transfers. We will provide the information in our transfer assessment that the Customer reasonably needs for its own assessment.

The Service lets the Customer access, correct, export and delete Customer Personal Data itself. If we receive a request from a data subject about Customer Personal Data, we will pass it to the Customer without undue delay and will not answer it ourselves unless the Customer asks us to or the law requires it. We will give reasonable help so the Customer can respond within the 45 days the Executive Regulation allows. Help beyond the Service’s standard features may be charged at reasonable cost.

We will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting Customer Personal Data, so that the Customer can notify the Ministry and data subjects within the 72 hours the Executive Regulation requires. Our notice will describe, as far as known, the nature of the breach, the data and data subjects concerned, the likely consequences, and the measures taken or proposed. We will take reasonable steps to contain it and give the Customer reasonable help. Notifying a breach is not an admission of fault or liability.

On written request, not more than once a year (or after a breach, or when the Ministry requires it), we will answer reasonable written questions about our compliance and provide relevant summaries, policies and our providers’ certifications. Where the Ministry requires an external audit under the PDPL, we will cooperate with an approved auditor bound by confidentiality, at a time agreed in advance and without access to other customers’ data. Each party bears its own costs, unless the audit shows a material breach by us.

The Customer can export Customer Data at any time, including during the read-only period of 90 days after its subscription ends. After that period, and after notice to the account owner, or earlier at the Customer’s request, we will delete Customer Personal Data, unless the law requires us to keep it or it is needed for an existing dispute. Backup copies, if any, are overwritten in the normal backup cycle and are protected until then.

Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms of Service, to the extent the law allows. Each party is responsible for its own fines and penalties imposed by an authority for its own breach of the PDPL.

• Tenant isolation: each company’s data is stored under its own path and every read and write is checked against the user’s company and role by server-side security rules; server routes verify the sign-in token on every request.
• Access control: role-based access with administrator, staff and vendor levels; approval workflows; only authorised platform staff can access the platform console, with verified email required.
• Authentication: Google Cloud identity services with hashed passwords; email verification required before payment; sessions use short-lived signed tokens.
• Encryption: data encrypted in transit (TLS) and at rest (Google Cloud encryption).
• Infrastructure: hosted on Google Cloud, which holds recognised security certifications (such as ISO/IEC 27001 and SOC 2) for its data centres and services.
• Secrets: keys and credentials are held in a secrets manager, not in source code.
• Logging: activity logs of important changes inside each company; billing events recorded; error logs kept for a limited time.
• Read-only protection: when a subscription ends, data cannot be changed or deleted by users until renewal or the end of the retention period.
• Payments: card data is entered with Thawani and never reaches our systems.
• AI: only the content needed for a request the user starts is sent to the AI provider, under terms that do not allow training on it.
• Change management and testing: security rules and key functions are covered by automated tests before release.
• Incident response: a process to assess, contain and notify breaches as set out in this DPA.
• Staff: confidentiality obligations and least-privilege access for anyone who can access production data.

We may update these measures as technology develops, provided the overall level of protection is not reduced.

Questions about this DPA, objections to sub-processors and breach-related communications: info@ciispc.com.