Data Processing Addendum

1. Scope and roles

This addendum forms part of the Terms of Service between DevLab Technologies, the provider of HiVouch ("HiVouch", the processor), and the customer (the controller). It applies to personal data of the customer's end users that HiVouch processes on the customer's behalf. It applies together with Egypt's Personal Data Protection Law No. 151 of 2020 and any other data protection law that applies to the customer.

For account data about the customer and its team, HiVouch is a controller and the Privacy Policy applies.

2. Details of the processing

• Subject matter and purpose: verifying that an end user controls a phone number through a WhatsApp message, and returning the result to the customer.
• Duration: the life of the customer's account, subject to the retention periods below.
• Data subjects: the customer's end users who start a verification.
• Types of data: phone numbers (encrypted at rest), message metadata, IP address, approximate country and city, device and browser type, and risk signals.

3. Processing on instructions

HiVouch will process the data only on the customer's documented instructions, which are these terms and the customer's use and configuration of the Service, unless the law requires otherwise. We will tell the customer if we think an instruction breaks the law.

The customer is responsible for having a lawful basis for the processing and for giving end users any notices the law requires.

4. Confidentiality and security

• People who handle the data are bound by confidentiality and have access only as needed.
• We apply measures suited to the risk, including encryption of phone numbers at rest, encryption in transit, access controls and redaction of sensitive fields in logs.

5. Sub-processors

The customer authorizes HiVouch to use these sub-processors:

• Meta Platforms (WhatsApp Business Platform): message delivery and receipt;
• ezPayments: payments (account data only);
• Brevo: transactional email;
• Cloudflare: CDN, DNS and security;
• our cloud hosting provider, [Cloud hosting provider name]: hosting.

We will bind each sub-processor to obligations no less protective than these, and remain responsible for them. We will tell the customer by email before adding or replacing one. The customer may object on reasonable data protection grounds within a reasonable time of that notice by writing to [email protected]; if we cannot resolve it, the customer may close its account.

6. Retention and deletion

• Inbound WhatsApp message records are deleted after 7 days.
• API request logs are deleted after 30 days; bodies are stored only for errors, capped and with sensitive fields redacted.

When the customer's account ends we delete or anonymize the remaining end-user data, except where the law requires us to keep it.

7. Assistance with data subject rights

If an end user contacts us about data we hold for the customer, we will pass the request to the customer and not answer it ourselves unless the law requires it. Taking into account the nature of the processing, we will give the customer reasonable help to respond to such requests, to carry out data protection impact assessments and to deal with regulators.

8. Personal data breaches

We will tell the customer without undue delay after we become aware of a breach affecting its end-user data, with the information we have to help it meet its own duty to notify.

9. Audits and information

On reasonable written request, and not more than once a year unless a breach has occurred, we will give the customer the information needed to show we comply with this addendum. Contact [email protected].

10. International transfers

Where end-user data is transferred outside Egypt, including to a sub-processor, we will do so only as the law allows and with appropriate safeguards.

11. Order of precedence and law

If this addendum conflicts with the Terms of Service on the processing of personal data, this addendum prevails. It is governed by the laws of the Arab Republic of Egypt. Questions: [email protected].