This Data Processing Agreement ("DPA") forms part of the agreement between Bayaan Hub FZCO, trading as Bayaan.ai ("Bayaan" or "Processor"), and the organisation identified in the applicable order, subscription or agreement ("Customer" or "Controller").
This DPA applies where Bayaan processes Personal Data on behalf of the Customer in connection with the Bayaan Service.
1. Definitions
For this DPA:
"Applicable Data Protection Law"
means applicable laws governing the processing and protection of Personal Data, including, where applicable, Federal Decree-Law No. 45 of 2021 Regarding the Protection of Personal Data of the United Arab Emirates and applicable implementing legislation.
"Controller"
means the party determining the purposes and means of processing Personal Data.
"Processor"
means the party processing Personal Data on behalf of the Controller.
"Personal Data"
means information relating to an identified or identifiable natural person.
"Processing"
has the meaning given under applicable data protection law.
"Data Subject"
means an identifiable individual to whom Personal Data relates.
"Sub-processor"
means a third party appointed by Bayaan to process Personal Data on behalf of the Customer.
2. Roles of the Parties
The Customer is the Controller of Personal Data submitted to Bayaan for processing on the Customer's behalf.
Bayaan is the Processor of such Personal Data.
The parties acknowledge that Bayaan may separately act as a Controller for Personal Data relating to the Customer's account, billing, customer support, security and direct business relationship with Bayaan.
3. Processing Instructions
Bayaan shall process Personal Data:
- only to provide and support the Service;
- in accordance with the Customer's documented instructions;
- in accordance with this DPA;
- in accordance with applicable data protection law; and
- for no unrelated purpose.
The Customer's instructions are generally documented through the Service, the applicable subscription, this DPA and the Terms of Service.
If Bayaan reasonably believes that an instruction violates applicable data protection law, Bayaan may notify the Customer and suspend the relevant instruction where legally required.
4. Nature and Purpose of Processing
Bayaan may process Personal Data for purposes including:
- hosting;
- storing;
- retrieving;
- organising;
- transmitting;
- displaying;
- analysing;
- securing;
- backing up;
- customer support;
- authentication;
- AI processing;
- generating outputs requested by the Customer;
- monitoring and maintaining the Service; and
- preventing fraud, abuse and security incidents.
5. Categories of Data Subjects
Depending on the Customer's use of the Service, Data Subjects may include:
- employees;
- administrators;
- mosque staff;
- volunteers;
- teachers;
- scholars;
- members;
- students;
- visitors;
- event participants;
- customers; and
- other individuals whose information the Customer submits to Bayaan.
The Customer remains responsible for ensuring that it has an appropriate legal basis to process and provide such information to Bayaan.
6. Categories of Personal Data
Depending on the Service, Personal Data may include:
- names;
- email addresses;
- telephone numbers;
- account credentials;
- user IDs;
- organisation information;
- contact details;
- audio recordings;
- text;
- documents;
- images;
- user-generated content;
- AI prompts and conversations;
- technical information;
- IP addresses;
- usage information; and
- other information submitted by the Customer.
The Customer should not submit Sensitive Personal Data unless the applicable Service expressly supports such processing and appropriate safeguards are in place.
7. Sensitive Personal Data
The Customer is responsible for determining whether information submitted to Bayaan constitutes Sensitive Personal Data.
Where the Customer intends to process Sensitive Personal Data through Bayaan, the Customer must notify Bayaan where reasonably necessary to enable Bayaan to implement appropriate safeguards.
Bayaan may restrict particular processing activities where necessary to comply with applicable law or security requirements.
8. Confidentiality
Bayaan shall ensure that persons authorised to process Personal Data are subject to appropriate confidentiality obligations.
Bayaan shall not disclose Customer Personal Data except:
- to provide the Service;
- on the Customer's documented instructions;
- to authorised Sub-processors;
- where required by applicable law; or
- where necessary to protect the security or integrity of the Service.
9. Security Measures
Bayaan shall maintain reasonable technical and organisational security measures appropriate to the risks associated with processing.
Such measures may include:
- access controls;
- authentication;
- encryption in transit;
- encryption at rest where appropriate;
- logging;
- monitoring;
- backups;
- vulnerability management;
- incident response procedures;
- personnel access controls; and
- secure development practices.
Bayaan may update its security measures provided that the overall level of protection is not materially reduced.
10. Sub-processors
The Customer authorises Bayaan to use third-party Sub-processors where reasonably necessary to provide the Service.
Sub-processors may include providers of:
- cloud hosting;
- AI infrastructure;
- databases;
- authentication;
- payment-related services;
- analytics;
- security;
- communications;
- customer support.
Bayaan shall require relevant Sub-processors to maintain appropriate data protection and confidentiality obligations.
Bayaan may maintain an up-to-date list of Sub-processors at:
Where required by applicable law or contract, Bayaan will provide reasonable notice of material changes to Sub-processors and an appropriate mechanism for raising objections.
11. Data Location and International Transfers
Bayaan primarily processes and stores Personal Data on servers located within the European Union.
The Customer acknowledges that Bayaan and its Sub-processors may process Personal Data in jurisdictions outside the European Union or the United Arab Emirates.
Where Personal Data is transferred internationally, Bayaan shall implement the safeguards required by applicable data protection law.
The parties shall cooperate in good faith to implement additional safeguards where legally required.
12. Data Subject Requests
Taking into account the nature of processing, Bayaan shall provide reasonable assistance to the Customer in responding to Data Subject requests.
If a Data Subject contacts Bayaan directly concerning Personal Data controlled by the Customer, Bayaan may direct the individual to the Customer unless applicable law requires Bayaan to respond directly.
The Customer remains primarily responsible for responding to requests concerning Personal Data for which it acts as Controller.
13. Personal Data Breaches
Bayaan shall maintain procedures designed to identify, investigate and respond to Personal Data breaches.
Where Bayaan becomes aware of a breach affecting Customer Personal Data, Bayaan shall notify the Customer without undue delay and provide information reasonably available to Bayaan concerning:
- the nature of the incident;
- categories of affected data;
- likely consequences;
- measures taken or proposed; and
- other information reasonably necessary for the Customer to meet applicable obligations.
14. Data Protection Impact Assessments
Where reasonably necessary, Bayaan shall provide reasonable information concerning its processing activities to assist the Customer with a data protection impact assessment.
The Customer remains responsible for conducting any assessment legally required of it as Controller.
15. Deletion and Return of Data
Following termination of the Service, Bayaan shall, subject to applicable legal retention obligations:
- delete Customer Personal Data;
- return Customer Personal Data where technically and commercially appropriate; or
- anonymise Customer Personal Data where appropriate.
Unless otherwise agreed, Customer Personal Data may remain in encrypted backups for a limited period before being securely overwritten in accordance with Bayaan's backup and retention procedures.
16. Audits and Compliance Information
Upon reasonable written request, Bayaan may provide information reasonably necessary to demonstrate compliance with this DPA.
Where legally required, the Customer may conduct an audit subject to reasonable notice, confidentiality obligations, security requirements and measures designed to avoid disruption to Bayaan's operations or other customers.
17. Customer Responsibilities
The Customer shall:
- comply with applicable data protection law;
- provide appropriate privacy notices to Data Subjects;
- establish an appropriate lawful basis for processing;
- ensure that Personal Data submitted to Bayaan is accurate and lawful;
- provide lawful instructions to Bayaan;
- implement appropriate access controls;
- avoid submitting unnecessary Sensitive Personal Data; and
- notify Bayaan of any relevant legal or security requirements applicable to the Customer's processing.
18. AI Services
Where the Customer uses AI functionality, the Customer acknowledges that Personal Data may be processed by AI technology providers used by Bayaan.
Bayaan shall take reasonable measures to ensure that such providers process Personal Data consistently with applicable contractual and legal requirements.
Bayaan shall not knowingly permit Customer Personal Data to be used by a third-party AI provider to train publicly available foundation models where the applicable provider terms prohibit such use.
19. Term and Termination
This DPA remains effective for as long as Bayaan processes Customer Personal Data on behalf of the Customer.
The DPA terminates automatically when Bayaan no longer processes Customer Personal Data, subject to provisions that by their nature survive termination.
20. Order of Precedence
In the event of a conflict:
- applicable mandatory law prevails;
- this DPA prevails over the Terms of Service with respect to the processing of Customer Personal Data;
- the applicable subscription or order form prevails over the Terms of Service where expressly stated.
21. Liability
Any liability relating to this DPA shall be subject to the liability provisions contained in the applicable commercial agreement between the parties, except to the extent mandatory applicable law provides otherwise.
22. Contact
Bayaan Hub FZCO Building A1, Dubai Digital Park, Dubai Silicon Oasis Dubai, United Arab Emirates
Privacy / Data Protection contact: info@bayaan.ai
Schedule 1 — Processing Details
Subject matter
Provision of the Bayaan.ai SaaS platform.
Duration
For the duration of the Customer's subscription and any legally required retention period.
Nature of processing
Collection, storage, hosting, retrieval, organisation, transmission, analysis, AI processing, support, security and deletion.
Purpose
To provide the Bayaan.ai Service requested by the Customer.
Data Subjects
Employees, administrators, mosque staff, volunteers, scholars, members, students, visitors, event participants and other persons whose Personal Data is submitted by the Customer.
Personal Data
Names, contact information, account data, usage information, text, audio, documents, images, AI prompts, conversations and other information submitted by the Customer.
Sensitive Personal Data
Only where expressly supported and authorised.
Processing locations
Primarily within the European Union. Additional processing may occur in other jurisdictions used by Bayaan and its approved Sub-processors, subject to appropriate safeguards.
Schedule 2 — Sub-processors
Bayaan maintains a current Sub-processor list at:
The list identifies, where appropriate:
- provider;
- service;
- processing purpose;
- processing location; and
- categories of Personal Data processed.