اتفاقيةData Processingمعالجة البياناتAgreement

This Data Processing Agreement ("DPA") forms part of, and is incorporated into, the Staffly Terms of Service between the subscribing organization ("Controller", "Tenant", "you") and Staffly ERP Est. ("Processor", "Staffly"). The Controller determines the purposes and means of processing personal data of its employees and other data subjects; Staffly processes that data solely as a processor, on the Controller's documented instructions.

Subject matter

Provision of the Staffly workforce-management and HR ERP platform (attendance, payroll, leave, employee affairs, and any other module the Controller enables).

Duration of processing

For as long as the service agreement is in force, plus any retention period required by law or set out in Section 9 below.

Nature & purpose

Storage, retrieval, organization, structuring, transmission, and deletion of personal data as necessary to deliver the modules the Controller has enabled.

Categories of data subjects

The Controller's employees, job applicants, and contractors, and their dependents where the relevant module is enabled.

Staffly will:

• Process personal data only on the Controller's documented instructions, including regarding international transfers, unless required to do otherwise by KSA law — in which case Staffly informs the Controller before processing, unless prohibited from doing so
• Ensure personnel authorized to process personal data are bound by confidentiality obligations
• Implement the technical and organizational security measures described in Section 6
• Assist the Controller in responding to data-subject requests (Section 5) and in meeting its own PDPL obligations (impact assessments, breach notification, prior consultation where required)
• Not engage a sub-processor without the authorization described in Section 4
• Make available information reasonably necessary to demonstrate compliance with this DPA, and allow for audits per Section 10

The Controller grants Staffly general authorization to engage sub-processors for the hosting, infrastructure, and support functions necessary to deliver the platform (e.g. cloud infrastructure providers), provided each sub-processor is bound by data-protection terms no less protective than this DPA. Staffly remains fully liable for a sub-processor's acts and omissions. Staffly maintains a current list of sub-processors and will notify the Controller of any intended addition or replacement, giving the Controller a reasonable opportunity to object on data-protection grounds.

Taking into account the nature of processing, Staffly will provide the Controller with reasonable technical and organizational assistance to fulfil its obligation to respond to data subjects exercising their PDPL rights (access, correction, deletion, objection, and restriction) — including through platform features that let the Controller's administrators view, correct, export, or delete personal data directly wherever technically feasible.

Staffly applies technical and organizational measures including:

• Tenant-level data isolation — an architectural design constraint, not a policy alone
• Encryption of data in transit, and encryption of sensitive fields at rest
• Role-based access control with server-side least-privilege enforcement
• Audit logging of access to, and modification of, personal data
• A documented security-incident response process
• Periodic review of granted access and entitlements

If Staffly becomes aware of a personal data breach affecting data it processes on the Controller's behalf, it will notify the Controller without undue delay, and in any event within 72 hours of becoming aware, describing the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed — so the Controller can meet its own notification obligations to the competent authority and affected data subjects under the PDPL.

Staffly's operating posture is in-Kingdom data residency: personal data is stored and processed within Saudi Arabia wherever technically feasible. Where a limited processing function must use a service component located outside the Kingdom, that transfer is made subject to the safeguards required under PDPL Article 29 (documented legal basis, an adequate level of protection or contractual safeguards, and an audit trail) — see the PDPL Compliance page for detail.

Staffly processes and retains personal data only for the duration of the service agreement, plus any period required by applicable law (e.g. statutory payroll/labor-record retention). On termination of the service agreement, at the Controller's choice, Staffly will return the Controller's data in a usable exported format and/or delete it (including from backups within a reasonable operational cycle) within 30 days, except where retention is required by law.

On reasonable prior written notice, and no more than once per year (or following a confirmed personal data breach), the Controller may request information demonstrating Staffly's compliance with this DPA, including relevant audit reports, security certifications, or a summary audit. Staffly will make such information available, or reasonably cooperate with an on-site audit where reasonably necessary, in a manner that does not compromise the security or confidentiality of other tenants' data.

This DPA takes effect on the date the Controller begins using the Platform and remains in effect for as long as Staffly processes personal data on the Controller's behalf under the service agreement. It terminates automatically on expiry or termination of the underlying service agreement, without prejudice to obligations that by their nature survive termination (confidentiality, security of retained data pending deletion, and breach notification for incidents arising before termination).

This DPA is governed by the laws of the Kingdom of Saudi Arabia, including the Personal Data Protection Law and its Implementing Regulations. Any dispute arising from this DPA is subject to the exclusive jurisdiction of the competent courts of Saudi Arabia.