Data Processing Agreement

1. Parties and purpose

1.1 This agreement is between the business that holds a Tsaami account (the "Shop", the controller) and Tsaami LLC, Commercial Registration No. 1677897, Sultanate of Oman ("Tsaami", the processor). It is part of the Tsaami Terms of Service and is accepted with them.

1.2 It sets out how Tsaami processes the personal data of the Shop's customers on the Shop's behalf, as the contract between a controller and a processor that Article 3 of the Executive Regulation of the Personal Data Protection Law (Ministerial Decision 34/2024) provides for. "PDPL" means the Personal Data Protection Law issued by Royal Decree 6/2022, and "Regulation" means that Executive Regulation. Words defined in the PDPL have the same meaning here.

1.3 What this agreement does not cover. Tsaami is itself the controller of (a) the Shop's own account, team and billing data and (b) the shared customer record (one record per mobile number) described in the Privacy Policy. Tsaami handles that data under the Privacy Policy, not under this agreement.

2. The processing

The subject matter, duration, nature and purpose of the processing, the kinds of personal data and the people concerned are in Annex 1.

3. The Shop's instructions

3.1 Tsaami processes the Shop's customer data only on the Shop's documented instructions. The instructions are: the Terms of Service, this agreement, and what the Shop and its users do and set in the service (for example the cards it designs, the stamps its staff record, the messages it sends, the exports it downloads and the integrations it connects).

3.2 Tsaami does not use the Shop's customer data for its own marketing, does not sell it, and does not disclose it to another shop, except for the shared record in clause 1.3.

3.3 If Tsaami believes an instruction breaks the PDPL, it tells the Shop and may decline to act on it.

3.4 Tsaami may be required by Omani law or a court order to process or disclose data. Where the law allows, it tells the Shop first.

4. The Shop's duties

The Shop confirms that it has a lawful basis for the data it puts into Tsaami, including the explicit consent of each customer where the PDPL requires it (Article 10), the guardian's consent for a child (Article 6), prior written consent for marketing (Article 22), and the customer's explicit consent to the transfer of their data outside Oman (Regulation, Article 37). The Shop gives its customers the notice Article 14 of the PDPL requires.

5. People who handle the data

Tsaami makes sure that every person it authorises to access the Shop's customer data is bound to keep it confidential. Access by Tsaami support staff to a Shop's account is through a recorded support session that states its reason, is visible to the Shop, shows customer names and numbers masked, and cannot download the customer list or erase a customer.

6. Security

Tsaami applies the technical and organisational measures in Annex 2 to protect the data against unlawful access, loss, alteration and disclosure (PDPL, Articles 13 and 21; Regulation, Article 26). Tsaami may change the measures as long as the level of protection does not go down.

7. Sub-processors

7.1 The Shop gives Tsaami general permission to use the sub-processors in Annex 3.

7.2 Tsaami tells the Shop at least 30 days before adding or replacing a sub-processor, by e-mail to the owner or in the dashboard. If the Shop objects on reasonable data-protection grounds and the parties cannot agree, the Shop may cancel its subscription before the change takes effect and receive a refund of the fees paid for the unused whole months.

7.3 Tsaami puts each sub-processor under data-protection duties no weaker than those in this agreement, so far as that provider's standard terms allow, and remains responsible to the Shop for what its sub-processors do with the data.

8. Transfers outside Oman

8.1 The Shop knows and agrees that the data is hosted and processed outside the Sultanate of Oman, in the places listed in Annex 3.

8.2 Tsaami gives the Shop the information it has about where the data goes and how each sub-processor protects it, so that the Shop can make the assessment Articles 38 and 39 of the Regulation require.

8.3 Tsaami does not move the data to a new country without telling the Shop under clause 7.2.

9. Personal data breaches

9.1 Tsaami tells the Shop without undue delay, and within 48 hours of becoming aware of a personal data breach that affects the Shop's customer data, so that the Shop can meet its own 72-hour duties to the Ministry and to the people affected (PDPL, Article 19; Regulation, Articles 30 and 32).

9.2 The notice says, so far as is known: what happened and when; which data and roughly how many people are affected; the likely effects; what Tsaami has done and will do; and who to contact. Tsaami sends more information as it becomes known.

9.3 Tsaami takes reasonable steps to contain the breach and limit its effects, keeps a record of it (Regulation, Articles 28 and 33), and does not tell the Shop's customers or the Ministry on the Shop's behalf unless the Shop asks or the law requires.

10. Helping the Shop meet its duties

10.1 Customers' requests. Tsaami provides the Privacy Centre, in which the Shop records each request from a customer (a copy of their data, a correction, erasure, or an objection to marketing), sees its deadline, downloads the customer's data, and anonymises a customer at that Shop. If a customer writes to Tsaami about data the Shop controls, Tsaami passes the request to the Shop without delay and does not answer it for the Shop.

10.2 Records and information. Tsaami keeps a record of its processing (Regulation, Article 28) and gives the Shop, on request, the information reasonably needed to show that this agreement is followed, or to answer the Ministry within the time the Regulation sets (Article 2).

10.3 Audits. Not more than once a year, or when the Ministry requires it (PDPL, Article 16), the Shop may ask Tsaami written questions about the measures in Annex 2, and Tsaami answers within 30 days. An inspection on site, or by an external auditor, is by agreement on scope, timing, confidentiality and cost.

11. Return and deletion at the end

11.1 While the subscription runs, and for 90 days after it is cancelled, the Shop's owner can download all of the Shop's data from the "Your data" page as CSV and JSON files.

11.2 After those 90 days Tsaami deletes or anonymises the Shop's customer data within a further 30 days, except: (a) data Tsaami must keep by law; (b) the anonymised history; (c) the shared customer record in clause 1.3; and (d) copies in encrypted backups, which expire within 35 days and are not restored for use.

11.3 On request Tsaami confirms in writing that the deletion is done.

12. Liability

The limits and exclusions in the Terms of Service apply to this agreement. Each party is responsible for the fines and claims that arise from its own breach of the PDPL or of this agreement.

13. Contacts

Tsaami's privacy contact (Data Protection Officer): info@tsaami.com, WhatsApp +968 7727 2705. The Shop's contact is the owner's e-mail address on the account.

14. Term, law and order of precedence

14.1 This agreement lasts as long as Tsaami holds the Shop's customer data.

14.2 It is governed by the laws of the Sultanate of Oman, and the dispute and language clauses of the Terms of Service apply. This agreement is written in Arabic and English; if they differ, the Arabic text applies.

14.3 If this agreement and the Terms of Service disagree about the handling of the Shop's customer data, this agreement applies.

Annex 1. Details of the processing

Annex 2. Security measures

• Encryption in transit: HTTPS for every page and API call, with strict

transport security and a content security policy on the web apps.

• Separation of shops: every table that holds a Shop's data is protected by

database row-level security keyed to the Shop; the application connects with a restricted database role that cannot bypass it.

• Sign-in: passwords stored only as Argon2 hashes; two-step sign-in

mandatory for owners and for Tsaami's own administrators (authenticator app, passkeys, single-use recovery codes); counter PINs hashed; lock-out after repeated wrong attempts; idle and absolute session time-outs; sessions can be listed and ended.

• Least privilege: roles and permissions per person; approval limits for

sensitive counter actions; downloading the whole customer list is limited to the owner and requires signing in again.

• Logging: an activity (audit) log protected against tampering by a hash

chain; an access log of who viewed customer data; personal data is masked or removed from technical logs.

• Secrets: credentials for connected services are encrypted at rest with

AES-256-GCM and are never shown again after they are saved.

• Abuse limits: rate limits on sign-in, joining, scanning and public pages.
• Backups: an encrypted database backup every 6 hours, kept 35 days, with a

monthly restore test.

• Payments: when a Shop pays online by card, card details are entered only

on Thawani's page and never reach Tsaami's systems.

• Erasure by anonymisation: a member's identity is removed while the

loyalty history is kept without it.

Annex 3. Sub-processors

Where a Shop connects its own WhatsApp number, WhatsApp (Meta) carries those messages; this is switched off until it is ready. The card-design helper that would use a third party (Anthropic) receives only what a Shop types about its own business and never any member data; it is switched off unless a Shop's own key is set.