This Data Processing Addendum ("Addendum") forms part of the agreement between the customer named in the order form ("Customer") and Apivom Technology FZ-LLC, licensed by the Dubai Development Authority (Dubai Internet City licence 107172), registered address DMC-BLD-VD-G00-706, Building 5, Dubai Media City, Dubai, United Arab Emirates ("Apivom"), under which Apivom provides a service listed in Schedule A (the "Service"). Capitalised terms not defined here have the meaning in that agreement (the "Agreement"). Questions: info@apivom.com. The list of sub-processors is published at /subprocessors.

1. Roles and definitions

1.1 For personal data that the Service processes on Customer's behalf, Customer is the controller (in Turkish law "veri sorumlusu") and Apivom is the processor ("veri işleyen"). Where Customer is itself a processor, Apivom is a sub-processor and Customer confirms that it has authority to give these instructions.

1.2 "Applicable Data Protection Law" means the data-protection laws that apply to Customer's processing, which Customer selects in the order form or in the Service settings: Law No. 6698 (KVKK) and its regulations; Regulation (EU) 2016/679 (GDPR); the UK GDPR and Data Protection Act 2018; UAE Federal Decree-Law No. 45 of 2021; the California Consumer Privacy Act as amended and other US state privacy laws; and any other law named in the order form. Each law Customer selects adds its terms from the "Jurisdiction terms" below, which prevail over this Addendum for that law.

1.3 "Personal Data", "processing", "data subject" and "personal data breach" have the meaning given in Applicable Data Protection Law.

2. Scope and instructions

2.1 Apivom processes Personal Data only on Customer's documented instructions: this Addendum, the Agreement, the Schedules and the settings Customer's administrators choose in the Service. This includes instructions on transfers to a third country.

2.2 If Apivom believes an instruction infringes Applicable Data Protection Law, it tells Customer immediately and may suspend the instruction until it is confirmed or changed.

2.3 Apivom does not use Personal Data to train models, does not send it to a third-party AI or analytics service, and does not process it for its own purposes.

3. Confidentiality

Apivom ensures that persons authorised to process Personal Data are bound by confidentiality and limits access to staff who need it to operate and support the Service. This obligation continues after the Agreement ends.

4. Security

Apivom implements the measures in Schedule B and keeps them appropriate to the risk. Customer remains responsible for choosing Service settings that fit its own risk.

5. Sub-processors

5.1 Customer gives general written authorisation for the sub-processors listed at /subprocessors.

5.2 Apivom gives Customer at least 30 days' written notice of an intended addition or replacement, by e-mail to the privacy contact Customer has named and on the sub-processor page. Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection, Customer may terminate the affected part of the Service without penalty and receive a pro-rata refund.

5.3 Apivom imposes on each sub-processor the same data-protection obligations as in this Addendum and remains liable to Customer for their performance.

6. International transfers

6.1 Customer acknowledges that Apivom is established in the United Arab Emirates and that the Service is hosted in the Microsoft Azure West Europe region.

6.2 Where a law Customer has selected restricts transfers and no adequacy decision covers the transfer, the parties use the transfer instrument named in the matching Jurisdiction terms and sign it as an annex to this Addendum.

6.3 Apivom applies the same safeguards to onward transfers.

6.4 If a transfer instrument is invalidated or a required notification is not made, Apivom suspends the affected processing at Customer's request until it is remedied.

7. Data subject requests

7.1 Apivom forwards a request it receives directly from a data subject to Customer within 3 business days and does not answer it unless Customer instructs otherwise.

7.2 Apivom assists Customer, with appropriate technical and organisational measures, so that Customer can answer requests within the deadlines of Applicable Data Protection Law.

8. Personal data breach

8.1 Apivom notifies Customer's breach contact without undue delay and within 24 hours of becoming aware of a personal data breach affecting Customer's Personal Data, with the information it then has (nature, categories and approximate numbers, likely consequences, measures taken), and updates it as facts emerge.

8.2 Customer decides whether and how to notify authorities and data subjects. Apivom supports the investigation and the notifications.

9. Assistance

Apivom assists Customer, within the nature of the Service and the information available, with security, breach handling, data-protection impact assessments and prior consultation, and with Customer's records of processing and notice duties. Apivom provides an impact-assessment input sheet on request.

10. Audit

10.1 Apivom makes available the information needed to show compliance with this Addendum and allows audits, including inspections, by Customer or an auditor Customer mandates.

10.2 Customer first reviews Apivom's documentation and questionnaire answers. An on-site or remote audit follows on 30 days' notice, at most once in 12 months unless a breach or a regulator's request requires more, during business hours, under confidentiality and without access to other customers' data. Each party bears its own audit costs.

11. Retention, return and deletion

11.1 Retention follows Customer's settings inside the ceilings described in the Schedules. Apivom deletes expired data automatically.

11.2 When the Service ends, Customer may export its data for 30 days. Afterwards Apivom deletes it, and existing copies, within 30 days, except where law requires storage.

11.3 Backups exist only for disaster recovery under Apivom's backup policy (database backups are kept for up to five years) and are not restored into production for any other purpose. They are removed when they expire.

12. Liability, governing law, precedence

12.1 Liability and indemnity follow the Agreement.

12.2 Governing law and forum follow the Agreement, except that a transfer instrument annexed under section 6 follows its own terms.

12.3 If this Addendum conflicts with a transfer instrument, the instrument prevails for the transfer. Otherwise this Addendum prevails over the Agreement on data protection.

13. Changes

Apivom may update this Addendum for legal or operational reasons and gives Customer at least 30 days' notice of a material change. If Customer objects to a material change that reduces its protection, it may terminate the affected Service without penalty.

Jurisdiction terms

A. Türkiye, KVKK (Law No. 6698)

A1. Transfer instrument. Because Apivom and the hosting are outside Türkiye, the parties sign the Personal Data Protection Board's Standard Contract 2 (controller to processor) without change, completed from the Schedules.

A2. Notification. The signed standard contract is notified to the Personal Data Protection Authority within five business days after the last signature, by hand or through registered e-mail (KEP), or by another method the Board sets. Customer, as data exporter, notifies. Apivom delivers the signed copy, proof of its signatories' authority and notarised Turkish translations of its foreign-language documents within 3 business days of signing. A change of party details or annex content, or termination, is notified again by the same route.

A3. Onward transfers. When Apivom transfers data onward, it acts only within the purpose and scope Customer set and on Customer's instructions, keeps the security measures, and applies the same safeguards to the onward transfer.

A4. Confidentiality. Apivom does not disclose the data contrary to the Law or use it for other purposes; this continues after the engagement ends.

A5. Breach. Apivom notifies Customer within 24 hours. Customer notifies data subjects and the Board within the shortest time.

A6. Requests and erasure. Customer answers requests within the shortest time and at the latest within 30 days. Apivom erases, destroys or anonymises on Customer's instruction and when the Service ends.

A7. Customer's own duties. Customer publishes the notice required by Article 10 before the Service scans messages, records its lawful basis, and checks whether the Data Controllers' Registry (VERBİS) obligation applies to it.

B. European Union and United Kingdom, GDPR and UK GDPR

B1. Article 28. Sections 2 to 11 are the terms required by Article 28(3) GDPR, including documented instructions with regard to transfers, confidentiality, Article 32 measures, the sub-processor conditions of Article 28(2) and (4), assistance with data-subject requests and Articles 32 to 36, deletion or return, and audit support. Apivom remains fully liable to Customer for its sub-processors.

B2. EU transfers. The parties incorporate the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), with: the docking clause included; general authorisation for sub-processors with a 30-day notice period; no independent dispute resolution body; and the supervisory authority, governing law and courts of the Member State stated in the order form (if none is stated, the Member State of Customer's establishment). Annex I is Schedule A, Annex II is Schedule B, Annex III is the sub-processor page.

B3. UK transfers. For UK GDPR processing, the UK International Data Transfer Addendum to the Standard Contractual Clauses applies with the same annex content.

B4. Breach. Apivom's 24-hour notice lets Customer meet the 72-hour deadline of Article 33.

B5. Requests. Customer answers data-subject requests within one month.

B6. Impact assessment. Scanning message content at scale is likely to need a data-protection impact assessment (Article 35); the assessment is Customer's and Apivom assists.

C. United Arab Emirates, PDPL (Federal Decree-Law No. 45 of 2021)

Apivom is licensed in a Dubai Development Authority free zone. Where Customer's own processing is subject to the PDPL, Apivom accepts the processor terms below by contract, whether or not the PDPL applies to Apivom directly.

C1. Processing under contract. This Addendum and the Schedules state the scope, subject, purpose, nature and type of data and the categories of data subjects.

C2. Period and erasure. Processing runs for the period in the Schedules and Customer's retention settings. If it would exceed that period, Apivom tells Customer so that Customer can authorise an extension or give instructions. Apivom erases data when the period ends or on handing it over.

C3. Confidentiality and security. Apivom does not disclose data or results of processing except where the law authorises it, and applies the Schedule B measures, including encryption of stored excerpts and design that avoids storing raw values.

C4. Record of processing. Apivom keeps a record of the processing it carries out for Customer and provides it to Customer on request, and to the UAE Data Office where the law requires.

C5. Proof of compliance. Apivom provides the means to prove compliance when Customer asks, and when the UAE Data Office asks where the law requires.

C6. Sub-processors. Where more than one processor is involved, roles and responsibilities are fixed in a written contract (section 5).

C7. Breach. Apivom notifies Customer as soon as it becomes aware (section 8: within 24 hours). Customer notifies the UAE Data Office and data subjects within the period the Executive Regulations set.

C8. Processing outside the State. Customer instructs Apivom to host in Microsoft Azure West Europe. The recipient and location are identified in Schedule C, and sub-processors are bound to the same obligations.

C9. Requests. Customer answers data-subject requests; Apivom assists under section 7. Each party decides for itself whether it must appoint a data protection officer.

D. United States, California CCPA/CPRA and other state laws

D1. Service provider. Apivom processes personal information on Customer's behalf only for the business purposes in the Schedules (performing the Service, security and integrity) and is Customer's service provider.

D2. Restrictions. Apivom shall not: sell or share the personal information; retain, use or disclose it for any purpose other than the business purposes specified in the Agreement, including any commercial purpose, or as the CCPA otherwise permits; retain, use or disclose it outside the direct business relationship between Apivom and Customer; or combine it with personal information it receives from or on behalf of another person or collects from its own interaction with the consumer, except as the CCPA and its regulations permit for a business purpose.

D3. Monitoring. Customer may monitor Apivom's compliance through reviews, scans, assessments, audits or testing at least once every 12 months (section 10 applies).

D4. Sub-processors. Apivom notifies Customer of each engagement of another person to assist in processing and binds that person by written contract to the restrictions in D2.

D5. Compliance. Apivom complies with the CCPA as it applies to service providers and tells Customer promptly if it can no longer meet its obligations.

D6. Requests and deletion. Apivom forwards consumer requests to Customer within 3 business days, assists under section 7, and deletes on Customer's instruction and when the Service ends (section 11).

D7. Other states. The terms above are written to meet the processor-contract requirements common to US state privacy laws. For a state with requirements beyond these, the parties add a schedule.

Schedules

Schedule A. Description of the processing

Service: Virtus (WhatsApp message data-protection scanning)

• Controller: Customer. Processor: Apivom Technology FZ-LLC.
• Purpose: detecting personal identifiers (for example national ID numbers, IBANs, card numbers, phone numbers, e-mail addresses) in messages on Customer's WhatsApp Business lines, so that Customer's authorised staff can review and handle them.
• Data subjects: Customer's contacts and customers who message its lines; Customer's staff who use the lines.
• Personal data: message text (read for scanning, not copied); findings: identifier type, confidence, message reference, line, direction, timestamps and the regime versions applied; optional masked context excerpt (off by default); audit events of who viewed or changed what.
• Special categories: not targeted. Detection is limited to the identifier types of the regimes Customer selects.
• Frequency and duration: continuous scanning for the term of the Agreement plus the return period in section 11.2.
• Retention: Customer sets the retention of findings and of excerpts inside ceilings that depend on the regimes and the risk tier it selects. Defaults: findings 365 days; excerpts off, and when on, 30 days or less. In the Elevated risk tier, findings are limited to 180 days and excerpts to 14 days. The ceilings are Apivom product policy, and Customer may lower them at any time.
• Operations: reading from Customer's workspace message store, pattern and checksum recognition, storing findings, optionally encrypting and storing excerpts, showing results to Customer's authorised users, and deleting on expiry.
• Hosting: Microsoft Azure, West Europe.

Customer-specific details (customer name, privacy and breach contacts, selected laws) are completed in the order form.

Schedule B. Security measures

• Data minimisation: the scan reads only the message identifier, conversation identifier, direction, provider message identifier, text and timestamps. It cannot read media or interactive payloads and cannot write to the messaging system. Findings never contain the raw detected value or the full message.
• Context excerpts: a masked window around a finding, encrypted with AES-256-GCM, with the key held outside the database in a file readable only by the service account. Only Customer's workspace administrators can view it, every view is recorded in the audit log, and switching the feature off deletes all stored excerpts in the same transaction.
• Access control: sign-in through Apivom Key (OpenID Connect); access requires the application's access role and administrative actions require the administrator role; each customer's data is held in a separate database.
• Least privilege: the Service's database role has column-level read access to the message and conversation tables, no write access to them, append-only audit records, and delete rights only on findings and excerpts.
• Audit: settings changes, excerpt views, document exports and purges are recorded with actor and time.
• Logging: worker logs contain counts and identifiers, not message text or detected values.
• No external processing: the scan path uses no third-party AI or external API.
• Transport, hosting and edge: TLS to the Service; hosting in Microsoft Azure West Europe behind Azure Front Door with a web application firewall; database backups through Azure Backup with geo-redundant storage.
• Retention: expired findings and excerpts are hard-deleted automatically, including while scanning is switched off.
• Engineering: two-factor authentication for engineers with source-code access, signed and reviewed changes, and automated dependency and container vulnerability scanning.

Schedule C. Sub-processors

The current list is published at /subprocessors.