1. Parties and roles
The customer is the data controller of its workspace data; SaudiConnect is its processor under the Personal Data Protection Law of the Kingdom of Saudi Arabia (PDPL).
2. Subject matter
Hosting and processing of workspace data — vehicles, drivers, trips, telematics, and video where enabled — to provide the fleet-management service.
3. Instructions
We process personal data only on the customer's documented instructions. The subscription configuration (plan, retention settings, enabled modules) constitutes those instructions.
4. Confidentiality
Personnel with access to personal data are bound by confidentiality obligations.
5. Security measures
Workspace isolation, encryption in transit, role-based access control, audit logging, and multi-factor authentication for administrative access — as described in the Terms of Service.
6. Sub-processors
The customer grants general authorisation for the sub-processors needed to run the service (in-Kingdom hosting, email delivery, SMS/connectivity). We maintain a list and give prior notice of changes.
7. Data-subject requests
Requests from drivers or other data subjects are forwarded to the customer as controller; we assist taking into account the nature of the processing.
8. Breach notification
We notify the customer without undue delay after becoming aware of a personal data breach affecting its workspace.
9. Data residency
Processing takes place within the Kingdom of Saudi Arabia unless otherwise agreed in writing.
10. Deletion and return
On termination the customer may export its data as described in the Terms of Service (§8); we then delete it, subject to statutory retention of tax and financial records.
11. Audits
Annual audits on reasonable notice, at the customer's cost, subject to confidentiality.
12. Liability and governing law
Liability follows the Terms of Service (§12). This agreement is governed by the laws of the Kingdom of Saudi Arabia.
Related documents