This contract is made between the two parties as detailed in the attached contracting form, referred to herein as “First Party” (Data Controller / Client) and “Second Party” (Data Processor / Service Provider), collectively referred to as “the Parties”. In accordance with the provisions of the Personal Data Protection Law No. 151 of 2020 and its executive regulations, the Egyptian Civil Law No. 131 of 1948, the Commercial Law No. 17 of 1999, the Cybercrime Law No. 175 of 2018, and the applicable laws and regulations in the Arab Republic of Egypt, this agreement aims to regulate the relationship of personal data processing between the First Party (Data Controller / Client) and the Second Party (Data Processor / Service Provider), whereby the Data Processor processes personal data on behalf of the Data Controller in accordance with specified instructions, while ensuring compliance with the provisions of the Personal Data Protection Law No. 151 of 2020 and its executive regulations, specifying the nature of the processing, its purpose, the duration of processing, the rights of data subjects, security obligations, compensation terms and penalties, and mechanisms for reporting data breaches, all within a framework of transparency and commitment to the highest standards of personal data protection and the governing laws in the Arab Republic of Egypt. The Parties have agreed on the following:

Article (1) Definitions of the Agreement
1- The words and phrases below, wherever they appear in this agreement, shall have the meanings indicated next to each, unless the context requires a different meaning:
2- The Agreement: refers to this Data Processing Agreement in all its terms and appendices, with its preamble considered an integral part thereof.
3- Data Protection Law: refers to the Personal Data Protection Law No. 151 of 2020 and its executive regulations, along with any amendments or supplements thereto.
4- Data Controller: the First Party in this agreement, being the natural or legal person who determines the purposes and means of processing personal data, and is responsible for compliance with the provisions of the Data Protection Law.
5- Data Processor: the Second Party in this agreement, being the natural or legal person who processes personal data on behalf of the Data Controller, in accordance with its instructions, and does not have the authority to determine the purposes or means of processing.
6- Personal Data: any information, regardless of its source or form, relating to an identified or identifiable natural person, including name, identification number, address, phone number, email, financial data, health data, biometric data, geographical location, device identifiers, and any other data that identifies the individual.
7- Sensitive Data: personal data related to health, medical condition, genetic data, biometric data, data related to religious or political beliefs, criminal data, and any other data considered sensitive by the executive regulations.
8- Processing: any operation or set of operations performed on personal data by any means, including collection, recording, organizing, storing, modifying, retrieving, using, transferring, publishing, sharing, anonymizing, restricting, deleting, or destroying it.
9- Consent: an explicit, freely given, specific, and informed statement of the will by the data subject expressing consent to the processing of their personal data.
10- Data Subject: the natural person to whom the personal data relates.
11- Data Breach: any security violation that results in the accidental or unlawful destruction, loss, alteration, disclosure of, or unauthorized access to personal data.
12- Sub-processor: any other data processor who processes personal data on behalf of the main Data Processor, based on instructions from the Data Controller.
13- Data Transfer across Borders: the transfer of personal data outside the Arab Republic of Egypt.
14- Processing Period: the duration during which personal data is processed, as specified in Article (3) of this agreement.
15- Related Parties: includes affiliates, parent companies, sister companies, as well as directors, employees, contractors, consultants, agents, and representatives.

Article (2) Subject of the Agreement and Scope of Processing
1- First: Subject of Processing:
2- The Data Processor shall process personal data on behalf of the Data Controller, for the following purpose:
3-  
4- Second: Description of Processing:
5- Types of Personal Data:  
6- Categories of Data Subjects:  
7- Nature of Processing:  
8- Purpose of Processing:  
9- Processing Period:  
10- Third: Processing Instructions:
11- The Data Processor shall process personal data solely in accordance with the written instructions issued by the Data Controller and shall not process the data for any other purpose without prior written consent from the Data Controller.
12- Instructions shall include: the type of processing, its purpose, the data retention period, security measures, data transfer mechanisms, and any other instructions specified by the Data Controller.