Between: Emmanuel Edge AI FZE (“Processor”)

And: The Customer (“Controller”)

Effective Date: April 29, 2026

1. Definitions and Interpretation

1.1 UAE PDPL: Refers to Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data in the United Arab Emirates and its Executive Regulations.

1.2 Data Office: The UAE Data Office established under Federal Decree-Law No. 44 of 2021.

1.3 Personal Data: Any data relating to an identified or identifiable natural person (Data Subject), processed by Emmanuel Edge on behalf of the Customer.

1.4 Sub-Processor: Any third-party service provider (including cloud infrastructure and AI platform providers) engaged by Emmanuel Edge to process Personal Data.

2. Scope and Role of Parties

2.1 Roles: The Customer is the Controller and Emmanuel Edge is the Processor.

2.2 Instructions: Emmanuel Edge shall process Personal Data only on the documented written instructions of the Customer, including transfers of personal data to a third country, unless required to do so by UAE law.

2.3 Duration: These terms apply for the duration of the Service Agreement and until all Personal Data is deleted or returned to the Customer.

3. Data Protection Obligations

3.1 Security: Emmanuel Edge shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption and anonymization where applicable, as mandated by Article 13 of the UAE PDPL.

3.2 Confidentiality: Emmanuel Edge ensures that all personnel authorized to process Personal Data have committed themselves to confidentiality.

3.3 Assistance: Emmanuel Edge shall assist the Customer (at the Customer’s cost) in responding to requests from Data Subjects exercising their rights (Access, Rectification, Erasure, and Limitation of Processing).

4. Sub-Processing & Trade Secret Protection

4.1 Authorized Sub-Processors: The Customer provides general authorization for Emmanuel Edge to engage sub-processors for cloud hosting, AI infrastructure, and database management.

4.2 Confidentiality of Stack: Consistent with the Service Agreement, the specific identity of sub-processors remains a trade secret of Emmanuel Edge. However, Emmanuel Edge warrants that all sub-processors are bound by data protection obligations no less onerous than those in this Agreement.

4.3 Notification: Emmanuel Edge shall inform the Customer of any intended changes concerning the addition or replacement of sub-processors via electronic notice, giving the Customer the opportunity to object.

5. Cross-Border Data Transfers

5.1 International Transfers: Personal Data may be transferred and processed outside the UAE. Emmanuel Edge shall ensure such transfers comply with Article 22 and 23 of the UAE PDPL, ensuring the destination country provides an "adequate level of protection" or that appropriate safeguards (such as standard contractual clauses) are in place.

6. Personal Data Breach Notification

6.1 Notification to Customer: Emmanuel Edge shall notify the Customer without undue delay (and in any event within 48 hours) after becoming aware of a Personal Data breach.

6.2 Cooperation: The notice shall describe the nature of the breach, the categories of data affected, and the measures taken to mitigate the impact.

7. Return and Deletion of Data

7.1 Termination: Upon termination of the Service, Emmanuel Edge shall, at the choice of the Customer, delete or return all Personal Data, unless UAE Federal Law or Ajman Free Zone regulations require storage of the Personal Data.

8. Liability and Indemnity

8.1 Indemnity: The Customer shall indemnify Emmanuel Edge against all costs, claims, and damages arising from the Customer’s instructions that violate the UAE PDPL or other applicable privacy laws.

8.2 Limitation: Emmanuel Edge’s liability under these Data Processing Terms shall be subject to the financial cap set forth in Section 6.1 of the General Terms and Conditions.

9. Law and Jurisdiction

9.1 Governing Law: These terms are governed by the laws of the United Arab Emirates.

9.2 Dispute Resolution: Any disputes arising from data processing shall be resolved via the DIAC Arbitration and DIFC Courts procedure outlined in the Service Agreement.