Data Processing Agreement

This Data Processing Agreement ("DPA"), also referred to as the B2B Data Protection Addendum, is entered into between ApeX by Wrap_OS ("Processor", "ApeX", "we", or "us") and the subscribing business entity ("Controller" or "Customer", "you").

This DPA forms an integral part of the ApeX Terms of Service and is effective from the Effective Date stated above. In the event of any conflict between this DPA and the Terms of Service on matters of data protection, this DPA shall prevail.

This DPA is aligned with the requirements of UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL") and any implementing regulations issued thereunder.

Roles: The Customer acts as the Data Controller and ApeX acts as the Data Processor. The Customer determines the purposes and means of processing Personal Data, while ApeX processes Personal Data solely on behalf of the Customer in accordance with this DPA.

Scope of Processing: ApeX processes Personal Data for the purpose of storing, organizing, and retrieving business records, financial transactions, and employee, customer, and vendor data within the ApeX platform.

Nature of Processing: Cloud-based accounting, invoicing, inventory, point of sale (POS), human resources, payroll, taxation, and reporting operations performed within the ApeX platform.

Duration of Processing: For the duration of the Customer's subscription term, plus a 7-year retention period where required for financial record-keeping under applicable UAE law.

Data Types Processed: Account data, business data, financial data, employee data, contact data, payment data, and usage data submitted or generated through the Customer's use of the ApeX platform.

ApeX processes Personal Data only on the Customer's documented instructions, including with regard to transfers of Personal Data to a third country or international organization, unless required to do so by applicable law.

The Customer warrants that it has complied and will continue to comply with all applicable data protection laws, including the PDPL, and that it has obtained all necessary consents and provided all necessary notices required to authorize ApeX's processing of Personal Data on the Customer's behalf.

ApeX shall inform the Customer in writing if, in ApeX's reasonable opinion, an instruction infringes applicable data protection laws. ApeX shall not be obligated to carry out the instruction until the Customer has confirmed or modified it.

ApeX ensures that all personnel authorized to process Personal Data are bound by enforceable confidentiality obligations, including obligations that survive the termination of their engagement.

ApeX applies a least-privilege role-based access control (RBAC) model, ensuring personnel access only the Personal Data necessary for the performance of their duties.

All authorized personnel receive regular data protection and information security training appropriate to their role and responsibilities.

ApeX implements and maintains appropriate technical and organizational security measures designed to protect Personal Data against unauthorized or unlawful processing, accidental loss, destruction, or damage. These measures include:

• Transport Layer Security (TLS) version 1.2 or higher for all data in transit, and AES-256 encryption for all data at rest.

• Row-level database security and company-scoped data isolation, ensuring that each Customer's data is logically separated from other Customers' data.

• Multi-factor authentication (MFA) for administrative access and secure password hashing for all user accounts.

• Rate limiting on public-facing endpoints to mitigate abuse and automated attacks.

• Comprehensive audit logging of access to and processing of Personal Data.

• Constant-time verification of webhook signatures to prevent timing-based attacks.

• File validation and a maximum upload size of 25MB for all user-uploaded files.

• Error message sanitization to ensure no sensitive data is disclosed through error responses.

• Regular security assessments, vulnerability scanning, and penetration testing conducted by qualified personnel.

The Customer provides general authorization for ApeX to engage sub-processors to assist in providing the ApeX platform and services. A current list of sub-processors is maintained and available upon request.

ApeX enters into written agreements with all sub-processors imposing data protection obligations that are no less protective than those set out in this DPA.

ApeX remains fully liable for the performance of each sub-processor and for the compliance of each sub-processor with the obligations set out in this DPA.

ApeX shall notify the Customer in advance of any intended addition or replacement of a sub-processor, giving the Customer the opportunity to object to such changes in accordance with the procedures set out in the Terms of Service.

ApeX shall assist the Customer in fulfilling its obligations to respond to requests from data subjects exercising their rights under the PDPL, including the rights of access, rectification, erasure, data portability, and objection.

The ApeX platform provides built-in tools that enable the Customer to export, correct, and delete Personal Data processed through the platform.

Where ApeX receives a request directly from a data subject relating to the Customer's Personal Data, ApeX shall promptly forward the request to the Customer and shall not respond to the request directly except as required by law.

In the event of a Personal Data Breach, ApeX shall notify the Customer without undue delay and in any case within 24 hours of becoming aware of the breach.

The notification shall include, to the extent available: the nature of the breach, the categories and approximate number of data subjects and Personal Data records concerned, the likely consequences of the breach, and the measures taken or proposed to address the breach and mitigate its possible adverse effects.

ApeX maintains automated breach detection and alert systems that notify administrators of potential security incidents in real time.

The Customer acknowledges that under PDPL Article 38, the Controller is responsible for notifying the UAE Data Office of a Personal Data Breach within 72 hours of becoming aware of it. ApeX's notification to the Customer under this DPA is intended to support the Customer in meeting this obligation. The Customer remains solely responsible for notifying the UAE Data Office and affected data subjects where required by law.

Personal Data may be transferred to and processed in countries outside the UAE, including the United States and European Union, for the purpose of providing and maintaining the ApeX platform.

Where Personal Data is transferred to a third country, ApeX ensures that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and data processing agreements with sub-processors that provide a level of protection comparable to that required under the PDPL.

UAE-only data residency options are available upon request. Customers with specific data localization requirements may contact ApeX to configure their account accordingly.

Upon termination of the Customer's subscription, ApeX shall, at the Customer's choice, delete or return all Personal Data processed on behalf of the Customer, subject to the retention requirements set out below.

ApeX shall retain financial records for a period of 7 years following termination, as required by UAE Federal Law and Federal Tax Authority (FTA) regulations. After the expiry of this retention period, ApeX shall securely delete the retained Personal Data.

Data export functionality is available to the Customer throughout the duration of the subscription, enabling the Customer to retrieve its data at any time.

The Customer may, at its own expense, conduct an audit of ApeX's compliance with this DPA, provided that the Customer gives ApeX at least 30 days' prior written notice of such audit.

ApeX shall provide reasonable cooperation and documentation to enable the Customer to conduct the audit, subject to applicable confidentiality obligations and security requirements.

Under no circumstances shall the Customer be granted access to, or information about, the data of any other ApeX customer.

The liability of each party under this DPA is subject to the limitations and exclusions of liability set out in the ApeX Terms of Service.

ApeX shall indemnify and hold harmless the Customer from and against any losses, damages, fines, or penalties arising from ApeX's breach of its obligations under this DPA.

The Customer shall indemnify and hold harmless ApeX from and against any losses, damages, fines, or penalties arising from the Customer's breach of its obligations under this DPA, including but not limited to the Customer's failure to comply with applicable data protection laws.

This DPA is governed by and construed in accordance with the laws of the United Arab Emirates, including the PDPL and any implementing regulations.

ApeX shall provide the Customer with at least 30 days' prior written notice of any material changes to this DPA. The Customer's continued use of the ApeX platform after the effective date of any such changes constitutes acceptance of the amended DPA.

In the event of any conflict between this DPA and the ApeX Terms of Service on matters of data protection and Personal Data processing, this DPA shall prevail.