Data Processing Agreement

Code Chain Creations – FZCO Version 2.7 · Effective date: 11 November 2026 · Last updated: 11 November 2026

This DPA forms part of the Code Chain Creations Terms of Service (the "Terms") between the Customer ("Controller") and Code Chain Creations – FZCO ("CCC", "Processor"). Capitalised terms not defined here have the meaning given in the Terms.

Details on request. The Portal is under active development, and CCC changes functions, AI models and service providers often. CCC gives the Customer the current names of its sub-processors, their countries, the periods for keeping data and its security measures free of charge on request through the Contact form, within 3 working days.

1. Scope and roles

1.1 This DPA applies to personal data that CCC processes for the Customer through the Portal ("Customer Personal Data").

1.2 The Customer is the controller and CCC is the processor of Customer Personal Data, within the meaning of Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL") and any other data protection law that applies (together, "Data Protection Law").

1.3 CCC is a separate controller only for data about the Customer's account, Users, billing and communications with CCC. That data is covered by CCC's privacy policy, not by this DPA.

2. Details of processing

3. Processing on instructions

3.1 CCC processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's use and configuration of the Portal are the Customer's instructions.

3.2 CCC informs the Customer if, in its opinion, an instruction breaches Data Protection Law. CCC may then decline to follow it.

3.3 Except for the review in clause 3.4, CCC does not use Customer Personal Data for its own purposes. It does not sell it and does not itself train AI models on it. Before a function sends Customer Personal Data to a sub-processor that may use it to train its models, CCC obtains the separate consent of the data subject or the Customer's instruction.

3.4 Review and analysis. The Customer instructs CCC to make Users' conversations with the AI agents available to the Customer's management when it asks, and allows CCC's authorised staff, when needed, to access and analyse Customer Personal Data, also with CCC's internal AI tools, to provide and support the Portal, solve problems and improve the quality of the work and of the interaction with the agents for the Customer. These tools may use CCC's sub-processors. Findings are used for other customers only in anonymised form; for that anonymised use CCC acts on its own responsibility. Each User's acceptance of the Portal Access Agreement is recorded in the Portal; without it, or after its withdrawal, the User's chat with the agents is unavailable and CCC stops this review of that User's conversations. The Customer is responsible for the lawfulness of its management's access, for telling Users about it, and for having a basis for other people's data that Users enter.

3.5 Documents and secrets. The Customer decides which personal and business context to provide for its purpose. CCC's agents do not ask Users to send identity documents or their numbers, payment card or bank account details, passwords, PINs or one-time codes.

4. Confidentiality

CCC ensures that every person it authorises to process Customer Personal Data is bound by confidentiality and has access only as needed for their tasks.

5. Security

CCC implements appropriate technical and organisational measures to protect Customer Personal Data, such as those in Annex 1. CCC may update the measures, provided the overall level of protection does not decrease.

6. Sub-processors

6.1 General authorisation. The Customer authorises CCC to use sub-processors in the sectors listed in Annex 2 and to add, replace or remove them at its discretion.

6.2 Current list. CCC keeps a current list of its sub-processors and gives it to the Customer on request within 3 working days.

6.3 Objection. If the Customer objects to a sub-processor on reasonable data protection grounds, the parties discuss the objection in good faith. If they cannot resolve it, the Customer may stop using the affected services and close its workspace, with a refund of any unused prepaid period. This is the Customer's sole remedy for the objection.

6.4 Written terms. CCC uses each sub-processor under written terms that set out their respective obligations and roles, as far as relevant to its service.

7. Transfers outside the UAE

7.1 The Customer acknowledges that Customer Personal Data may be stored and processed outside the UAE, including in Singapore, the United States, the European Union and other countries of CCC's sub-processors.

7.2 CCC transfers Customer Personal Data outside the UAE only:

• (a) to a country with an adequate level of protection approved under Article 22 PDPL; or
• (b) under a contract with the recipient that requires it to apply the protections and controls of the PDPL, as described in Article 23(1)(a) PDPL; or
• (c) with the explicit consent of the data subject under Article 23(1)(b) PDPL. For Customer Personal Data about the Customer's employees, candidates or contacts, the Customer, as controller, is responsible for obtaining that consent or another basis; or
• (d) on another basis permitted by Article 23 PDPL or by the Executive Regulation, once issued.

7.3 CCC will adapt the transfer arrangements to the PDPL Executive Regulation and any decisions of the UAE Data Office when they are issued.

8. Assistance to the Customer

8.1 Data subject rights. CCC assists the Customer, through the Portal's functions or otherwise as reasonably required, to respond to requests from data subjects to exercise their rights under Data Protection Law. These include requests for access, correction, erasure, restriction, objection and data portability. CCC forwards to the Customer any such request it receives directly and does not answer it itself, unless the Customer instructs otherwise.

8.2 Human review (Article 18 PDPL). The Portal does not make automated decisions; decisions are made by the Customer's Users (Terms, clause 3.2). CCC provides the logs and explanations of Output that the Portal stores, so that the Customer can carry out human review when a data subject asks for it.

8.3 Impact assessments. CCC provides reasonable information and assistance for the Customer's data protection impact assessments and any prior consultation with a regulator, in relation to the Portal.

9. Personal data breaches

9.1 CCC notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.

9.2 The notice describes, as far as known:

• the nature of the breach and the categories and approximate number of data subjects and records;
• its likely consequences;
• the measures taken or proposed;
• a contact person.

CCC provides further information as it becomes available.

9.3 CCC takes reasonable steps to contain and remedy the breach. The Customer, as controller, decides on notification to the UAE Data Office and to data subjects. CCC does not notify them on the Customer's behalf unless the Customer instructs it to or the law requires it.

10. Audit

10.1 CCC makes available to the Customer the information reasonably necessary to demonstrate compliance with this DPA. This includes descriptions of its security measures and any certifications or audit reports it holds.

10.2 CCC provides this information on request within 3 working days. Any further review is agreed between the parties in writing, at the Customer's cost.

11. Return and deletion

11.1 When the workspace is closed, the Customer may ask for an export of Customer Personal Data for a reasonable period.

11.2 After that, or earlier if the Customer asks, CCC deletes Customer Personal Data from its systems, unless the law requires CCC to keep it or CCC needs it to establish or defend a legal claim. Backups are overwritten in the normal cycle of CCC's providers. On request, CCC confirms deletion in writing. Deletion cannot be undone, and CCC does not carry it out while it knows of a dispute, claim or request from an authority concerning this data.

12. Liability and order of precedence

12.1 The limitations of liability in the Terms apply to this DPA.

12.2 If this DPA conflicts with the Terms regarding personal data, this DPA prevails.

12.3 Clause 16.1 of the Terms (language) applies to this DPA.

Annex 1. Technical and organisational measures

CCC applies measures appropriate to the data and the service, and changes them as the Portal develops, for example:

1. Encrypted connections.
2. Separation of each customer's workspace data.
3. Access for Users by role, and for CCC staff only where needed.
4. Handling of security incidents under section 9.

The current measures are available on request.

Annex 2. Sub-processors

Sectors, in the UAE and abroad:

• providers of AI models, speech recognition and similar AI services;
• hosting, database, authentication and file storage;
• e-mail delivery, notifications and messaging;
• other technical services that a function of the Portal needs.

The current names and countries are available on request (section 6.2).

Annex 3. Template notice to candidates and employees (issued by the Customer)

For use by the Customer in its own name. The Customer adapts it to its processing.

How we use AI in [recruitment / HR]

[Company name] uses a software tool provided by Code Chain Creations – FZCO to help manage [applications / HR records]. The tool uses artificial intelligence (AI) to [summarise and sort applications / prepare drafts and reminders].

• A person decides. AI only makes suggestions. Every decision about your [application / employment] is made by a member of our team.
• What data. We process the information you give us [your CV and application / your employment records] to [assess your application / manage your employment].
• Where. Your data may be stored and processed by service providers, including AI providers, outside [country], including in Singapore, the United States and other countries.
• Your conversations with the AI agent. When needed, our management and the provider of the tool may review your conversations with the AI agent to improve the quality of work and of the interaction with the agent. You will be asked to accept this when you first enter.
• Your rights. You may ask us for access to your data, to correct or delete it, and to have any assessment reviewed by a person. Contact: [e-mail].
• Retention. We keep [application] data for [number] months, unless you agree to a longer period.