1.1. This Data Processing Agreement (DPA) is the Data Processing Agreement referred to in the E-Service Agreement entered into between Hayya (Data Processor) and the Partner (Data Controller) as available at https://hayya.ae/saas (Agreement). In the event of a contradiction between this DPA and the provisions of Agreement, this DPA shall prevail.
1.2. This DPA is deemed to be concluded by using opt-in check-box or by entering into Agreement, including by electronic means (scan, email, etc.).
2. DEFINITIONS AND INTERPRETATION
2.1. In this DPA:
“Personal Data” means any personal data that is received from one party and processed by the other party under the Agreement in connection with provision or use (as applicable) of the E-Service to Partner.
“Data Protection Legislation” means, as applicable: (a) the GDPR; and/or (b) the UAE Federal Decree-Law 45/2021; and/or (c) any other applicable law, statute regulation, directive or legislative act of another form, applicable to the processing of Personal Data.
“GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02016R0679-20160504).
Other capitalized terms when used herein shall have the same meaning as is given such terms in the Agreement.
2.2. The terms “controller” or “data controller”, “data subject”, “personal data”, “processing” and “processor” or “data processor” as used in this DPA have the meanings given in Data Protection Legislation.
2.3. Any reference to a legal framework, statute or other legislative enactment is a reference to it as amended or re-enacted from time to time.
3. PROCESSING OF PERSONAL DATA
3.1. Partner hereby instructs Hayya to collect and Personal Data and process Personal Data provided by the Partner and listed in this section for the purposes of providing the E-Service and fulfilling the obligations under the Agreement.
3.2. Personal Data of Drivers:
3.2.1. full name, social security number, national ID details, date of birth, place of birth, gender, citizenship, photo, mobile number, official residential address, chats, calls, location data, status data (‘available’, ‘waiting’, ‘driving’ and other signal as available in the Service), license plate number vehicle registration certificate;
3.2.2. driving license details: forename and surname, date and place of birth, expiry date, official body that has issued the license, license number, place where the license has been issued, car category or categories to which the license extend;
3.2.3. scanned copies of the documents containing the data listed in this section 3.2;
3.2.4. other Personal Data indicated in the Agreement.
3.3. Parties’ representatives: full name, signature, e-mail, phone number, contact details, address, position.
3.4. Regarding processing of Personal Data of Drivers listed in this section 3 Hayya acts as Data Processor on behalf of the Partner.
3.5. Partner acting as data controller shall ensure legal basis for processing of Drivers’ Personal Data by the Partner and, where applicable, by Hayya, and, at the Hayya’s request, shall provide supporting evidence thereof.
3.6. Partner shall ensure legal basis for collection of Personal Data by Hayya on behalf of the Partner, and, at the Hayya’s request, shall provide supporting evidence thereof.
3.7. Where required by applicable law, the Partner shall obtain drivers’ consents to collect and process Personal Data by Hayya and transfer Personal Data to Hayya, and, at Hayya’s request, shall provide supporting evidence thereof. Partner shall promptly notify the Hayya if it becomes aware that any such consent is withdrawn.
3.8. Partner shall implement and maintain a privacy notice compatible with the requirements of Data Protection Legislation, governing processing of Drivers’ personal data. Partner shall duly inform the Drivers that their data will be transferred to Hayya.
4. DURATION OF PROCESSING
4.1. Hayya shall process Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing.
4.2. Personal Data shall be deleted upon the sooner of (i) request of the Partner; or (ii) when Personal Data is no longer needed to perform the Agreement.
5. SUB-PROCESSORS
5.1. Partner acknowledges and agrees that:
5.1.1. Hayya’s Affiliates may be retained as sub-processors;
5.1.2. Hayya may engage third-party Sub-processors, including Operational Partner in connection with the provision of the E-Service.
5.2. Hayya verifies that its appointed Sub-Processors have provided sufficient guarantees to Hayya to implement appropriate technical and organizational measures in such a manner that the processing of Personal Data meets the requirements of the Data Protection Legislation. Hayya undertakes that all the Sub-Processors are subject to a written agreement with Hayya which imposes data protection obligations on the Sub-Processors that are no less onerous than those imposed on the Hayya under this DPA.
5.3. Hayya is not bound by any recommendations of the Partner in respect to choice of sub-processors and can follow or not follow such recommendations at its own discretion. Hayya can change Sub-processors from time to time and engage new sub processors without any prior approval.
6. DATA SUBJECT RIGHTS
6.1. Partner’s obligations:
6.1.1 The Partner shall promptly notify Hayya of any request it has received from a data subject, including access, rectification or erasure requests.
6.1.2. The Partner shall to respond to data subjects’ requests for the exercise of their rights as provided by Data Protection Legislation.
6.2. Hayya’s obligations:
6.2.1 Hayya shall promptly notify the Partner of any request it has received from a data subject, provided that such request refers to Personal Data processing under this DPA.
6.2.2. Hayya shall assist the Partner in fulfilling its obligations to respond to data subjects’ requests for the exercise of their rights under Data Protection Legislation. In fulfilling its obligations under this section, Hayya shall comply with the instructions from the Partner.
6.3. Redress. In case of a dispute between a data subject and one of the Parties as regards compliance with the present DPA or the Agreement, that Party shall use its best efforts to resolve the issue amicably in a timely fashion. The Parties shall keep each other informed about such disputes and, where appropriate, cooperate in resolving them.
6.4. Where the data subject invokes a third-party beneficiary right, the data processor shall accept the decision of the data subject to: lodge a complaint with the supervisory authority of his/her habitual residence or place of work; refer the dispute to the competent courts.
6.5. The Parties accept that the data subject may be represented by a not-for-profit body, organization or association under the conditions set out in Data Protection Legislation. The data processor shall abide by a decision that is binding under the applicable Data Protection Legislation. The data processor agrees that the choice made by the data subject will not prejudice his/her substantive and procedural rights to seek remedies in accordance with applicable laws.
7. REPRESENTATIONS AND WARRANTIES
7.1. Partner represents and warrants, and, at Hayya’s request, will provide supporting evidence, to demonstrate that:
7.1.1. Partner collects, obtains and processes Personal Data, provided by Partner to Hayya under this DPA, lawfully, without violating any third parties’ rights, contractual obligations or Data Protection Legislation;
7.1.2. Partner’s data processing activities are compliant with Data Protection Legislation, applicable e-commerce legislation, advertising legislation or consumer protection legislation.
7.1.3 Partner has all rights, consents, authorization and title to grant the rights and permissions to collect such Personal Data by Hayya according to the Agreement and the terms of this DPA;
7.1.4. where required by applicable Data Protection Legislation, Partner has obtained the consents of data subjects (including Drivers and Couriers) to collect, process and share such Personal Data and transfer (including cross-border transfer) such Personal Data to Hayya;
7.1.5. Partner has implemented and will maintain a privacy policy compatible with the requirements of Data Protection Legislation, governing processing of such Personal Data;
7.1.6 processing of such Personal Data by Hayya will not violate the Data Subject’s rights and rights of the other third parties, including without limitation privacy, data protection, good-will, good name, publicity, confidentiality and intellectual property rights.
7.2. Where applicable, Partner has obtained all mandatory licenses, authorizations and approvals provided by applicable law, including legislation of UAE
7.3. Disclosure Notification. Without limiting the aforesaid, Partner confirms, and at Hayya’s request will demonstrate that all data subjects whose Personal Data processed by Hayya received appropriate disclosures and notifications, as required under Data Protection Legislation. Where a third party provided the notices to the data subjects and (or) received their consent, Partner will bear sole responsibility to verify and will be able to demonstrate that the notices and (or) consents were sufficient for the purposes of use under the terms of the Agreement and this DPA and adequate pursuant to the Data Protection Legislation.
8. COOPERATION
8.1. Assistance in Compliance. Partner shall cooperate with Hayya and provide all necessary assistance to Hayya in connection with Data Protection Legislation.
8.2. Hayya shall cooperate with Hayya and provide all necessary to Hayya in connection with requests to exercise data subjects’ rights, complaints and inquiries;
8.3. Partner Notices. Unless prohibited under applicable laws, Partner will notify Hayya of:
8.3.1. Any violation by Partner, or anyone on Partner’s behalf of any provision under this DPA;
8.3.2. Any official competent supervisory proceedings regarding the processing of the Personal Data;
8.3.3. Any legal or factual circumstances preventing Partner from performing any of its representations, warranties or obligations under the terms of this DPA; and
8.3.4. Any material changes impacting the technical and organizational security measures implemented by Partner which cause such measures to fall short of Partner’s data security obligations under the Data Protection Legislation.
8.4. Inquiries, requests and complaints. Partner will provide all reasonable and timely assistance to Hayya, to enable Hayya to respond to: (i) supervising authorities’ or data subjects’ requests under the Data Protection Legislation; and (ii) any other correspondence, inquiry or complaint received from data subjects (or on data subjects’ behalf), supervising authority and other regulators, or competent authorities in connection with the processing of the Personal Data provided under this DPA.
8.5. If any such communication is made directly to Partner, Partner will promptly inform Hayya about such communication, provide Hayya with all related details and will not respond to the communication unless specifically required by Data Protection Legislation or authorized by Hayya.
9. LIABILITY
9.1. Partner guarantees the prompt and satisfactory performance of its obligations and responsibilities under this DPA by the Partner and Partner agrees that it will be responsible for all costs associated with its compliance with such obligations. Partner is responsible and liable for its acts and omissions under this DPA.
9.2. Partner will defend, indemnify and hold Hayya, its Affiliates, their officers, directors, employees, contractors and agents harmless from and against any and all third-party claims, demands, losses, damages or expenses, including reasonable attorneys’ fees and court costs, arising out of or in connection with any failure by Partner to comply with the requirements under this DPA.
10. SECURITY INCIDENTS
10.1. Data Processor shall inform Data Controller within 72 hours after becoming aware of any security incident that affects Personal Data, including accidental or unlawful destruction, loss, alteration, theft, unauthorised disclosure of, processing, acquisition or access to Personal Data.
10.2. Data Processor shall immediately take remediation and containment measures to prevent or limit unauthorised access, alteration, loss of confidentiality and Processing of Controller Personal Data.
11. DATA SECURITY
11.1. Taking into account the state of the art, the costs of implementing technical and organizational measures that align with the nature, scope, context and purposes of the processing of Personal Data, Data Processor shall implement appropriate technical and organizational measures to protect Personal Data against accidental or unlawful loss, destruction, damage, theft, alternation or disclosure and to ensure a level of security appropriate to the risk. Such measures may include, but are not limited to limitation of access, access control mechanisms, data encryption, data pseudonymization, malware protection, possessing the ability to restore the availability of and access to Controller Personal Data in a timely manner after a security incident and other relevant measures.
11.2. Data Processor shall regularly test and monitor the effectiveness of its safeguards, controls, systems and procedures.
12. PRIORITY
12.1. Effect of this DPA. In the event of a contradiction between this DPA and the provisions of Agreement, this DPA shall prevail, unless otherwise is stipulated in the DPA.
12.2. Other Data Processing Agreements. This DPA will not affect any other separate data processing agreements between Hayya and Partner in respect of any data processing arising out of the agreements other than Agreement.