Data Processing Agreement

This Data Processing Agreement ("Agreement") forms part of the agreement under which CVM provides the CX Suite (LeadMe, SurveyMe and CaseMe) to a client business ("Client"). It applies whenever CVM processes personal data on the Client's behalf.

CVM ("we", "us") provides the CX Suite from Dubai, United Arab Emirates, at cvm-me.com. Contact for data protection matters: mahermustafa@cvm-me.com.

1. Roles

1.1 The Client is the controller of the personal data of its customers, prospects and staff that it places in, or collects through, the CX Suite. The Client decides why and how that data is used.

1.2 CVM is the processor. We process that data only to provide the CX Suite to the Client and only on the Client's documented instructions, which include this Agreement, the Client's settings in the CX Suite and the actions of the Client's authorised users.

1.3 This Agreement is designed to meet the requirements of the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL") and any other data protection law that applies to the Client.

2. The Client's responsibilities

2.1 The Client confirms that it has a lawful basis, including consent where the law requires it, to share the personal data with CVM and to contact its customers through the channels it uses in the CX Suite, including WhatsApp, SMS, email, web links and telephone.

2.2 The Client records where each customer's permission to be contacted came from, and honours opt-outs. The CX Suite records consent sources and opt-outs and stops contact after an opt-out; the Client remains responsible for the accuracy of what it uploads.

2.3 The Client does not upload special-category data (such as health, biometric or financial account data) unless it has agreed this with CVM in writing.

3. CVM's responsibilities

CVM will:

3.1 process the personal data only on the Client's documented instructions, and tell the Client if we believe an instruction breaks the law;

3.2 make sure that everyone at CVM who can access the data is bound by confidentiality;

3.3 apply the security measures in Annex B and keep them appropriate to the risk;

3.4 keep each Client's data separate from every other client's data;

3.5 use only the sub-processors listed in Annex C, give the Client at least 30 days' notice before adding or replacing one, and allow the Client to object; where the Client objects on reasonable grounds and we cannot resolve it, the Client may end the service for the affected product without penalty;

3.6 bind each sub-processor to data protection obligations no less protective than this Agreement;

3.7 help the Client respond to requests from individuals to access, correct, delete, restrict or port their data, or to object to processing, within the time the law allows;

3.8 help the Client meet its obligations on security, breach notification and data protection impact assessments, taking into account the information available to us;

3.9 notify the Client without undue delay, and in any event within 48 hours of becoming aware, of a personal data breach affecting the Client's data, with the information the Client needs to meet its own obligations;

3.10 make available the information reasonably needed to show compliance with this Agreement, and allow audits by the Client or an auditor it appoints, with reasonable notice, at the Client's cost and not more than once a year unless a breach has occurred.

4. Transfers outside the UAE

4.1 Some sub-processors in Annex C store or process data outside the UAE. CVM will transfer personal data outside the UAE only where the PDPL permits it, including to countries with adequate protection or under appropriate contractual safeguards.

4.2 If the Client needs its data to remain in the UAE (for example for health information), it must tell CVM before any such data is uploaded, and CVM will confirm in writing whether and how this can be met.

5. Retention, return and deletion

5.1 CVM keeps the Client's data for as long as the Client uses the CX Suite, or for the shorter retention period the Client sets.

5.2 The Client can export its data at any time from the report centres of each product.

5.3 When the service or a pilot ends, CVM will, at the Client's choice, return the data in a standard format or delete it, within 30 days. Copies in backups are deleted within 90 days of the end of the service, as backups rotate. CVM confirms deletion in writing on request.

5.4 CVM will delete an individual's data from the Client's workspace within 7 days of a valid request passed on by the Client.

6. Liability and precedence

6.1 Each party's liability under this Agreement is subject to the limits in the main agreement between the parties, except where the law does not allow liability to be limited.

6.2 If this Agreement conflicts with the main agreement on the protection of personal data, this Agreement applies.

7. Duration and law

7.1 This Agreement lasts as long as CVM processes personal data for the Client, including during any pilot, and its obligations on confidentiality, deletion and security continue after that.

7.2 This Agreement is governed by the laws of the United Arab Emirates as applied in the Emirate of Dubai, and the courts of Dubai have jurisdiction.

Annex A — Details of the processing

Annex B — Security measures

• Encrypted connections (HTTPS/TLS) for all access to the CX Suite and its interfaces.
• Each client account is kept in its own workspace; users see only the accounts and workspaces they are authorised for.
• Role-based access for Client users (for example administrator, manager, agent, read-only reports).
• Sign-in through a single CVM account with password policies and self-service password reset.
• Activity and audit logs of key actions (for example case changes and data imports).
• Application settings and access keys stored encrypted; encrypted backup of settings held separately from its password.
• Regular database backups held in a restricted storage location, with restore tests.
• Customer contact through approved messaging templates; opt-outs recorded and enforced.
• Access by CVM staff limited to what is needed to provide and support the service.

Annex C — Sub-processors