Data Processing Agreement

Last updated: 8 October 2026

This Data Processing Agreement ('DPA') forms part of the Terms of Service between you (the 'Customer', acting as Controller of the personal data in your workspace) and Izara (the 'Processor'). It applies automatically when you create a workspace — no separate signature is required, though a countersigned copy is available on request for your own compliance records.

1. Definitions

'Personal Data', 'Processing', 'Controller', 'Processor' and 'Data Subject' have the meanings given in applicable data protection law (including the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and, where applicable to your organization, the EU/UK GDPR). 'Customer Data' means the personal data your team enters into or generates within your workspace — employee records, customer/contact records, invoices, tickets and similar operational data.

2. Roles of the parties

You are the Controller of Customer Data. Izara is the Processor, acting only on your documented instructions as given through your use of the platform's features and settings, and as set out in this DPA and the Terms of Service.

3. Subject matter, duration, nature and purpose

• Subject matter: hosting, storage, and processing of Customer Data as needed to provide the Izara platform.
• Duration: for as long as your subscription is active, plus the retention period described in the Privacy Policy.
• Nature and purpose: automated storage, retrieval, backup and display of Customer Data within your workspace, exactly as directed by your own use of the platform's HR, CRM, finance, service and related modules.

4. Categories of data subjects and personal data

Depending on which modules you use, Customer Data may include personal data relating to: your employees (HR records, attendance, payroll), your customers and leads (CRM/contact records), your suppliers and vendors, and any other individuals your team chooses to record — for example names, contact details, employment or transaction history, and documents you upload.

5. Processor obligations

• Process Customer Data only on your documented instructions, as given through the platform itself — Izara does not use Customer Data for its own purposes, and does not sell it or use it for advertising.
• Ensure personnel with access to Customer Data are bound by confidentiality obligations.
• Implement appropriate technical and organizational security measures, including schema-level isolation per workspace, encryption in transit (HTTPS), and one-way password hashing — see Section 4 of the Privacy Policy for detail.
• Engage sub-processors only as disclosed in Section 7 below, each bound to data-protection obligations materially equivalent to this DPA.
• Assist you, to the extent reasonably possible, in responding to data subject requests (access, correction, deletion) and in meeting your own data-protection obligations.
• Notify you without undue delay after becoming aware of a personal data breach affecting Customer Data.
• Delete or return Customer Data at the end of the relationship, per the retention rules in the Privacy Policy, unless retention is required by law.
• Make available information reasonably necessary to demonstrate compliance with this DPA.

6. Sub-processors

Izara uses the following categories of sub-processor to operate the platform:

• Cloud object storage — for file uploads (documents, receipts, contracts) and static assets, hosted with a reputable cloud infrastructure provider under standard data-processing terms.
• Payment processing — Stripe, Inc., used only for platform subscription billing (your own card details are entered directly with Stripe and never stored by Izara).

If your workspace administrator configures your own third-party email, SMS or WhatsApp provider for notifications, that provider processes data as your own sub-processor under your agreement with them, not Izara's — Izara only passes the message content you configure to the service you connect.

7. International transfers

Izara is operated from the United Arab Emirates. Where Customer Data is processed or stored outside the UAE by a sub-processor listed above, Izara relies on that sub-processor's own compliance certifications and standard contractual safeguards for the transfer.

8. Term and termination

This DPA remains in effect for as long as Izara processes Customer Data on your behalf, and terminates automatically when your workspace is closed and the retention period in the Privacy Policy has elapsed.

9. Contact

Questions about this DPA, or to request a countersigned copy: team@izara.ae