This Data Processing (DPA) applies to the use of the Tawqi3i platform and services and forms part of the contractual framework governing the processing of Personal Data between Tawqi3i Limited and its customers.

​​

​

1. Definitions

​​

For the purposes of this DPA:

• Personal Data: means any information relating to an identified or identifiable natural person.

• Processing: means any operation performed on Personal Data (automated or non-automated), including collection, storage, use, disclosure, or deletion.

• Controller: means the Customer who determines the purposes and means of Processing.

• Processor: means Tawqi3i, which Processes Personal Data on behalf of the Controller.

• Services: means Tawqi3i’s digital signature, document management, workflow, developer APIs, and related trust services.

​​​

​

​​2. Roles of the Parties

​​​​

• The Customer acts as the Controller of Personal Data.

• Tawqi3i acts as the Processor and Processes Personal Data only on behalf of, and in accordance with, the Customer’s instructions.

​​​

​

3. Purpose of Processing

​​​

Tawqi3i Processes Personal Data strictly to:

​

• Provide and operate the Services.

• Generate audit trails and signature evidence.

• Maintain platform security and continuity.

• Comply with applicable laws and regulatory requirements.​

​​

​

​4. Compliance with Applicable Laws

​​​

• Tawqi3i Processes Personal Data in accordance with applicable laws in the Hashemite Kingdom of Jordan, including the Electronic Transactions Law, the Cybercrimes Law, and any relevant instructions issued by competent authorities, where applicable.

​

5. Processing Instructions and Limited Access

​​

• Tawqi3i Processes Personal Data solely based on the Customer’s documented instructions.

• Tawqi3i does not access document content or Personal Data except to the extent technically necessary to provide and operate the Services.

​​

6. Confidentiality

​

• Tawqi3i ensures that its employees and authorized contractors are subject to strict confidentiality obligations. Personal Data is not disclosed to unauthorized parties except as required to provide the Services or where legally required.

​

7. Security Measures

​

Tawqi3i implements appropriate technical and organizational measures to protect Personal Data, including:

• Encryption in transit and at rest.

• Role-based and multi-level access controls.

• Security monitoring and logging.

• Incident response procedures.

​

​

8. Sub-Processors

​

• Tawqi3i may use qualified sub-processors where necessary to provide the Services. Tawqi3i requires sub-processors to maintain a level of data protection consistent with this DPA. Upon request, Tawqi3i will provide available information regarding relevant sub-processors.​

​

​

9. Data Subject Requests

​

• Tawqi3i will reasonably assist the Customer, where required by law, in responding to requests from individuals regarding access, correction, deletion, or restriction of their Personal Data.

​​

​

10. Personal Data Breach Notification

​

• If Tawqi3i becomes aware of a Personal Data security breach, it will notify the Customer without undue delay and provide available information necessary to support required legal or regulatory steps.

​​

​

11. Data Retention and Deletion

​

• Tawqi3i retains Personal Data only as long as necessary to provide the Services or as required by applicable law. Upon termination of the Services, Tawqi3i will delete or return Personal Data to the Customer, unless retention is legally required.

​

12. Cross-Border Transfers

​

• Tawqi3i does not transfer Personal Data outside the Hashemite Kingdom of Jordan unless necessary and subject to appropriate legal and technical safeguards.

​

13. Audit and Compliance

​

• Upon reasonable request, Tawqi3i will provide information necessary to demonstrate compliance with this DPA, subject to confidentiality and security considerations and without undue disruption to operations.