Data Processing Agreement (DPA)
Last updated: September 2, 2026
This DPA is entered into between LayanX ERP (Processor) and the Customer using our services (Data Controller), governing the processing of end-user data in compliance with GDPR and Oman's Personal Data Protection Law (PDPL) and Gulf region regulations.
1. Definitions
- Controller: The Customer who determines purposes and means of processing.
- Processor: LayanX ERP, processing data on behalf of the Controller.
- Personal Data: Any information relating to an identified or identifiable natural person.
2. Nature of Processing
- Purpose: Provide ERP services for shipping, accounting, and e-commerce.
- Duration: Subscription term + 90 days post-termination (for recovery).
- Data Types: Names, emails, phone numbers, addresses, financial data, shipment records.
- Data Subjects: Controller's staff, customers, suppliers, drivers.
3. Processor Obligations
- Process data only per Controller's documented instructions.
- Ensure confidentiality via AES-256-GCM encryption at rest and TLS 1.2+ in transit.
- Store data in certified data centers (SOC 2 / ISO 27001).
- Notify Controller within 72 hours of any breach.
- Assist with Data Subject Rights requests.
- Delete or return data at contract end per Controller instructions.
4. Sub-processors
We use the following sub-processors and notify Controllers before any change:
See Arabic version for the full list.
5. International Transfers
We use Standard Contractual Clauses (SCCs) or equivalent safeguards for transfers outside the Gulf region.
6. Data Subject Rights
We help Controllers fulfill: access, rectification, erasure, portability, and objection rights.
7. Liability
Total liability capped at 12 months of subscription fees preceding the incident.
8. Termination
Upon termination, Controller has 30 days to request data return or deletion. After 90 days, all data is permanently deleted.
9. Governing Law
Governed by Oman law. GDPR rights recognized for EU Controllers.