Data Processing Agreement (DPA)

This Data Processing Agreement (“DPA”) forms part of the Wowmotive Master SaaS Services Agreement and applies where Wowmotive, LLC (“Wowmotive” or “Processor”) processes Personal Data on behalf of the Customer (“Customer” or “Controller”) in connection with the Services. Where the UAE Personal Data Protection Law applies, this DPA is intended to support the Parties’ obligations under Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data (the “UAE PDPL”), together with its applicable Executive Regulations. The UAE PDPL expressly applies, subject to its scope and exclusions, to a Controller or Processor located outside the UAE that processes Personal Data of Data Subjects inside the UAE. Nothing in this DPA reduces an obligation that Applicable Law imposes on Wowmotive as a matter of law regardless of contract language.

“Personal Data,” “Sensitive Personal Data,” “Controller,” “Processor,” “Subprocessor,” “Data Subject,” “Processing,” “Personal Data Breach,” and “Cross-Border Processing” have the meanings given under Applicable Law, including the UAE PDPL where applicable.

For processing activities where Customer determines the purposes and means of processing Personal Data and Wowmotive processes that data on Customer’s behalf, Customer acts as Controller and Wowmotive acts as Processor. Wowmotive may act as a Controller for limited processing that it independently determines, such as account administration, security, fraud prevention, billing, and service analytics. Each Party remains responsible for its own obligations under Applicable Law.

Wowmotive will process Personal Data only on documented instructions from Customer, unless required by law to do otherwise. Wowmotive will not sell Customer Personal Data or use it for unrelated purposes outside the agreed Services except where expressly authorised by Customer or required by law.

Subject matter: provision, operation, support, security, reporting, integrations, and administration of the Services. Duration: the applicable subscription term plus the agreed retention/deletion period. Data Subjects: drivers, employees, contractors, administrators, Customer personnel, and other individuals whose Personal Data Customer submits to the Services. Categories of Personal Data may include: name and contact information; account and authentication information; Emirates ID, passport and driver licence information where provided; vehicle and asset information; trip, route and operational records; GPS and geographical location; device and technical log information; uploaded documents; invoicing, payroll, and driver-wallet ledger records (earnings, balances, and payment status tracked internally; Wowmotive does not collect or store bank account or card numbers and does not itself process, hold, or transmit funds); and communications and support records.

Customer is solely responsible for determining and documenting the lawful basis for processing where Customer is the Controller, providing required notices to Data Subjects, and obtaining consent where consent is the applicable legal basis. Wowmotive bears no responsibility for the sufficiency of Customer’s lawful-basis determination or notices.

• Process Personal Data only in accordance with documented Customer instructions and Applicable Law.
• Maintain confidentiality obligations for personnel authorised to process Personal Data.
• Implement technical and organisational security measures appropriate to the risk, as further described in the Security Addendum.
• Provide reasonable assistance to Customer with Data Subject requests, Personal Data Breaches, and regulatory requests, which may be subject to a reasonable fee for material additional work beyond Wowmotive’s standard support.

Wowmotive will use commercially reasonable efforts to maintain technical and organisational measures proportionate to the risks of the processing, as further described in the Security Addendum. No specific security outcome is guaranteed.

As an operational aim only, and not as a guaranteed deadline, Wowmotive will use reasonable efforts to notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, targeting no later than seventy-two (72) hours where reasonably practicable. The notice will contain information reasonably available at the time.

Where Wowmotive acts as Controller for Personal Data it independently controls (including account administration, billing, security and fraud-prevention data), Wowmotive will notify the UAE Data Office within the timeframe required by Applicable Law (as a benchmark, and consistent with prevailing UAE PDPL practice, no later than seventy-two (72) hours of becoming aware of a Personal Data Breach likely to result in a risk to the rights of Data Subjects), and will notify affected individuals without undue delay where the breach is likely to result in a high risk. This paragraph does not expand any obligation beyond what Applicable Law actually requires.

Where Wowmotive acts as Processor, Wowmotive will provide reasonable assistance to Customer in responding to valid Data Subject requests. Where Customer is the Controller, Wowmotive will not independently determine the merits of a Data Subject request unless required by law or expressly instructed by Customer.

Wowmotive may permit (a) authorised Wowmotive personnel located in the United States or other disclosed locations, and (b) an independent third-party contracted software development and engineering services provider based in Pakistan — engaged as a Subprocessor, and not a Wowmotive employee or personnel — to access Personal Data solely as necessary to provide, secure, support, maintain or troubleshoot the Services. Such personnel and the Pakistan-based contractor will be engaged under Wowmotive’s standard vendor confidentiality, security, and data-protection terms, appropriate to their role. Customer acknowledges that this remote access constitutes processing and cross-border processing where applicable, and that Wowmotive is based in the United States and may store, access, or process Personal Data in the United States and other jurisdictions. The Parties acknowledge that UAE PDPL Articles 22 and 23 regulate transfers of Personal Data outside the UAE. Cross-border processing will be carried out using the transfer route and safeguards required by Applicable Law. Wowmotive does not represent that any particular country is automatically an adequate destination.

Customer authorises Wowmotive to engage Subprocessors reasonably necessary to provide the Services. Wowmotive will maintain a current Subprocessor List through the legal portal and will provide reasonable notice of a new or materially changed Subprocessor, taking into account the nature and urgency of the change. Where Customer has a reasonable, documented data-protection objection to a new Subprocessor that the parties cannot resolve, Customer’s sole and exclusive remedy is to terminate the affected Service; no other remedy is available for a Subprocessor change.

The UAE PDPL requires a Controller or Processor to appoint a Data Protection Officer in specified, risk-based circumstances. The Parties will assess whether DPO appointment requirements apply to their respective processing activities. Where Wowmotive is required to appoint a DPO under Applicable Law, Wowmotive will maintain an appropriate DPO arrangement.

Where Applicable Law requires a DPIA, the Controller is responsible for conducting or coordinating it. Wowmotive will provide reasonable assistance concerning processing under Wowmotive’s control, which may be subject to a fee for material additional work.

Upon reasonable written request, and no more than once per twelve-month period absent a confirmed security incident, Wowmotive may provide available compliance information, security summaries, or certifications appropriate to the Services. Any assessment is limited to written questionnaires and documentation review; on-site inspection or third-party auditor access is not included and, if desired, requires a separate written agreement and may be subject to a fee.

If Wowmotive receives a legally binding request for Customer Personal Data, Wowmotive will, where legally permitted, notify Customer and provide reasonable assistance.

Wowmotive will retain Personal Data only for as long as necessary to provide the Services, comply with law, maintain security, resolve disputes, and perform the Agreement, in accordance with Wowmotive’s internal retention schedule (available upon request) and any Customer-configured retention settings. After termination, Customer Personal Data will be available for export for thirty (30) days and may thereafter be deleted, subject to lawful retention requirements.

Current production/service locations include Germany (AWS/Neon), the United States (Google Cloud Storage), and the Netherlands (Railway/Valhalla). Authorised Wowmotive personnel and contractors, including those located outside the UAE, may access Personal Data as necessary to provide, secure, support, maintain, or troubleshoot the Services.

Wowmotive will ensure that personnel and contractors authorised to process Customer Personal Data are bound by confidentiality obligations appropriate to their role.

Liability arising under this DPA is subject to the limitation of liability in MSA Section 23.

If this DPA conflicts with the MSA, the Order Form, or an incorporated operational addendum regarding Personal Data processing, this DPA controls to the extent of the conflict. No provision of this DPA is intended to exclude a mandatory provision of Applicable Law that cannot lawfully be excluded.

This DPA remains in force for as long as Wowmotive processes Personal Data on Customer’s behalf. Provisions that by their nature should survive will survive termination.

This DPA becomes binding when incorporated into an executed Order Form or other written agreement that references it. No separate signature is required unless expressly stated.