Trust & compliance

Data processing agreement

Last updated: 1 Nov 2026

Draft for counsel review. This text is a working framework prepared by the product team and not yet approved by legal counsel; it is not a contractual commitment until approved.

Roles

The customer (trustee or organisation) is the controller of waqf data; Qayyim is a processor acting on documented instructions within the service.

Processor obligations

Processing solely to provide the service.
Confidentiality of authorised staff and need-to-know access.
Appropriate technical and organisational measures (see the security overview).
Notification of any incident affecting data without undue delay.
Assistance with data-subject and regulator requests.
Return or deletion of data at contract end, per the customer’s choice and statutory periods.

Sub-processors

The approved list is published with each processor’s location and purpose; the customer is notified of additions a reasonable period before they take effect, with a right to object.

Transfers outside the Kingdom

Stored waqf data is not transferred outside the Kingdom. Automatic deed reading may pass through an external provider for transient processing only; the customer may disable it and use manual transcription.

For contractual and legal enquiries: through the quote request page or the support address in your contract.