Skip to contentTalk to us
العربيةLog inStart free
DPA for Teams and Enterprise customers

Data Processing Agreement

When you build an app on Fanann, you are the controller of your customers' data and Fanann processes it on your behalf. This Agreement sets out each party's obligations under Saudi and UAE data protection laws.

Controller and processorTransfer safeguards
Request a copy to signSub-processors
Legal draft — requires review by legal counsel before publicationData Processing Agreement: a preliminary draft with bracketed fields to be completed; not legal advice.
Entity[LEGAL COMPANY NAME]
Commercial Registration[COMMERCIAL REGISTRATION]
Address[ADDRESS]
Effective date[EFFECTIVE DATE]
Last updated[LAST UPDATED DATE]
Version[VERSION NUMBER]
Roles

Who does what?

Click any role to see its responsibilities. Data flows one way: from you, to Fanann, to sub-processors.

Your responsibilities (Controller)
  • Defining processing purposes and legal basis
  • Informing your customers via your app's privacy policy
  • Collecting consent where required
  • Responding to data subject requests (with our tools)
  • Choosing a hosting region per project
  • Managing your team's permissions
Fanann's responsibilities (Processor)
  • Processing only on your documented instructions
  • Staff confidentiality obligations
  • Appropriate technical and organizational security measures
  • Notifying you of any breach within [DURATION]
  • Assisting with data subject requests and impact assessments
  • Deleting or returning data at the end of service
Sub-processors' responsibilities (contracted by Fanann)
  • A written contract with the same protection obligations
  • Notice to you [DURATION] before adding a new sub-processor
  • Right to object to any new sub-processor
  • Processing limited to the specified purpose
  • Security assessment before contracting and periodically
  • Fanann remains liable to you for their obligations
Sub-processors

Who helps us process your data

Each sub-processor is bound by a written contract imposing the same protection obligations.

[INFRASTRUCTURE PROVIDER]Your project's region
Compute, storage, and databases — All project data
[AI MODEL PROVIDER][REGION]
Running Fanann Agent — Agent chats and code
[EMAIL PROVIDER][REGION]
Notifications and verification codes — Email and name
[PAYMENT PROVIDER][REGION]
Subscription billing — Billing data
[MONITORING PROVIDER][REGION]
Logs, performance, and alerts — Technical logs
[SUPPORT PROVIDER][REGION]
Support tickets and chats — Contact data
We notify you [DURATION] before adding or changing any sub-processor, and you have the right to object. The final list is subject to legal team approval.
Security measures

Controls protecting data at every layer

Annex of technical and organizational measures. [To be completed with details and ECC-2:2024 compliance level as applicable]

Encryption in transitTLS for all user-to-service connections.
Encryption at restDatabases, files and backups.
Access controlLeast privilege, SSO and two-factor authentication.
Audit logsWho accessed what data, when, and from where.
Project isolationEach project is isolated in the runtime environment.
Backup and recoveryAutomatic backups and restore points.
Incident responseA documented plan, with notice to you within [DURATION].
Personnel and confidentialityConfidentiality agreements and regular security training.
Cross-border data transfers

Your data stays in-region, and any transfer is safeguarded

How we handle transfers under Saudi and UAE data protection laws.

Default: data stays in-regionYour project data stays in the region you chose.
If transfer is required: safeguardsAn adequate level of protection or approved contractual safeguards.
Full transparencyWe document every transfer and notify you in advance.
Personal Data Protection Law — Saudi Arabia
In force since September 14, 2023, fully enforced since September 14, 2024; supervised by the Saudi Data & AI Authority (SDAIA). Transfers outside the Kingdom go to jurisdictions with adequate protection, or under appropriate safeguards:
Standard contractual clausesBinding corporate rulesCertifications
Personal Data Protection Law — UAE
Federal Decree-Law No. 45 of 2021. Its executive regulations had not been issued as of 2026; DIFC and ADGM have their own regimes. Transfer conditions apply per the Decree-Law: [TO BE DETERMINED BY LEGAL COUNSEL].
We will update this section when the regulations are issued

This section is informational, not legal advice, and does not imply Fanann holds any certification or accreditation.

Signature

What does the Agreement cover?

Six main sections, with an annex of security measures and the sub-processor list.

  1. 1Subject matter, duration, and nature of processing
  2. 2Types of data and categories of data subjects
  3. 3Obligations of the processor and sub-processors
  4. 4Incident notification and audit rights
  5. 5Cross-border transfers and safeguards
  6. 6Deletion and return upon termination
Ready for e-signatureWe prepare the agreement in your company's name and send it to your authorized signatory.
Signature request details
Controller's country
Preparing your copy…Filling in both parties' details and adding annex Saudi Arabia.
Request receivedWe'll send the agreement for e-signature to the email you entered within [DURATION].

Explore more of Fanann

Privacy PolicyWhat data we collect, why, and how long we keep it.Trust CenterSecurity, data residency and PDPL compliance.Terms of UseThe rules governing your use of Fanann.

Build for your customers with confidence

A clear Data Processing Agreement and in-region hosting.

Start free · No credit card · Speaks MSA & dialects

DPA for Teams and Enterprise customers

Data Processing Agreement

When you build an app on Fanann, you are the controller of your customers' data and Fanann processes it on your behalf. This Agreement sets out each party's obligations under Saudi and UAE data protection laws.

Controller and processorTransfer safeguards
Request a copy to signSub-processors
Data Processing AgreementEffective date: [EFFECTIVE DATE]
Draft
First Party (Controller)[CLIENT NAME]
Second Party (Processor)[LEGAL COMPANY NAME]
Controller signature
Processor signature
Legal draft — requires review by legal counsel before publicationData Processing Agreement: a preliminary draft with bracketed fields to be completed; not legal advice.
Entity[LEGAL COMPANY NAME]
Commercial Registration[COMMERCIAL REGISTRATION]
Address[ADDRESS]
Effective date[EFFECTIVE DATE]
Last updated[LAST UPDATED DATE]
Version[VERSION NUMBER]
Roles

Who does what?

Click any role to see its responsibilities. Data flows one way: from you, to Fanann, to sub-processors.

Your responsibilities (Controller)
  • Defining processing purposes and legal basis
  • Informing your customers via your app's privacy policy
  • Collecting consent where required
  • Responding to data subject requests (with our tools)
  • Choosing a hosting region per project
  • Managing your team's permissions
Fanann's responsibilities (Processor)
  • Processing only on your documented instructions
  • Staff confidentiality obligations
  • Appropriate technical and organizational security measures
  • Notifying you of any breach within [DURATION]
  • Assisting with data subject requests and impact assessments
  • Deleting or returning data at the end of service
Sub-processors' responsibilities (contracted by Fanann)
  • A written contract with the same protection obligations
  • Notice to you [DURATION] before adding a new sub-processor
  • Right to object to any new sub-processor
  • Processing limited to the specified purpose
  • Security assessment before contracting and periodically
  • Fanann remains liable to you for their obligations
Sub-processors

Who helps us process your data

Each sub-processor is bound by a written contract imposing the same protection obligations.

Sub-processorPurposeDataRegion
[INFRASTRUCTURE PROVIDER]Compute, storage, and databasesAll project dataYour project's region
[AI MODEL PROVIDER]Running Fanann AgentAgent chats and code[REGION]
[EMAIL PROVIDER]Notifications and verification codesEmail and name[REGION]
[PAYMENT PROVIDER]Subscription billingBilling data[REGION]
[MONITORING PROVIDER]Logs, performance, and alertsTechnical logs[REGION]
[SUPPORT PROVIDER]Support tickets and chatsContact data[REGION]
We notify you [DURATION] before adding or changing any sub-processor, and you have the right to object. The final list is subject to legal team approval.
Security measures

Controls protecting data at every layer

Annex of technical and organizational measures. [To be completed with details and ECC-2:2024 compliance level as applicable]

Encryption in transit

TLS for all user-to-service connections.

Encryption at rest

Databases, files and backups.

Access control

Least privilege, SSO and two-factor authentication.

Audit logs

Who accessed what data, when, and from where.

Project isolation

Each project is isolated in the runtime environment.

Backup and recovery

Automatic backups and restore points.

Incident response

A documented plan, with notice to you within [DURATION].

Personnel and confidentiality

Confidentiality agreements and regular security training.

Cross-border data transfers

Your data stays in-region, and any transfer is safeguarded

How we handle transfers under Saudi and UAE data protection laws.

Default: data stays in-regionYour project data stays in the region you chose.
If transfer is required: safeguardsAn adequate level of protection or approved contractual safeguards.
Full transparencyWe document every transfer and notify you in advance.
Personal Data Protection Law — Saudi Arabia
In force since September 14, 2023, fully enforced since September 14, 2024; supervised by the Saudi Data & AI Authority (SDAIA). Transfers outside the Kingdom go to jurisdictions with adequate protection, or under appropriate safeguards:
Standard contractual clausesBinding corporate rulesCertifications
Personal Data Protection Law — UAE
Federal Decree-Law No. 45 of 2021. Its executive regulations had not been issued as of 2026; DIFC and ADGM have their own regimes. Transfer conditions apply per the Decree-Law: [TO BE DETERMINED BY LEGAL COUNSEL].
We will update this section when the regulations are issued

This section is informational, not legal advice, and does not imply Fanann holds any certification or accreditation.

Signature

What does the Agreement cover?

Six main sections, with an annex of security measures and the sub-processor list.

  1. 1Subject matter, duration, and nature of processing
  2. 2Types of data and categories of data subjects
  3. 3Obligations of the processor and sub-processors
  4. 4Incident notification and audit rights
  5. 5Cross-border transfers and safeguards
  6. 6Deletion and return upon termination
Ready for e-signatureWe prepare the agreement in your company's name and send it to your authorized signatory.
Signature request details
Controller's country
Preparing your copy…Filling in both parties' details and adding annex Saudi Arabia.
Request receivedWe'll send the agreement for e-signature to the email you entered within [DURATION].

Explore more of Fanann

Privacy PolicyWhat data we collect, why, and how long we keep it.Learn moreTrust CenterSecurity, data residency and PDPL compliance.Learn moreTerms of UseThe rules governing your use of Fanann.Learn more

Build for your customers with confidence

A clear Data Processing Agreement and in-region hosting.

Start free · No credit card · Speaks MSA & dialects