Data Processing Addendum
Last updated: 2026-06-04
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Simplify Your Work FZ-LLC (“Simplify,” the “Processor”) and the customer (“Controller”) and applies where Simplify processes personal data on the Controller's behalf.
1. Scope & roles
The Controller is responsible for the lawfulness of the personal data it loads into the Service. Simplify acts as the Processor and processes personal data only on documented instructions from the Controller.
2. Nature & purpose
Personal data is processed to provide the Service — including accounting, HR, fleet, CRM, scheduling, messaging, and analytics features — for the duration of the subscription.
3. Data categories & data subjects
- Employees, technicians, sales staff of the Controller.
- Customers, contacts, and suppliers of the Controller.
- Categories include name, contact details, role, financial transactions, location data (for fleet + mobile app), and communication records.
4. Sub-processors
Simplify uses sub-processors for infrastructure, email delivery, analytics, and support tooling. A current list is available on request and will be provided with at least 30 days' notice of material changes.
5. Security measures
- TLS-in-transit and at-rest encryption.
- Role-based access control with per-user allowedModules overlay.
- Session cookies with HttpOnly + Secure + SameSite flags.
- Audit logs for administrative actions.
- Regular backups + documented recovery procedures.
- Penetration testing + independent security review on a rolling basis.
6. International transfers
Where personal data is transferred outside the UAE, we rely on Standard Contractual Clauses or other appropriate safeguards.
7. Data subject requests
Simplify will assist the Controller in responding to data-subject requests (access, correction, deletion, portability) through self-serve platform features and, where needed, manual support.
8. Breach notification
Simplify will notify the Controller without undue delay after becoming aware of a personal-data breach, and no later than 72 hours where feasible.
9. Audits
Simplify will provide the Controller with the information necessary to demonstrate compliance with this DPA, and will allow audits (including third-party audits) subject to reasonable confidentiality + scheduling terms.
10. Termination
On termination of the Service, Simplify will — at the Controller's choice — return or delete the personal data, subject to legal retention obligations (notably VAT and tax records).
11. Contact
Version: 2026-06-04