Data Processing Addendum

1. Roles

You are the controller of your customers' personal data; Rizo acts as processor and processes it only on your documented instructions.

2. Obligations

Rizo ensures staff confidentiality, implements appropriate technical and organisational measures (including encryption at rest), assists with data subject requests, and notifies you without undue delay of a personal data breach.

3. Sub-processors

You authorise Rizo to use sub-processors for hosting, AI inference, messaging, email, and payments, bound by equivalent obligations. We will notify you of changes.

4. Deletion

On termination, Rizo deletes or returns customer personal data, unless retention is legally required.

5. Saudi PDPL and UAE PDPL

• Where you or your customers are in the Kingdom of Saudi Arabia, both parties will comply with the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations. Where you or your customers are in the United Arab Emirates, both parties will comply with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).
• As controller, you are responsible for having a lawful basis for the customer data you process through Rizo and, in particular, for collecting each customer's opt-in consent before sending any marketing messages, keeping records of that consent, and honouring opt-outs. Rizo will not send marketing messages on your behalf to customers who have not opted in, where you have told us they have not.