Data Processing Agreement

1. Subject matter and duration

The subject matter is the processing of personal data uploaded or generated by the Controller's users (typically mortgage applicants) for the purpose of operating DubaiPropertyLoan. The DPA continues for as long as Namvio Web Services processes such data.

2. Nature and purpose of processing

Hosting and serving the document portal, generating eligibility estimates, providing optional AI-assisted analysis, sending platform notifications, and enabling broker–client communication.

3. Types of data and data subjects

Data subjects: brokers, broker team members, mortgage applicants and authorised representatives. Categories of personal data: identification and contact data; financial and employment documents; communications; technical and log data. Sensitive document categories listed in the Privacy Policy may be present when uploaded by the user.

4. Controller and processor obligations

The Controller will (a) ensure it has a lawful basis for the processing it instructs Namvio Web Services to perform; (b) provide all required notices and obtain all required consents from data subjects; (c) instruct Namvio Web Services only in writing through the documented features of the service.

Namvio Web Services will (a) process personal data only on documented Controller instructions; (b) ensure persons authorised to process the data are bound by confidentiality; (c) implement the security measures in the Information Security Policy; (d) assist the Controller in responding to data-subject requests and supervisory-authority enquiries; (e) make available information needed to demonstrate compliance.

5. Subprocessors

Namvio Web Services engages the following categories of subprocessor: cloud database & object storage (Supabase), edge hosting (Cloudflare / Vercel), payment processing (PayPal), AI processing (Google Gemini), transactional email, analytics and monitoring. The current named list is maintained at subprocessor-page-url and updated as it changes. Namvio Web Services will give the Controller advance notice of new subprocessors and a reasonable period to object.

6. International transfers

Where processing takes place outside the data subject's country and applicable law requires transfer safeguards, Namvio Web Services relies on contractual protections with its subprocessors and on the measures described in the International Data Transfer Policy.

7. Personal data breach

Namvio Web Services will notify the Controller without undue delay and, where feasible, within 72 hours after becoming aware of a personal data breach affecting the Controller's data, in accordance with the Data Breach Response Policy.

8. Data subject requests

Namvio Web Services will, taking into account the nature of processing, assist the Controller by appropriate technical and organisational measures to respond to requests to exercise data-subject rights.

9. Return and deletion

On termination of the service, and at the Controller's choice, Namvio Web Services will delete or return personal data and delete existing copies unless retention is required by law, in line with the Document Retention Policy.

10. Audits

Namvio Web Services will make available all information necessary to demonstrate compliance with this DPA and will allow for and contribute to audits by the Controller or an auditor mandated by the Controller, subject to reasonable confidentiality and security restrictions and at the Controller's expense.