Data Processing Agreement

Version 1.0 · Last updated: 2026-10-20

This Data Processing Agreement (“DPA”) forms part of the Terms of Service (the “Agreement”) between Peikly, Dubai, United Arab Emirates (“Peikly”, the “Processor”) and the business that created a Peikly account (the “Client”, the “Controller”). It applies when Peikly processes Personal Data on the Client’s behalf in providing the Service. It takes effect when the Client accepts the Terms of Service, and it replaces any earlier data processing terms between the parties.

1. Definitions

• Applicable Data Protection Law: the UAE Federal Decree-Law No. 45 of 2021 (PDPL) and its regulations, and, where they apply to the Client’s processing, the EU General Data Protection Regulation (GDPR), the UK GDPR, and other data protection laws that apply to Client Data.
• Client Data: Personal Data that the Client, its users or its connected accounts submit to or generate in the Service, for example contacts, leads, messages, campaign content, form answers, notes, tasks, media files and data received from connected platforms.
• Personal Data, Controller, Processor, Data Subject, Processing, Supervisory Authority: have the meanings in Applicable Data Protection Law.
• Personal Data Breach: a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Client Data.
• Sub-processor: a third party that Peikly engages to process Client Data.
• Service: the Peikly platform described in the Agreement, including its AI features.
• Standard Contractual Clauses (SCCs): the standard clauses approved for international transfers under Applicable Data Protection Law, including the EU Commission Implementing Decision (EU) 2021/914 and the UK Addendum.

2. Scope and roles

2.1 For Client Data, the Client is the Controller and Peikly is the Processor.

2.2 Peikly acts as a controller for its own account, billing, security and website data. That data is covered by the Privacy Policy and not by this DPA.

2.3 The Client is responsible for the lawfulness of its Processing. This includes having a legal basis and any consent needed to store Client Data in the Service and to contact recipients by email or WhatsApp, giving required notices to Data Subjects, and honouring opt-outs.

2.4 Annex I describes the subject matter, duration, nature, purpose, data types and Data Subjects.

3. Processing on instructions

3.1 Peikly will process Client Data only on the Client’s documented instructions. The Agreement, this DPA, the Client’s use of the Service’s features and settings, and its support requests are the Client’s complete instructions.

3.2 Peikly will not process Client Data for its own purposes, sell it, or combine it with other clients’ data, except for anonymised, aggregated statistics about use of the Service that identify neither the Client nor any individual.

3.3 If Peikly believes an instruction breaches Applicable Data Protection Law, it will tell the Client without undue delay and may suspend that processing until the instruction is confirmed or changed.

3.4 If the law requires Peikly to process Client Data otherwise, Peikly will inform the Client before doing so, unless the law prohibits it.

4. Artificial intelligence features

4.1 Peikly will not send Client Data to an AI provider for an AI feature unless the Client’s company administrator has recorded consent to AI data use in the Service (onboarding or Settings → Company → AI & data). This consent is the Client’s instruction for those features. It may be withdrawn at any time, and Peikly will then stop sending Client Data to AI providers for the Client’s account. Withdrawal does not delete content already created, which the Client can delete or ask Peikly to delete.

4.2 Client Data sent to AI providers is limited to what a feature needs for the task a user starts. AI providers act as Sub-processors.

4.3 The Client is responsible for reviewing AI-generated content before using it. Peikly does not use AI to make decisions with legal or similarly significant effects on Data Subjects.

5. Confidentiality

Peikly will ensure that everyone it authorises to process Client Data is bound by a duty of confidentiality and receives appropriate data protection training, and that access is limited to what their role needs, such as providing support at the Client’s request.

6. Security

6.1 Peikly will keep appropriate technical and organisational measures to protect Client Data, taking into account risk, state of the art and cost. The minimum measures are set out in Annex II.

6.2 The Client is responsible for the security of its own accounts, including strong passwords, sensible user permissions, and removing users who have left. It is also responsible for the connections it authorises, such as Meta, LinkedIn, Pinterest, Canva and mailboxes.

7. Sub-processors

7.1 The Client gives Peikly general authorisation to use the Sub-processors listed in Annex III.

7.2 Peikly will list the current Sub-processors at [Sub-processors page URL], and will give the Client at least 30 days’ notice (by email to the account administrator and a notice on that page) before adding or replacing one that will handle Client Data.

7.3 The Client may object on reasonable data protection grounds within that period. The parties will then work in good faith to find a solution. If none is found within 30 days, the Client may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for it.

7.4 Peikly will bind each Sub-processor by a written contract with data protection obligations no less protective than this DPA, and remains responsible for its Sub-processors’ performance.

7.5 Platforms the Client chooses to connect (for example its own Meta, LinkedIn, Pinterest, Canva, email or payment accounts) are the Client’s own service providers, not Peikly’s Sub-processors. Peikly transmits data to them on the Client’s instruction.

8. International transfers

8.1 Peikly may process Client Data in the UAE and in the countries where its Sub-processors operate, as listed in Annex III.

8.2 Where Client Data from the EU, EEA, UK or another region with transfer restrictions is transferred to a country without an adequate level of protection, the parties agree to the SCCs, which are incorporated by reference and completed as follows: Module Two (Controller to Processor) applies; the Client is the exporter and Peikly the importer; Annexes I to III of this DPA serve as the annexes to the SCCs. The UK Addendum applies to UK transfers. In case of conflict, the SCCs prevail.

8.3 Transfers out of the UAE will comply with the PDPL’s transfer requirements. Peikly will apply approved safeguards or another lawful transfer mechanism and, on request, tell the Client which one applies.

8.4 Peikly will ensure its Sub-processors’ onward transfers have comparable safeguards.

9. Data Subject requests

9.1 Peikly will promptly (within 5 business days) tell the Client if it receives a request from a Data Subject about Client Data, and will not respond to it itself except to say that it has passed the request on, unless the Client instructs otherwise.

9.2 Taking into account the nature of the processing, Peikly will assist the Client with appropriate measures so the Client can answer Data Subject requests. The Service lets the Client search, export, correct, restrict and delete contact data itself. Peikly will help where the Client cannot, at no extra charge for reasonable requests.

10. Personal Data Breaches

10.1 Peikly will notify the Client’s account administrator without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Client Data.

10.2 The notice will include, as far as known: the nature of the breach and the data and Data Subjects concerned, likely consequences, the measures taken or proposed, and a contact point. Peikly will provide further information as it becomes available, and will take reasonable steps to contain and remedy the breach.

10.3 The Client decides whether and how to notify authorities and Data Subjects. Peikly will help as reasonably required. A notice of a breach is not an admission of fault.

11. Assistance

Peikly will give the Client reasonable help, taking into account the nature of the processing and the information Peikly has, with:

• data protection impact assessments and prior consultations with authorities;
• the Client’s security and breach-notification obligations;
• responding to Supervisory Authority enquiries about Peikly’s processing of Client Data.

12. Audit and information

12.1 Peikly will make available the information needed to show compliance with this DPA, such as its security documentation and summaries of independent assessments or certifications it holds.

12.2 If that information is not enough, or a Supervisory Authority requires it, the Client may audit Peikly’s compliance once in any 12 months (more often after a Personal Data Breach), on at least 30 days’ written notice, during business hours, with a reasonable scope, under confidentiality, without access to other clients’ data, and at the Client’s cost. The Client may use an independent auditor bound by confidentiality.

13. Return and deletion

13.1 During the term, the Client can export and delete Client Data using the Service.

13.2 When the Client’s account closes, the Client keeps access until the end of the period already paid for. Peikly will then, at the Client’s choice, return a copy of the Client Data on request made within 30 days, and will delete the Client Data from active systems within 30 days after that, and from backups within 35 days after deletion.

13.3 Peikly may keep Client Data only where the law requires, only for that purpose, and under the protections of this DPA. Deleting an item in the Service hides it immediately, and permanent erasure follows within the periods in this section.

13.4 On request, Peikly will confirm deletion in writing.

14. Platform-specific terms

14.1 WhatsApp Business app coexistence. If the Client connects a WhatsApp number that is also used in the WhatsApp Business app, the Client authorises Peikly to import that number’s contacts and message history once. The Client is responsible for ensuring it may do so. Imported history is stored as past records only.

14.2 Messaging compliance. The Client is solely responsible for opt-in, content and frequency of messages it sends, and must comply with Meta’s WhatsApp Business policies and applicable messaging and anti-spam laws. Peikly may pause sending that breaches these rules.

14.3 Tokens and credentials. Access tokens and credentials the Client provides are stored encrypted and used only to provide the Service.

15. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions in the Agreement, except where Applicable Data Protection Law does not allow them.

16. Term, order of precedence and changes

16.1 This DPA applies as long as Peikly processes Client Data, and its confidentiality, deletion and liability provisions survive for as long as necessary.

16.2 If this DPA conflicts with the Agreement on data protection, this DPA prevails. If it conflicts with the SCCs, the SCCs prevail.

16.3 Peikly may update this DPA to reflect legal changes or changes to the Service, giving the Client at least 30 days’ notice of material changes. If the Client reasonably objects, section 7.3 applies by analogy.

17. Governing law and disputes

This DPA is governed by the laws that govern the Agreement, being the laws of Dubai and the federal laws of the UAE applicable there. The courts named in the Agreement have jurisdiction.

18. Contact

Data protection matters: privacy@peikly.com

Annex I: Description of the processing

Annex II: Technical and organisational measures

Access and isolation

• Each Client’s data is logically separated. Every query is filtered by the Client’s company identity, and no cross-tenant access is permitted.
• Role-based access with per-user permissions set by the Client’s administrator; the platform’s own staff access Client Data only when needed to provide support, and that access is logged.
• Password hashing; multi-factor authentication for Peikly staff and, where offered, for Clients.

Encryption and secrets

• Encryption in transit (TLS) for all traffic.
• Field-level encryption at rest for sensitive data, including access tokens, credentials, contact details, and payment identifiers.
• Connection tokens are never shown again after setup.

Application security

• Signed and verified webhooks and API requests, with replay protection.
• Rate limiting and abuse protection.
• Subscription and feature checks on every request.
• Records are soft-deleted in the application, and permanently removed according to section 13.

Monitoring and resilience

• Audit logging of sensitive actions, error monitoring and alerts for failures.
• Regular backups with restore testing; backup encryption and retention of 35 days.

Organisation

• Confidentiality commitments and security training for staff.
• Secure development practices, dependency scanning and periodic penetration testing.
• Vendor review before engaging Sub-processors.

Annex III: Authorised Sub-processors

Meta, LinkedIn, Pinterest, Canva and the Client’s own mailboxes are services the Client connects (section 7.5).