1. Parties

This Data Processing Agreement (“DPA”) forms part of the SnagBolt Terms of Service between Nobots FZ LLC (“Processor”), Compass Building, Alshohada Rd, RAK, United Arab Emirates (TRN: 105027313300001; License: 47006538), and the entity or individual agreeing to these terms (“Controller”).

2. Scope and Purpose

The Processor processes personal data on behalf of the Controller solely to provide the SnagBolt property inspection reporting service, including: storing inspection photographs and annotations, generating PDF reports, managing user accounts, processing subscription payments, and sending transactional emails.

3. Categories of Data and Data Subjects

• Data subjects: Controller's employees, agents, and end-users who use the service.
• Personal data categories: Name, email address, photographs uploaded for inspection purposes, device/browser metadata, IP addresses, and payment identifiers (card details are held by Stripe, not the Processor).
• No special category (sensitive) data is intentionally collected.

4. Processor Obligations

• Process personal data only on documented instructions from the Controller, unless required by applicable law.
• Ensure that persons authorised to process personal data have committed to confidentiality.
• Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
• Assist the Controller in responding to data subject access, rectification, erasure, and portability requests.
• Notify the Controller without undue delay after becoming aware of a personal data breach.
• Delete or return all personal data at the end of the service relationship, unless retention is required by law.
• Make available to the Controller all information necessary to demonstrate compliance with this DPA.

5. Sub-processors

The Processor engages the following sub-processors. The Controller authorises these sub-processors as of the effective date. The Processor will notify the Controller before adding or replacing sub-processors.

6. International Transfers

Personal data may be transferred to and processed in countries outside the data subject's country of residence, including the United States. Such transfers rely on: (a) EU Standard Contractual Clauses where applicable; (b) the sub-processor's own data protection frameworks and certifications; and (c) appropriate safeguards required by applicable data protection law.

7. Data Retention

• Active account data is retained for the duration of the service relationship.
• After account deletion or subscription expiry, personal data is deleted within 90 days, except where retention is required for legal, tax, or audit purposes.
• Inspection photographs and report data are retained only while the account is active or during any post-termination retention period.
• Payment records are retained as required by applicable tax law (typically 5–7 years).

8. Security Measures

• All data in transit is encrypted using TLS 1.2 or higher.
• Data at rest is encrypted using AES-256 or equivalent.
• Access to production systems is restricted to authorised personnel with role-based access controls.
• Regular security reviews and dependency updates are performed.
• Authentication uses OAuth 2.0 with secure token handling.

9. Data Subject Rights

The Processor will assist the Controller in fulfilling data subject requests (access, rectification, erasure, restriction, portability, objection) within the timeframes required by applicable law. Data subjects may contact the Controller or the Processor directly at [email protected].

10. Breach Notification

The Processor will notify the Controller without undue delay (and in any event within 72 hours of becoming aware) of any personal data breach that is likely to result in a risk to the rights and freedoms of data subjects. The notification will include the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to mitigate the breach.

11. Term and Termination

This DPA is effective as long as the Processor processes personal data on behalf of the Controller. Upon termination, the Processor will delete or return all personal data in accordance with Section 7, unless applicable law requires further retention.

12. Contact