Data Processing Agreement

1. Roles

The business (“Controller”) decides why and how its customers’ personal data is processed. Turnly [legal entity name — to be completed] (“Processor”) processes it only to provide the Turnly service, on the Controller’s documented instructions, which are these terms and the settings the Controller chooses.

2. What is processed

• People: the Controller’s customers who join its queue.
• Data: phone number (WhatsApp joins only), language, ticket history, answers to allow-listed pre-visit questions, ratings, messages sent to the queue number.
• Not processed: special categories of data, including health data. The Controller must not enter such data.
• Duration: for as long as the Controller uses the service, subject to the retention periods in the Privacy Policy.

3. The Processor’s commitments

• Process personal data only on the Controller’s instructions and not for its own purposes, advertising or sale.
• Keep it confidential and limit access to people who need it.
• Apply appropriate security: encryption in transit, encryption at rest for secrets and uploaded files, tenant isolation, role-based access, audit logging.
• Help the Controller answer requests from individuals, including through the self-service deletion tools.
• Tell the Controller without undue delay after becoming aware of a personal data breach. [Lawyer: confirm notification timeframe required by UAE PDPL]
• Delete or return personal data when the service ends, unless the law requires it to be kept.

4. Sub-processors

The Controller authorises the sub-processors on the sub-processor list. We will announce changes on that page before they take effect. Where the Controller connects its own WhatsApp number, Meta acts under the Controller’s own agreement with Meta.

5. Transfers

Data is hosted outside the UAE. [Lawyer: confirm the transfer basis and any required safeguards]

6. The Controller’s commitments

• Have a lawful basis for putting customers in the queue and messaging them.
• Tell its customers how their data is used (a notice at the premises or on the ticket page).
• Not enter sensitive data, and not attempt to contact customers through the service for any purpose other than their visit.

7. Audit

On reasonable written request we will provide information needed to show compliance with this agreement. [Lawyer: confirm audit rights and frequency]