Data Processing Agreement

1. Parties and how this agreement applies

This Data Processing Agreement ("DPA") is between the customer that uses Requify for its business ("Controller") and Array Dynamic FZE LLC, CWS-1V-229383, 26th Floor, Amber Gem Tower, Ajman, United Arab Emirates ("Processor"). It applies when the Controller stores personal data in Requify and the GDPR, or a law based on it, applies to that processing. It forms part of the Terms of Service; by accepting the Terms as a business customer, the Controller also accepts this DPA.

Customers who need a signed copy for their records can request one at info@requify.tech.

2. Subject, duration, nature and purpose

• Subject: providing the Requify platform for writing, reviewing, versioning and exporting requirements and documentation.
• Duration: as long as the Controller uses the Service, and until data is deleted under section 10.
• Nature: hosting, storing, displaying, exporting and, for AI features the Controller's users choose to use, analysing text.
• Purpose: only to provide the Service to the Controller.

3. Types of personal data and data subjects

Data subjects: the Controller's users (employees, contractors, invited reviewers) and people named in documents.

Types of data:

• account data: name, email address, role, organization membership;
• usage data: sign-in times, actions on projects (audit log), AI token usage;
• content: whatever personal data the Controller's users write into documents, comments and files.

The Service is not designed for special categories of data (Art. 9 GDPR). The Controller should not store such data in it.

4. Instructions

The Processor processes personal data only on documented instructions from the Controller. The Terms, this DPA and the Controller's use of the Service's settings are those instructions. If the Processor believes an instruction breaks data protection law, it tells the Controller. If law requires the Processor to process data otherwise, it tells the Controller first, unless the law forbids that.

5. Confidentiality

Everyone the Processor authorises to process personal data is bound to confidentiality. Access to customer data is limited to what is needed to run, support and secure the Service.

6. Security

The Processor takes the technical and organisational measures in Annex 1 (Art. 32 GDPR). It may improve them over time but will not lower the overall level of protection.

7. Sub-processors

The Controller authorises the sub-processors in Annex 2. The Processor binds each of them by contract to data protection obligations at least as protective as this DPA.

The Processor announces new or replaced sub-processors on this page and, for paying customers, by email at least 30 days in advance. The Controller can object on reasonable data protection grounds within that period; if no solution is found, the Controller may end the affected service, and fees paid in advance for the time after that are refunded.

8. Transfers outside the EU/EEA

The database and file storage are located in Frankfurt, Germany, and the server functions run in Frankfurt. Some sub-processors are based outside the EU/EEA (Annex 2). Transfers rely on the safeguards of Chapter V GDPR, in particular the European Commission's Standard Contractual Clauses in the sub-processors' data processing agreements.

AI features: on the Standard AI region (the default), text sent to AI features is processed by DeepSeek in China, which is not covered by an EU adequacy decision. The Controller can switch a workspace to the EU AI region (Settings → AI usage); AI processing then uses only Mistral AI in France, with no fallback to other providers. Controllers subject to the GDPR should use the EU AI region for personal data.

9. Assistance

• Data subject requests: the Service lets the Controller export and delete data; the Processor helps with requests the Controller cannot handle itself.
• Personal data breaches: the Processor notifies the Controller without undue delay after becoming aware of a breach affecting the Controller's data, with the information it has, so the Controller can meet its own deadlines.
• Impact assessments and authorities: the Processor provides the information it reasonably can for data protection impact assessments and consultations with supervisory authorities.

10. Deletion and return

The Controller can export its documents at any time. When the Controller deletes its account or organization in the Service, the Processor deletes the related data from the live database and file storage. Copies that exist only in backups of the database provider are removed when those backups expire. Data the Processor must keep by law (for example invoices) is kept only as long as required.

11. Information and audits

The Processor makes available the information needed to show compliance with Art. 28 GDPR, including this DPA, Annex 1 and the certificates and reports its sub-processors publish. If that is not enough, the Controller may audit by written questionnaire, or on site with 30 days' notice, at most once a year unless a breach or an authority requires more. Each party bears its own costs.

12. Liability and final provisions

Liability is governed by the Terms of Service, without limiting liability under Art. 82 GDPR towards data subjects. If this DPA conflicts with the Terms on the protection of personal data, this DPA prevails.

Annex 1 – Technical and organisational measures

Location and hosting

• Database (MongoDB Atlas) and file storage (AWS S3) in Frankfurt, Germany; server functions in Frankfurt.
• Physical security of the data centres is provided by the hosting providers under their own certifications.

Access control

• Sign-in through Clerk; passwords are never stored by Requify.
• Every request is checked on the server for the user's organization and role; organizations cannot see each other's data (covered by automated tests).
• Organization roles (owner, admin, project manager, editor, viewer) plus project roles and per-section assignments limit who can read and change what.
• Review workflow: approved or in-review sections are protected from changes by other users.
• API keys for integrations are stored hashed and can be revoked.

Transmission and storage

• HTTPS only, enforced with HTTP Strict Transport Security.
• Security headers against embedding and content injection (Content-Security-Policy, X-Frame-Options, X-Content-Type-Options).
• Shared review links use random tokens, can expire or be switched off, and are excluded from search engines.

Input control and integrity

• Audit log of important actions (for example creating, changing and deleting projects, role changes).
• Version history and baselines of documents; deleted pages go to a trash first.

Availability

• Health checks of the database, email, queue and AI providers every 5 minutes, with alerts to the operator.
• Rate limits on sensitive endpoints.
• Availability commitment for paid plans in the Service Level Agreement.

Data minimisation and separation

• AI features send only the text the user submits and the related project context.
• Per-workspace choice of AI region; the EU region never falls back to providers outside the EU.
• Data export and account deletion are available to users in the Service.

Organisation

• Sub-processors are bound by data processing agreements (Annex 2).
• The application has an automated test suite that is run before changes are released.

Annex 2 – Sub-processors