Data processing agreement

Last updated 2026-11-14

1. Who and what

This agreement is between the organization using AED Keeper (the customer, controller) and Ihab Tag, trading as Qamarita Lab (we, processor). It covers the personal data in the customer’s records in AED Keeper. It is part of our terms and applies automatically, with no signature needed. If it conflicts with the terms, this agreement wins on data protection.

2. The processing

We process the customer’s records to provide AED Keeper: storing sites, devices and checks; sending reminders and alerts; producing records and exports. We do this for as long as the customer’s organization exists, and then as section 9 says. The details are in Annex 1.

3. Instructions

We process the data only on the customer’s documented instructions. Those instructions are these terms, this agreement and what the customer does in the app. If the law requires other processing, we tell the customer first unless the law forbids it. If we think an instruction breaks data protection law, we say so.

4. Confidentiality

Everyone we allow to process the data is bound to keep it confidential.

5. Security

We keep the measures in Annex 2 and improve them as risks change.

6. Sub-processors

The customer authorizes the providers listed at /subprocessors. We give 30 days’ notice of a new one, on that page and by email to organization owners. An owner who objects on reasonable data protection grounds may end the subscription before the change, and we refund the unused prepaid part. Each sub-processor is bound by data protection terms at least as protective as these. We remain responsible for them.

7. Helping the customer

We help the customer, as far as we reasonably can:

  • answer requests from people exercising their rights. Most can be done in the app: export, correction and deletion;
  • with security, impact assessments and consultations with a supervisory authority (GDPR Articles 32 to 36).

8. Breaches

We tell the customer’s owners of a personal data breach without undue delay, and within 48 hours of becoming aware. We say what happened, what data and people are affected, and what we are doing about it. We add details as we learn them.

9. Deletion

The customer can export all its data at any time. When it deletes its organization, we delete the data at once, and our backups of it are gone within 30 days, unless the law requires us to keep it.

10. Audits

We make available the information needed to show we meet this agreement: this page, Annex 2, and answers to a reasonable questionnaire. If that isn’t enough, the customer may audit us once a year, with 30 days’ notice and at its own cost, or whenever a supervisory authority requires it.

11. International transfers

We operate from Egypt, and some sub-processors are in the United States. For transfers of personal data from the EU, the EU Standard Contractual Clauses (Commission Decision 2021/914) are incorporated by reference: Module 2 between the customer (exporter) and us (importer), and Module 3 for our sub-processors. The details:

  • Clause 7 (docking) applies.
  • Clause 9 option 2 (general authorization, with the notice in section 6).
  • Clause 11’s optional wording does not apply.
  • Clause 17: the law of Ireland.
  • Clause 18: the courts of Ireland.
  • The annexes are Annexes 1 and 2 here.

For transfers from the UK, the UK International Data Transfer Addendum (version B1.0) applies with those clauses. Either party may end the Addendum as its Section 19 allows. If these clauses conflict with the rest of this agreement, the clauses win.

12. Liability and law

Liability is as in the terms. Apart from the clauses in section 11, the governing law and courts are those in the terms.

Annex 1: details of the processing

  • People: the customer’s members (owners, admins, members); people who check its equipment; people it invites.
  • Data:
    • names and email addresses;
    • members’ roles and site assignments;
    • checker names entered on the check page, and optional photos of equipment;
    • check results and notes;
    • the log of who did what;
    • sign-in sessions.
    No special categories of data are intended. The check page asks only about equipment.
  • Purpose and nature: storing, organizing and displaying the records, sending emails about them, and producing exports and PDFs.
  • Duration: as long as the organization exists, then section 9. The log of who did what is kept 2 years.

Annex 2: security measures

  • Encryption in transit (TLS) on every connection.
  • Nightly backups, encrypted on our server before they leave it, with a key kept offline. Restore is tested.
  • Every organization’s data is separated by organization in every query, and an automated test suite proves no organization can read or change another’s data.
  • Codes on equipment labels are stored sealed with a dedicated key.
  • Sign-in by single-use email links or Google, with rate limits.
  • Roles: owner, admin and member. Members see only their assigned sites.
  • The operator panel sits behind an access gateway and its own password, with lockout.
  • No request logs. Error reports and usage statistics are stripped of personal data, ids and tokens before they leave our server.
  • Dependencies are kept up to date.
  • Access to the server is limited to the operator and our deploy pipeline, with key-based login only.