Data Processing Addendum

Data Processing Addendum

Univia Tax — UAE Tax Compliance & Business Records

Effective date: 4 August 2026 · Last updated: 19 Jul 2026

[REQUIRES QUALIFIED LEGAL REVIEW] — this entire document creates binding data protection obligations, allocates breach and audit risk, and asserts positions about UAE Federal Decree-Law No. 45 of 2021 (the PDPL) including its cross-border transfer regime. It must be reviewed by qualified counsel before it is offered to any customer, and re-checked against the PDPL's Executive Regulations.

This Addendum forms part of the Terms of Use between Univia Global Consultancy ("Univia", "Processor") and the customer ("you", "Controller"). It applies where Univia processes personal data on your behalf. Where it conflicts with the Terms of Use on a data protection matter, this Addendum prevails.

Accounting firms, and any customer processing personal data of its own clients, customers, suppliers, or employees in the Service, should read this document rather than assume the Privacy Notice covers them.

1. Roles

1.1 You are the Controller of the personal data contained in your business records in the Service — your customers, suppliers, employees, and (if you are a firm) your clients and their contacts. You determine why and how it is processed. You are responsible for having a lawful basis to process it and to disclose it to Univia.

1.2 Univia is the Processor of that data. Univia processes it only on your documented instructions.

1.3 Univia is an independent Controller of the data about you as its customer — your account, billing, support, and usage data. That processing is governed by the Privacy Notice, not by this Addendum.

1.4 Where you are yourself a processor for your own client (for example, a firm acting for a taxpayer), Univia is a sub-processor. You confirm you have your client's authority to appoint Univia and that your contract with your client permits it.

2. Your instructions

2.1 Documented instructions. Univia's instructions are: the Terms of Use, this Addendum, the configuration and settings you select in the Service, and the operations you and your users perform in it. Univia will not process personal data for any other purpose.

2.2 Univia will notify you if, in its opinion, an instruction breaches applicable data protection law, and may suspend that processing.

2.3 Univia may process personal data where required to do so by law, and will inform you before doing so unless the law prohibits it.

2.4 You warrant that: your instructions are lawful; you have a lawful basis for the processing; you have given the required notices to data subjects; and you have obtained any consent required.

3. Subject matter of the processing

4. Confidentiality and personnel

4.1 Univia will ensure that everyone authorised to process personal data under this Addendum is bound by a written confidentiality obligation that survives the end of their engagement.

4.2 Access to customer personal data by Univia personnel and contractors is limited to those who need it for a defined task, and is governed by docs/legal/employee-and-contractor-access-terms.md.

4.3 Univia will ensure such personnel receive appropriate data protection training.

5. Security measures

5.1 Univia implements appropriate technical and organisational measures, taking account of the state of the art, the cost of implementation, and the nature, scope, and risk of the processing. The measures in force as at the date of this Addendum are:

Encryption and transport

• HTTPS enforced throughout, with HTTP Strict Transport Security applied for two years including subdomains.

• Data encrypted at rest by the database and object storage providers.

• Passwords stored only as bcrypt hashes.

Access control and tenant isolation

• Authentication enforced by middleware across every application route.

• JWT sessions capped at 14 days; cookies marked Secure in production with hardened cookie prefixes.

• Every data access query is scoped to the acting user and their companies, through the ownership chain.

• Cross-tenant isolation is covered by a mandatory automated test suite for each data table; a table shipped without its isolation suite fails code review by definition.

• PostgreSQL row-level security policies are deployed and forced across all 38 application tables. Their current activation is partial — they are enforced at the database on the document presign, document confirm, and chat routes when the tenant-context setting is enabled; on other routes isolation remains enforced at the query layer. This is stated openly rather than overclaimed.

Uploads

• Files go directly from the browser to object storage using short-lived presigned URLs; they never pass through the application server.

• A 25 MB size cap and a fixed accepted-file-type list (PDF, Excel, CSV, PNG, JPEG, WebP).

• The leading bytes of every file are verified against the declared file type before any processing; a mismatch fails the document and writes an audit event.

• A malware scanning integration is supported. Where no scanning service is configured, every document is recorded honestly as "not scanned" and the status is shown in the document list. Univia never records a scan that did not happen.

Application hardening

• An enforced Content Security Policy permitting no external script host, with framing denied, object sources blocked, and a restrictive permissions policy.

• Rate limiting on login, registration, upload presign, document confirmation, chat, import commit, and e-invoicing submission.

Integrity and recovery

• An audit trail recording the acting user, company, entity, action, metadata, and timestamp.

• An amendment trail on records: a change writes the original value, the new value, the user, the timestamp, and the reason. Records included in a signed-off return become immutable; corrections are made by issuing a new record, never by mutation.

• Point-in-time recovery from the database provider's write-ahead log history.

5.2 Residual risks are published, not hidden. Univia maintains an honest record of known security limitations at docs/security/HARDENING.md, summarised for customers in docs/legal/security-and-incident-notice.md. Univia will not represent a control as being in force when it is not.

5.3 Univia may update its security measures, provided it does not materially reduce the overall level of protection.

6. Subprocessors

6.1 You give Univia general written authorisation to appoint subprocessors, subject to this clause.

6.2 Univia will impose on each subprocessor data protection obligations no less protective than those in this Addendum, and remains fully liable to you for each subprocessor's performance.

6.3 Current subprocessors as at 19 Jul 2026:

6.4 Change notice. Univia will give you at least 30 days' notice before adding or replacing a subprocessor, by email to your registered address and by updating this Addendum. [PRODUCT FOLLOW-UP — a subscribable subprocessor change list at a public URL is the standard mechanism and should be built.]

6.5 Objection. You may object to a new subprocessor on reasonable data protection grounds within the notice period. Univia will work with you in good faith to find an alternative. Where no reasonable alternative exists, you may terminate the affected Service on notice before the change takes effect, and Univia will refund prepaid unused fees pro rata. That is your sole remedy.

7. Cross-border transfers

[REQUIRES QUALIFIED LEGAL REVIEW]

7.1 Providing the Service necessarily transfers personal data outside the UAE. In particular, document content and AI assistant messages are transferred to the AI subprocessor, which processes them outside the UAE. Payment, email, job orchestration, and hosting also involve non-UAE providers.

7.2 Uploaded document files are stored in the UAE (AWS me-central-1). The transfer to the AI subprocessor is for processing, not primary storage.

7.3 Univia effects such transfers in accordance with Articles 22 and 23 of the PDPL, relying on [TRANSFER MECHANISM — CONFIRM WITH COUNSEL per destination: adequacy under Art. 22; or contractual safeguards, necessity for performance of the contract, or explicit consent under Art. 23], and has executed data processing agreements containing appropriate safeguards with each subprocessor [CONFIRM — each executed DPA must be collected and filed before this clause is relied on].

7.4 No training on your data. Univia's arrangements with its AI subprocessor prohibit the use of your data to train, fine-tune, or improve any model. Data is sent only to fulfil the request that generated it.

7.5 You acknowledge that clause 7.1 is material and that you have taken it into account in your own transfer assessment as Controller.

8. Data subject rights, and assistance to you

8.1 Univia will, taking into account the nature of the processing, provide reasonable assistance by appropriate technical and organisational measures to help you respond to data subject requests for access, rectification, erasure, restriction, portability, and objection. Much of this is self-service: you can search, view, edit, export, and delete records in the Service directly.

8.2 If Univia receives a request directly from a data subject relating to data it processes on your behalf, Univia will not respond substantively but will refer the request to you without undue delay, unless legally required to respond.

8.3 Univia will provide reasonable assistance with data protection impact assessments and prior consultations with the UAE Data Office, so far as the information is available to Univia and the assistance relates to Univia's processing.

8.4 Assistance under this clause is provided at no charge for reasonable volumes. Univia may charge its reasonable costs for assistance that is disproportionate or repetitive, on prior notice.

9. Retention, return, and deletion

9.1 Univia processes personal data for the term of the Terms of Use.

9.2 On termination, Univia will make your data available for export in the formats the Service supports for 30 days, unless an order form provides a different period or law requires longer retention.

9.3 At the end of that period, and at your written election, Univia will delete or return the personal data it processes on your behalf, and delete existing copies, except where retention is required by law.

9.4 Backups. Deleted data persists in point-in-time recovery backups until those backups roll out of the provider's retention window. During that period the data remains protected by this Addendum and is not restored except in a recovery event.

9.5 Integrity records retained. Audit events recording who did what and when, and amendment trails, are retained for integrity purposes and are not deleted with the underlying record. They are minimised: they record the action, not the content.

[REQUIRES QUALIFIED LEGAL REVIEW] — a deletion instruction may conflict with the Controller's own statutory record-keeping obligation under UAE tax law. Counsel should confirm whether Univia should warn the Controller before actioning a full deletion, and whether a minimum retention floor should be contractually imposed.

10. Personal data breach

[REQUIRES QUALIFIED LEGAL REVIEW] — notification timing and content must be aligned with the PDPL and its Executive Regulations.

10.1 Univia will notify you without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach affecting personal data it processes on your behalf. The 72-hour period is a contractual commitment by Univia; it is not a statement of the statutory notification period, which counsel must confirm against the PDPL and its Executive Regulations.

10.2 The notification will describe, so far as known at the time: the nature of the breach; the categories and approximate number of data subjects and records affected; the likely consequences; the measures taken or proposed to address it and mitigate its effects; and a contact point for further information. Where the full picture is not available, Univia will provide information in phases without further undue delay.

10.3 Univia will take reasonable steps to contain and remediate the breach and will preserve evidence.

10.4 Notification to the UAE Data Office and to data subjects is your responsibility as Controller. Univia will provide reasonable assistance and will not make a public statement identifying you without prior consultation, unless legally required.

10.5 A notification under this clause is not an admission of fault or liability.

11. Audit and evidence

[REQUIRES QUALIFIED LEGAL REVIEW] — the scope of audit rights granted here is a commercial as well as a legal decision.

11.1 Univia will make available to you the information reasonably necessary to demonstrate compliance with this Addendum. In the first instance this is satisfied by: this Addendum; the security notice at docs/legal/security-and-incident-notice.md; the published residual-risk record; the internal access terms; and Univia's written responses to your security questionnaire.

11.2 Where that information is genuinely insufficient, you may audit Univia's compliance, subject to: at least 30 days' written notice; no more than once in any 12-month period (unless required by a regulator or following a personal data breach affecting you); conduct during business hours in a manner that does not disrupt Univia's operations; use of an independent auditor who is not a competitor of Univia and who signs a confidentiality undertaking; scope limited to Univia's processing of your personal data; and no access to other customers' data, to Univia's source code, or to any premises or systems of a subprocessor.

11.3 You bear the cost of an audit, unless it reveals a material breach of this Addendum by Univia, in which case Univia bears its reasonable cost.

11.4 Where Univia obtains a third-party security certification or attestation, providing the report will satisfy an audit request for the period it covers. [STATUS — no formal certification or attestation exists as at 19 Jul 2026. ISO 27001 readiness work is in progress and unmerged.]

12. Liability

12.1 Each party's liability under this Addendum is subject to the limitation of liability in clause 16 of the Terms of Use, except to the extent that limitation is not permitted by applicable data protection law.

[REQUIRES QUALIFIED LEGAL REVIEW] — whether a liability cap may lawfully limit exposure for a data protection breach under the PDPL, and whether a separate super-cap for data protection claims should be negotiated, requires counsel's view. Enterprise and firm customers will negotiate this clause.

13. General

13.1 This Addendum takes effect on the effective date of the Terms of Use and continues while Univia processes personal data on your behalf.

13.2 Clauses 4, 9, 10, 11, and 12 survive termination.

13.3 Governing law and dispute resolution are as set out in clause 18 of the Terms of Use: UAE federal law as applied in Dubai, with Dubai Courts subject to mandatory rights.

13.4 If any provision is unenforceable, it is modified to the minimum extent necessary or severed; the remainder is unaffected.

Univia Global Consultancy — Univia Global Consultancy L.L.C-FZ, Trade Licence No. 2534238.01, Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates · Data contact: support@univiaglobal.com