1. Roles and scope
This agreement forms part of the Terms and Conditions and applies to personal data the Customer or its Users enter in the workspace, such as traveler, employee and contact data.
The Customer is the controller and ARM is the processor acting on its behalf.
2. Processing on instructions
ARM processes the data only to provide the services on the Customer’s documented instructions, including the settings it makes in the system, uses it for no other purpose, and tells the Customer if it believes an instruction breaks the law.
3. Confidentiality and personnel
ARM limits data access to staff who need it to provide the service or support and who are bound by confidentiality.
4. Security measures
- Encrypted connections between the browser and the service (HTTPS).
- Each customer’s data separated in its own workspace, with user permissions set by the Customer.
- Restricted and reviewed administrative access, with keys and secrets kept on servers only.
- System monitoring and security updates.
5. Sub-processors
The Customer authorizes ARM to use the sub-processors on the Sub-processors list. ARM binds them to protection obligations at least equal to this agreement, publishes any change to the list 30 days before it takes effect, and the Customer may object on reasonable grounds.
6. Transfers outside the Kingdom
ARM transfers personal data outside the Kingdom only in line with the Personal Data Protection Law and the Regulation on Personal Data Transfer outside the Kingdom, limited to what is necessary and with appropriate safeguards.
7. Assistance and data subject requests
ARM reasonably helps the Customer respond to data subject requests (access, correction, destruction) and forwards to the Customer any request it receives directly about the Customer’s data.
8. Personal data breaches
ARM notifies the Customer without undue delay after becoming aware of a breach affecting its data, with the available information about its nature, impact and the measures taken, so the Customer can meet its duty to notify the Saudi Data and AI Authority within 72 hours.
9. End of service
When the subscription ends, the Customer may request a copy of its data in a common format within 30 days. ARM then deletes the data within 90 days of the end of the subscription, including backups on their next cycle, except where the law requires retention.
10. Information and audits
On reasonable request, ARM provides the information needed to show compliance with this agreement. Requests: support@armtrips.com.