Data Processing Agreement

Parties

Incorporation. This DPA forms part of, and is governed by, the SimpleX Terms of Service, for every Customer: accepting the Terms of Service accepts this DPA, and no separate signature is required. Where the two conflict on the processing of personal data, this DPA prevails.

Effective date. The date the Customer accepts the Terms of Service, or the date this DPA is countersigned, whichever is earlier.

1. Subject matter, nature and purpose

Simplify processes personal data solely to provide the SimpleX platform to the Customer: accounting, invoicing, inventory, reporting, tax and VAT functionality, and the AI financial insights described in §7 — together with the hosting, storage, backup, support and incident response that serve them.

Simplify processes that data only on the Customer's documented instructions. Those instructions are: this DPA, the Terms of Service, and the Customer's ordinary use of the platform's features.

2. Duration

For as long as the Customer's subscription is live, and thereafter only until the data is returned or deleted under §13.

3. Categories of data subject and personal data

Data subjects. The Customer's own staff and platform users; the Customer's customers, vendors and business contacts; the Customer's salespersons.

Personal data. Names, email addresses, telephone numbers, billing and shipping addresses, VAT registration numbers, contact and company identifiers, and the transactional records that reference them — invoices, quotations, bills, expenses, payments, credit and debit notes, journal entries.

Special-category data is not intentionally processed, and the platform provides no field for it. The Customer must not use free-text fields — notes, descriptions, terms — to record health, biometric, religious, political or similar data.

4. Roles and instructions

The Customer determines the purposes and means of processing and warrants that it has a lawful basis for the data it enters — including for the personal data of its own customers and vendors, whom Simplify never contacts directly and with whom it has no relationship.

Simplify will inform the Customer if, in its opinion, an instruction infringes the PDPL or other applicable data-protection law. Simplify is not obliged to provide legal advice, and that assessment is not a legal opinion.

5. Confidentiality

Simplify ensures that every person authorised to process the Customer's personal data is bound by a duty of confidentiality that survives the end of their engagement.

6. Security

Simplify implements the technical and organisational measures in Annex A. Those measures are described as actually implemented, not as aspirations.

Simplify may update the measures over time provided the overall level of protection is not reduced.

7. AI financial insights

The insight features — cash-flow prediction, expense trends, profitability analysis, payment-delay and unusual-spend alerts — operate on the Customer's own data and return it to the Customer in summarised form. They do not produce legal or similarly significant effects concerning any individual, they do not score or profile individuals, and their output is returned only to the Customer's own tenant.

AI features are off unless the Customer switches them on. Four features can use an external AI model: the wording of insights, the notes beside reports, bank-reconciliation match suggestions (including reading the columns of an uploaded bank statement), and Arabic ↔ English item-name translation. They are off for every Customer until the Customer's owner or an administrator switches them on under Settings → Data & privacy, which displays what each feature sends. While they are on, the data each feature needs is sent to Anthropic (Annex B) to produce wording or suggestions. For insights, report notes and bank reconciliation, customer and vendor names are replaced with placeholders before sending, and any other text on a bank statement is sent as it appears on the statement; a translation sends only the item name to be translated. The Customer may switch them off at any time, and nothing is sent while they are off. Every change is recorded in the Customer's audit log.

8. Sub-processors

The Customer gives Simplify general authorisation to engage the sub-processors listed in Annex B.

Simplify imposes data-protection obligations on each sub-processor no less protective than those in this DPA, and remains fully liable to the Customer for their performance.

Simplify keeps the current list at www.simplexnow.com/privacy#who-else-touches-the-data and gives the Customer 30 days' notice before adding or replacing a sub-processor. The Customer may object on reasonable data-protection grounds; if the objection cannot be resolved, the Customer may terminate the affected service.

9. International transfers

Bahrain imposes no general data-localisation requirement on accounting software of this kind, so SimpleX is hosted outside Bahrain: its database and its application servers are in Frankfurt, Germany, in the European Union, and attached files are stored in the European Union. Annex B gives the location of every sub-processor.

Where a transfer leaves an adequate jurisdiction, Simplify relies on a lawful basis under PDPL Article 12 — adequacy, authorisation, or an Article 13 exception — together with contractual safeguards with the sub-processor concerned.

10. Assisting the Customer with data-subject rights

The platform provides the Customer with self-service tooling, so most requests need no involvement from Simplify at all:

• Access and portability — under Settings → Data & privacy, the Customer can download its data in a structured, machine-readable form.
• Erasure — under Settings → Data & privacy, a user can close their own account, which anonymises the personal data held about that user.
• Rectification — the Customer edits contact and user records directly.

Where a request cannot be satisfied through that tooling, Simplify will provide reasonable assistance, taking into account the nature of the processing.

An important limit. Financial records cannot be physically deleted: Bahraini VAT law requires them to be retained, and the platform enforces this by design — invoices, bills, payments, journals and credit notes are never hard-deleted, only voided or cancelled. Where an erasure request touches such a record, Simplify pseudonymises the personal data in place and retains the transactional record for the statutory period alone.

11. Personal-data breach

Simplify notifies the Customer without undue delay and in any event within 72 hours of becoming aware of a personal-data breach affecting the Customer's data, with: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.

The Customer is responsible for notifying the Personal Data Protection Authority and affected data subjects where the law requires it.

12. Audit

Simplify makes available to the Customer the information reasonably necessary to demonstrate compliance with this DPA.

13. Return and deletion

When the Customer's subscription ends, the Customer keeps read-only access to its data, with no time limit, and can export it at any time. Simplify keeps the Customer's personal data until the Customer instructs its deletion. On that instruction, at the Customer's choice, Simplify returns the personal data in a structured format or deletes it, together with existing copies — except records subject to a legal retention duty, which are retained for ten years for that purpose only and remain protected by this DPA for as long as they are held.

Deletion takes effect in the live database at once. The database provider also keeps a restore history of up to seven days, so deleted data is gone from that history within seven days. Files the Customer attaches to its records are kept for ten years from the day they are attached, under a retention lock, even if they are later removed from a record, and are deleted when that period ends.

14. Liability and governing law

Liability is subject to the limitations in the Terms of Service. This DPA is governed by the laws of the Kingdom of Bahrain, and the courts of the Kingdom of Bahrain have exclusive jurisdiction over any dispute arising from it.

Annex A — Technical and organisational measures

Each measure below is implemented in the platform today unless marked otherwise.

Tenant isolation. Dual-layer and deliberately redundant: every query is scoped to the Customer's own company in application code, and PostgreSQL Row-Level Security enforces the same at the database. Production runs under a non-bypass database role, so RLS cannot be sidestepped even by the application.

Encryption. In transit via TLS, with HSTS. At rest via the managed database provider and the file-storage provider.

Access control. Short-lived access tokens (15 minutes) with rotating refresh tokens; sign-out revokes both the refresh token and the access token via a server-side denylist, so a signed-out session is rejected immediately rather than living out its expiry. Optional two-factor authentication (TOTP), with the secret stored encrypted. Role-based access control with least privilege. Platform-administrator access is separated from tenant access.

Auditability. An append-only audit log records every financial mutation and privileged action — who, what, when, and from where.

Personal-data minimisation in logs. Passwords, tokens, bank account numbers, IBAN/BIC, VAT registration numbers and card numbers are never logged. Credential-grade query parameters are stripped before anything reaches the error-monitoring service.

Secure development. Mandatory code review; an automated pipeline running linting, type-checking, tests and a coverage floor that cannot be lowered; secret scanning and dependency vulnerability scanning on every change.

Resilience. Point-in-time restore of the database, from a restore history the database provider keeps for up to seven days. Attached files are protected from deletion by a ten-year retention lock.

Monitoring. Health probes for the API and the database. Unexpected server errors and browser errors are reported to GlitchTip (Annex B) with the user's and company's identifiers only, never their names or email addresses. Users' screens are not recorded: a financial application's screens carry personal data.

Annex B — Authorised sub-processors