Data Processing Addendum

01Purpose and scope

This Data Processing Addendum ("DPA") applies where Insurance Gulf processes personal data on behalf of a partner, such as an insurer, reinsurer, TPA or broker ("the Partner"), in connection with an agreement for our services ("the Agreement"). It forms part of the Agreement.

For this processing the Partner is the controller and Insurance Gulf is the processor.

02Details of the processing

Subject matter: product development, underwriting support, policy administration, member enrolment, claims management support, distribution and related services under the Agreement.

Duration: the term of the Agreement and any period needed to return or delete data afterwards.

Data subjects: policyholders, members and their dependants, claimants, and staff of the Partner and its distributors.

Categories of data: identity and contact details, policy and payment details, and where required for health products, health and medical information.

03Our obligations as processor

• Process personal data only on the Partner's documented instructions, unless the law requires otherwise.
• Make sure everyone who handles the data is bound by confidentiality.
• Apply appropriate technical and organisational security measures, including access control, encryption in transit and regular review of those measures.
• Help the Partner respond to data subject requests and meet its obligations on security, breach notification and impact assessments.
• Notify the Partner without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Partner's data.

04Sub-processors

The Partner gives general authorisation for us to use sub-processors such as hosting and IT providers. We will tell the Partner before adding or replacing a sub-processor, giving it the chance to object, and we will impose data protection terms on each sub-processor that are no less protective than this DPA.

05International transfers

We will only transfer the Partner's personal data outside the UAE, the UK or the EU with appropriate safeguards in place under the applicable law, such as standard contractual clauses.

06Audits

We will make available the information needed to show compliance with this DPA and allow reasonable audits by the Partner or an auditor it appoints, with reasonable notice and subject to confidentiality.

07Return and deletion

When the Agreement ends, we will return or delete the Partner's personal data at its choice, unless the law requires us to keep it.

08Law and precedence

This DPA is governed by the law that governs the Agreement. If this DPA conflicts with the Agreement on data protection, this DPA prevails. To receive a copy for signature, email [email protected].