Data Processing Agreement

Draft — not yet reviewed by counsel.

This is a working draft prepared from what the inEspect platform actually does. It has not been reviewed by an Egyptian data protection lawyer and must be before it is offered to a customer or signed. Every commitment in it is one the system can meet today or is honestly marked as a gap.

inEspect is a product of Easy Audit, an Egyptian company whose activity is digital solutions. References to “we”, “us”, or “the operator” mean Easy Audit, which provides and operates this platform.

1. Parties and scope

This agreement is between:

• Easy Audit, an Egyptian company in digital solutions, operating the inEspect platform (“we”, “the Processor”); and
• the organization holding a subscription to inEspect (“you”, “the Controller”).

It forms part of, and is governed by, the inEspect Terms of Service. Where this agreement and the Terms disagree about personal data, this agreement wins.

It applies to personal data we process on your behalf when you use the platform. It does not apply to data for which we are the controller in our own right — account contacts, security logs, billing records — which are covered by our Privacy Policy.

2. Which of us is which

You are the controller of everything you put into the platform: forms, submissions, review files, evidence, CAPA-related records as features ship, and the people named in them. You decide what is collected, why, and who may see it.

We are the processor of that data. We act on your instructions and we do not decide what you collect or why.

We are a controller in our own right for a narrow set: account details of your users (name, email, role), security and audit logs the platform generates, and our billing records.

3. Your instructions

We process personal data only to provide the platform as described in the Terms; as you instruct through the product; as you instruct in writing for anything the product does not cover; and where a law we are subject to requires it (we tell you first unless forbidden).

We do not read your data except where necessary to provide support you asked for, or to investigate a security incident. We do not use it to train machine-learning models, and we do not sell it.

4. Confidentiality

Access to your data is limited to people who need it to run the service. Anybody with such access is under a confidentiality obligation. There are no shared operator login accounts.

5. Security

We keep appropriate technical and organisational measures, summarised on Security and in Annex-style detail below. We will not weaken these measures during the term. Gaps are named on the Security page rather than omitted.

6. Subprocessors

You give general authorisation for the subprocessors listed on Subprocessors (Neon, AWS, email SMTP, Paddle when live; Paymob later).

Before a new subprocessor begins handling your data we will update that page and, for enterprise customers who request it in writing, give at least 30 days' notice. Each subprocessor is bound by obligations no weaker than these, and we remain responsible to you for what they do.

7. Transfers outside Egypt

Your data is processed on Neon PostgreSQL and AWS (and related providers) that may be outside Egypt, as set out on Subprocessors.

Cross-border transfer licensing under Egyptian law may not yet be complete. We state this rather than omit it. It is being handled with counsel. If you need the transfer position resolved before you can sign, say so and we will tell you where the application stands.

8. Helping you with people's rights

If someone asks us directly about data you control, we do not answer for you. We pass the request to you, tell the person we have, and help you respond.

Signed-in users can use Privacy tools for personal JSON export and deletion requests. Requests about data we control we answer ourselves.

9. Breaches

If we become aware of a personal data breach affecting your data, we will tell you without undue delay of becoming aware, with what happened, what data is affected as far as we know, what we are doing, and what we advise you to do. See Incident / Breach Notice.

We will not notify your data subjects on your behalf unless you ask us to in writing.

10. Deletion and return

While your subscription is active, your administrators can delete records inside the product according to permissions.

When it ends, company and account deletion follow the published Deletion and Retention pages: human review, export where agreed, and honest treatment of backup rotation windows. We keep what a law requires and delete the rest.

11. Audits

We will answer your security questionnaire and give you, on request, the current subprocessor list and evidence of controls described on the Security page.

We hold no ISO 27001 or SOC 2 certification and no published penetration-test report for inEspect. Both are stated here so you do not ask for something that does not exist.

12. Liability and precedence

Liability under this agreement is governed by the Terms of Service. Order of precedence: this agreement, then the Terms, then anything else.

Annex — what is processed (summary)

Subject matter: provision of the inEspect quality operations platform.

Types of personal data: account details (name, email, role, password hash, MFA secret); technical (IP, user agent, session and sign-in records); staff details in quality records; free-form content in uploads.

Special categories: none is asked for and no field is designed for one. You undertake not to place special-category data in uploads without agreeing it with us first.

Children: business tool; we do not knowingly process data about anybody under 16.

Security measures in force: Argon2 passwords; MFA; lockout 5/30m; 12h idle sessions; session_version force-logout; tenant isolation; CSP; append-only audit log; TLS at Nginx; no card data in our database. Gaps are listed on Security.

Contact sales@inespect.com if you need a counsel-reviewed DPA for procurement. This page is not offered for signature in its present form.