Data Processing Agreement

This agreement aims to regulate the relationship between Illevante Internet Services LLC, in its capacity as the “data processor” (Processor), and the customer, in its capacity as the “data controller” (Controller), with regard to the personal data the customer processes using our services.

This Data Processing Agreement forms an integral part of the agreements concluded between the customer (hereinafter the “Controller”) and Illevante Internet Services LLC (hereinafter the “Processor”), and rests on the laws in force in the Syrian Arab Republic and on the general international principles of personal data protection.

The following definitions are used in this Data Processing Agreement, whether they appear in the singular or the plural:

• Data controller (Controller): The natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• Personal data (Personal Data): Any information relating to an identified or identifiable natural person, directly or indirectly, that the Processor processes on the Controller’s behalf under this agreement, including the data of the Controller’s employees, its customers and/or its other contacts.
• Data subject (Data Subject): The natural person to whom the personal data relates.
• Processing (Processing): Any operation performed on personal data, such as collecting, recording, storing, altering, retrieving, using, transferring, disclosing, erasing or destroying it.
• Data processor (Processor): The legal entity that processes personal data on behalf of the Controller.
• Subprocessor (Subprocessor): A legal entity or person, not a member of the Processor’s staff, that is engaged or will be contracted by the Processor for the purpose of providing products or services to the Controller on the Processor’s behalf; this person or contracted entity may receive or access personal data for this purpose.

2.1. The Processor undertakes to process personal data on the instructions of the Controller, subject to the terms of this Data Processing Agreement. Data is processed solely for the purpose of storing the Controller’s data in the “Cloud”, related online services, network services and server hosting services (colocation), and for those purposes that can reasonably be connected with them or that are determined by mutual agreement.

2.2. The Controller decides which types of personal data it asks the Processor to process, and thereby also determines the (categories of) data subjects to whom this personal data relates; the Processor has no influence over this decision. In all cases, this concerns the personal data of the Controller’s customers and employees that the Controller stores with the Processor. The Processor refrains from using the personal data for any purpose other than that determined by the Controller. The Controller undertakes to inform the Processor of the purposes of the processing if they are not already stated in this Data Processing Agreement.

2.3. Personal data processed on the instructions of the Controller remains the property of the Controller and/or the data subjects concerned.

3.1. With regard to the processing operations referred to in Article 2, the Processor complies with the laws and regulations in force in the Syrian Arab Republic, in particular Law No. 12 of 2024 on the protection of personal data, and with the general international principles of personal data protection that the “Privacy Policy” sets out, including the Guidelines for the Regulation of Computerized Personal Data Files adopted by the United Nations General Assembly in 1990: lawful and fair processing, accurate data, a specified purpose, the data subject’s right of access, and security.

3.2. The Processor processes personal data only on the Controller’s documented instructions, including what the Controller asks for through its account or from the support team. If the Processor considers that an instruction of the Controller breaches the law, it informs the Controller.

3.3. The Processor’s obligations arising from this agreement also apply to any party that processes personal data under the Processor’s authority, including, without limitation, employees in the broadest sense, and each of them is bound to keep this data confidential.

4.1. The Processor processes personal data in the data center the Controller chooses for the service among the data centers we work with in Europe, the Middle East, North America and Asia, and does not transfer it to another country except on the Controller’s instructions, where this is needed to provide the service through a subprocessor under Article 6, or where the law requires it.

4.2. Wherever personal data is transferred, the Processor ensures that the recipient protects it at a level no lower than this agreement provides, taking into account the intended duration of the processing, the country of origin and the country of destination, the general and sectoral legal rules in force in the country concerned, and the professional rules and security measures applied there.

4.3. At the Controller’s request, the Processor informs it of the country or countries in which its data is processed.

5.1. The Processor provides the information technology resources needed for the processing, which the Controller may use for the purposes set out in Article 2. The Processor will not of its own accord carry out any processing except on the basis of the agreements concluded with the Controller.

5.2. With regard to all personal data and instructions given by the Controller to the Processor, the Controller warrants that it has the necessary authority and powers to do so. The Controller undertakes to indemnify the Processor against any form of damage and/or third-party claims that may arise from, relate to or be based on an allegation that the Controller was not authorized to provide certain personal data or to give specific instructions to the Processor.

6.1. The Processor engages subprocessors, a list of which is available on request, and the Controller hereby authorizes it to do so. If new subprocessors are engaged, the Processor will inform the Controller. If the Controller has justified objections to the engagement of particular subprocessors, an appropriate solution must be sought through consultation. If the parties are unable to reach an appropriate solution, the Controller may give notice to terminate the agreement if the use of a particular subprocessor of which it has been notified is unacceptable to it.

6.2. The subprocessors include our partner Illevante Cloud LLC (United Arab Emirates), where it takes part in providing the service the Controller orders, and it is bound by what this agreement provides.

6.3. The Processor ensures in all cases that these subprocessors are bound in writing by obligations similar to those agreed between the Controller and the Processor.

6.4. The Processor ensures the proper compliance of these subprocessors with the obligations in this Data Processing Agreement, and in the event of errors on their part, the Processor is itself liable for any and all damage or loss as if it had committed this error (or errors) itself.

7.1. The Processor undertakes to put in place and apply appropriate technical and organizational measures to secure personal data and protect it against loss or any form of unlawful processing, including unnecessary collection of data or its further processing.

7.2. The Processor ensures that the security measures described in “Annex A”, or otherwise agreed in writing, remain in force and in operation at all times.

8.1. The Processor undertakes to notify the Controller, without undue delay and, if possible, within twenty-four (24) hours, if the Processor discovers, or has reasonable grounds to suspect, the occurrence of unauthorized access to, or unauthorized acquisition, use, loss, theft, destruction or disclosure of, personal data (a “data breach”).

8.2. In the event of a data breach, the Processor completes the form in “Annex B” as accurately and completely as possible and sends it to the Controller.

8.3. The Processor cooperates with the Controller on any notice of the data breach the Controller may have to give to the competent authorities or to the data subjects, where the law requires it.

9.1. If a data subject sends the Processor a request to access, correct, complete, change, block or delete their data, or files a complaint with the Processor, the Processor refers the request or complaint to the Controller, and the Controller follows up on that request or complaint. The Processor may inform the data subject that it has done so.

9.2. The Processor helps the Controller, as far as is reasonable and the nature of the service allows, to respond to these requests.

10.1. The Processor undertakes to keep confidential all personal data it receives from the Controller, or to which it is given access by the Controller. The Processor may not disclose this data or make it available to third parties (other than permitted subprocessors) without obtaining the Controller’s prior written permission, unless disclosure of the personal data is required to an authority legally entitled to receive it (such as a competent judicial authority, or an authority Syrian law empowers to do so) on its written decision or request. In that case, the Processor informs the Controller unless the law or the requesting authority prevents it.

11.1. The Controller is entitled to arrange for a suitable external party acceptable to the Processor to carry out an audit to determine whether the Processor is complying fully and correctly with this Data Processing Agreement. This party is bound by confidentiality toward third parties.

11.2. When the audit is carried out, efforts are made to minimize any impact on the Processor’s business operations. Audits are carried out at most once a year and are announced at least fourteen (14) days before they take place.

11.3. The Processor undertakes to cooperate in the audit, and will provide as soon as possible any information and staff that may be reasonably relevant to the audit (including supporting information such as system logs).

11.4. If the audit shows that the Processor has materially failed to comply with this Data Processing Agreement, the Processor will, at its own expense, take all measures necessary to remedy any breach identified as quickly as possible. The Controller bears the costs of the external party carrying out the audit.

11.5. If the audit shows that the Processor has not failed to comply with this Data Processing Agreement, the Controller bears the costs of the audit (including the reasonable costs incurred by the Processor in cooperating with the audit).

12.1. This Data Processing Agreement remains in force for the term set out in the agreement concluded between the parties, and where no term is set, it applies at least for the whole period of their cooperation.

12.2. Upon termination of the services, the Controller is itself responsible for making copies of, exporting or otherwise retrieving in good time the personal data the Processor processes on its behalf. After termination of the Data Processing Agreement, the Processor deletes or destroys the Controller’s personal data, unless the law requires it to keep it.

12.3. The Processor is entitled to revise this Data Processing Agreement and any of its annexes from time to time. It undertakes to inform the Controller of the changes at least one (1) month before they take effect. The Controller may give notice of objection by the end of this month if it does not agree to the changes. If the Processor does not receive a notice of objection within this period, the changes are deemed accepted by the Controller.

13.1. This Data Processing Agreement and its performance are governed by the laws of the Syrian Arab Republic, subject to clause 13 “Governing law and dispute resolution” of the Terms and Conditions.

13.2. The parties seek to settle amicably any dispute arising between the Controller and the Processor in connection with this Data Processing Agreement, under clause 13 of the Terms and Conditions; failing that, the dispute is referred to the competent Syrian courts in the city of Aleppo.

• What type of incident occurred?
• What type of data was affected?
• In what way was the data compromised?
• When did the incident occur?
• What are the possible consequences of the incident for the Data Controller?
• What measures have been taken to end the incident and/or limit its consequences?
• What measures will be taken to end the incident and/or limit its consequences?
• What is the expected date for these measures to be carried out?

For any question about this agreement or about data processing, write to us or call us: