Data Processing Agreement

Effective: 19 October 2026 · Version: 1.3

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Mivi Tech Labs L.L.C. ("Processor", "we", "us") and the subscribing company ("Controller", "you").

It applies whenever we process personal data on your behalf. Where this DPA conflicts with the Terms of Service on anything concerning personal data, this DPA prevails.

1. Definitions

Terms used here have the meaning given in the Personal Data Protection Law promulgated by Royal Decree 6/2022, as amended by Royal Decree 68/2026, and its Executive Regulation issued by Ministerial Decision 34/2024 (together, "the PDPL").

• Personal Data — data by which a natural person is identified or identifiable, as defined in Article 1 of the Law
• Sensitive Personal Data — the categories listed in Article 5 of the Law
• Processing — any operation performed on Personal Data
• Data Subject — the natural person to whom the Personal Data relates
• Sub-processor — a third party engaged by us to process Personal Data on your behalf
• Personal Data Breach — a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data
• the Ministry — the Ministry of Transport, Communications and Information Technology of the Sultanate of Oman (MTCIT)

2. Roles

2.1 You are the Controller. You determine the purposes and means of processing the Personal Data you put into BinaFlo. You remain answerable for it under the PDPL.

2.2 We are the Processor. We process that Personal Data only on your documented instructions.

2.3 For Personal Data about your own account administrators, and about visitors to our website, we act as Controller in our own right. That processing is governed by our Privacy Policy and is outside this DPA.

2.4 Neither party is a joint controller with the other.

3. Scope and instructions

3.1 We process Personal Data only:

• to provide, maintain and support BinaFlo under the Terms of Service;
• on your further documented instructions, where they are consistent with the Terms of Service and this DPA; and
• where required by a law to which we are subject — in which case we will tell you before processing, unless that law prohibits us from doing so on important grounds of public interest.

3.2 Your instructions are given by: this DPA, the Terms of Service, your configuration of the software, and the actions your authorised users take within it.

3.3 We will tell you if, in our opinion, an instruction infringes the PDPL. We may suspend performance of that instruction until it is withdrawn or amended.

3.4 We will not:

• process Personal Data for our own purposes;
• sell, rent or trade it;
• use it for advertising, profiling or market research;
• use it to train machine learning or artificial intelligence models;
• disclose it to any third party except as clause 8 permits or as clause 5.6 requires.

3.5 We may produce aggregated and anonymised statistics about how BinaFlo is used, and use them to improve and market the product, provided the result is no longer Personal Data and cannot be re-identified, and provided it does not identify you.

4. Duration

This DPA applies from the effective date of your subscription until we have deleted or returned all Personal Data under clause 12. Clauses 6, 11, 12, 13 and 15 survive termination.

5. Our obligations

5.1 Lawful processing. We process only in accordance with the PDPL and this DPA.

5.2 Confidentiality (Article 21). Everyone we authorise to process Personal Data is bound by a written confidentiality obligation that survives the end of their engagement, and is trained on their obligations.

5.3 Least privilege. Access is limited to personnel who need it to provide or support the service. Administrative access is logged.

5.4 Security (Article 13). We implement and maintain the measures in Schedule 2, appropriate to the nature of the data and the risk.

5.5 Records (Article 17). We keep records of the processing we carry out for you, and provide them on request.

5.6 Government and legal demands. If we receive a legally binding demand for your Personal Data from any authority, we will:

• tell you immediately, unless legally prohibited;
• where prohibited, use reasonable lawful efforts to obtain a waiver of that prohibition, and record our efforts;
• challenge any demand that appears unlawful, overbroad or not compliant with due process;
• disclose only the minimum the demand actually compels.

5.7 Cooperation (Article 18). We cooperate with the Ministry as the Law requires, and support you in doing so.

5.8 Data Protection Officer (Article 20). We have appointed one and publish the contact details, which are in our Privacy Policy.

5.9 External audit (Article 16). We appoint an independent auditor to verify our compliance where the Law requires, and will provide the resulting report or a summary on request.

6. Sub-processors

6.1 You give general authorisation for us to engage the Sub-processors listed in Schedule 3.

6.2 Before adding or replacing a Sub-processor, we will give you at least 30 days' written notice, naming the Sub-processor, what it will do, and where it is located.

6.3 You may object on reasonable data protection grounds within those 30 days. If you do, we will work with you in good faith to find an alternative. If we cannot within a further 30 days, you may terminate the affected part of the subscription and we will refund prepaid fees for the unused period. We will not treat an objection as a breach of the Terms.

6.4 Every Sub-processor is engaged under a written contract imposing obligations no less protective than this DPA, including security, confidentiality, breach notification and transfer restrictions.

6.5 We remain fully liable to you for a Sub-processor's performance as if it were our own.

7. Transfers outside Oman

This clause matters more than any other in this DPA. Article 29 of the Law makes an unlawful transfer punishable by a fine of OMR 100,000 to OMR 500,000. By comparison, Article 28 provides for a fine of OMR 15,000 to OMR 20,000, and Article 30 for a fine of OMR 5,000 to OMR 100,000 where the offender is a legal person.

7.1 The position. We are not established in Oman and we do not operate servers in Oman. Providing BinaFlo necessarily involves transferring Personal Data outside the Sultanate. Schedule 3 states where.

7.2 Article 23 of the Law permits transfer in accordance with the controls in the Executive Regulation, and prohibits it where the data has been processed in violation of the Law or where the transfer would harm the Data Subject.

7.3 What we do, under Executive Regulation Articles 37–40:

7.4 Prior Ministry approval is not required for transfers of this kind, and none has been obtained. There is no adequacy list or approved-country list under Omani law; the assessment is made and documented by the controller and processor.

7.5 We will not transfer Personal Data to a destination not listed in Schedule 3 without following clause 6.2.

7.6 If a destination's law changes so that the Schedule 5 conclusion no longer holds, we will tell you without undue delay and either implement additional safeguards, move the data, or — if neither is possible — give you the right to terminate under clause 6.3.

8. Data Subject rights

8.1 Article 11 gives Data Subjects the rights to withdraw consent, to rectification, to access, to portability, to erasure and to breach notification. Article 14 gives the right to object to automated decisions.

8.2 You are responsible for responding to your Data Subjects, because you are the Controller.

8.3 We assist you by:

• providing self-service functions in BinaFlo to search, view, correct, export and delete records, which will satisfy most requests without needing us at all;
• responding to a request for assistance from you within 10 working days, so that you can meet your own deadline;
• providing exports in a structured, commonly used, machine-readable format for portability requests.

8.4 If a Data Subject contacts us directly about data we process for you, we will not respond substantively. We will forward the request to you without undue delay and tell the Data Subject that we have done so and that you are the Controller.

8.5 The Executive Regulation requires a Controller to respond to a Data Subject request within 45 days, free of charge. Our 10-working-day assistance window is set to leave you time inside it.

8.6 We do not charge for this assistance unless requests are manifestly excessive or repetitive, in which case we will agree a reasonable fee with you in advance.

9. Personal Data Breach

9.1 We notify you without undue delay and in any event within 24 hours of becoming aware of a Personal Data Breach affecting your Personal Data.

We set our own deadline at 24 hours because your obligations to the Ministry and to your Data Subjects run to 72 hours under Executive Regulation Articles 30 and 32, and you cannot meet them if we are slow.

9.2 Our notification will include, so far as known:

• what happened and when we became aware
• the categories and approximate number of Data Subjects and records affected
• the likely consequences
• what we have done and propose to do
• a contact point for more information

We will not delay an initial notification because the picture is incomplete. We will follow up in stages.

9.3 We assist you in making your own notifications to the Ministry and to Data Subjects, including by providing information you reasonably need.

9.4 We do not notify your Data Subjects directly unless you instruct us to in writing, or unless we are independently required to by law.

9.5 We keep a record of every breach, its effects and the remedial action, and make it available to you.

9.6 We will not condition, delay or restrict a notification under this clause on you agreeing to any waiver, release or limitation of liability.

10. Data protection impact assessments

We provide reasonable assistance if you carry out a data protection impact assessment or need to consult the Ministry, taking into account what we know about the processing. This includes the information in Schedules 1 to 5 and reasonable answers to written questions.

11. Audit

11.1 We make available the information reasonably necessary to demonstrate compliance with this DPA, including Schedules 1 to 5, our security documentation, and any external audit report obtained under clause 5.9.

11.2 You may audit us — yourself or through an independent auditor who is not our competitor and who signs a confidentiality undertaking — on 30 days' written notice, no more than once in any 12 months, unless a Personal Data Breach has occurred or the Ministry requires it, in which case the limit does not apply.

11.3 An audit takes place during business hours, does not unreasonably disrupt the service, and does not extend to data belonging to any other customer or to our commercially sensitive information beyond what is necessary.

11.4 You bear your own audit costs. If an audit finds a material breach of this DPA by us, we bear the reasonable cost of the audit and of remediation.

12. Return and deletion

12.1 On termination, and at any time on your written request, we will delete or return your Personal Data at your choice.

12.2 Unless you instruct otherwise, the account is read-only and we retain the data so you can export it: 90 days after the paid period ends (30 days after the end of a trial that was not converted). Then we delete or irreversibly anonymise it, together with the files stored for you.

12.3 We may retain Personal Data where required by a law to which we are subject, and in the accounting records we hold ourselves — our own accounting records relating to the Controller, including the transaction records Paddle provides for the subscription, which we keep for 10 years, because our customers are required to retain their own tax invoices and accounting records for that period under Omani tax law, and because we need the records for our own accounting and audit. Anything retained remains subject to this DPA and is processed only for the purpose requiring its retention.

12.4 Data in encrypted backups is deleted when the backup rotates out, within the periods in Schedule 4. Backups are not restored to service after termination except to meet a legal obligation.

12.5 We certify deletion in writing on request.

13. Your obligations as Controller

13.1 You warrant that you have a lawful basis under the PDPL for every category of Personal Data you put into BinaFlo. Under Article 10bis the available bases are legal obligation, publicly available data, vital interests, and performance of a contract to which the Data Subject is a party. There is no legitimate-interests basis in Omani law. Where none applies, you need consent.

13.2 You warrant that you have given your Data Subjects the notice they are entitled to, including the matters required by Article 10 of the Law and Article 36 of the Executive Regulation, and that your notice identifies us as a processor and discloses that data is transferred outside Oman.

13.3 Transfer consent is yours to obtain. Executive Regulation Articles 37–40 require the express consent of the Data Subject to a transfer outside Oman. We cannot obtain it — we have no relationship with your employees, workers, customers or suppliers. You must obtain and record it before entering their data into BinaFlo, and you must be able to evidence it.

We provide consent-capture and record-keeping features in the software to help. Using them is your responsibility.

13.4 You warrant that the Personal Data you enter is accurate and that you have the right to enter it.

13.5 You must appoint a Data Protection Officer. Article 20 requires it of every controller, with no exemption for small organisations, and Executive Regulation Articles 34–35 require the contact details to be published.

13.6 Sensitive Personal Data. You will not enter Sensitive Personal Data as defined in Article 5 — genetic, biometric or health data, racial origin, sex life, political or religious opinions, philosophical beliefs, criminal convictions, or data relating to security measures — except where you hold the permit that Article 5 requires or an exemption under Article 5bis applies.

BinaFlo is not designed to hold Sensitive Personal Data and we do not represent that it is suitable for it. Note that civil ID number, passport number, salary and bank account details are not Sensitive Personal Data under Article 5; they are Personal Data and BinaFlo is designed to handle them.

13.7 You will keep users' credentials secure and remove access for anyone who leaves.

13.8 You indemnify us against any claim, fine or loss arising from your breach of this clause 13.

14. Liability

14.1 Liability under this DPA is subject to the limitations in clause 16 of the Terms of Service.

14.2 Clause 14.1 does not limit either party's liability for a fine, penalty or award imposed on the other by the Ministry or a court to the extent it results from that party's own breach of the PDPL or of this DPA.

14.3 Neither party limits liability for fraud, wilful misconduct, or anything that cannot lawfully be limited under Omani law.

15. General

15.1 This DPA is governed by the laws of the Sultanate of Oman, and disputes are resolved under clause 24 of the Terms of Service.

15.2 We may update this DPA to reflect a change in law, in Sub-processors or in our security measures, on 30 days' notice. Where an update reduces your rights or our obligations, you may terminate under clause 6.3.

15.3 This DPA is published in English.

Schedule 1 — Details of processing

Subject matter. Provision of the BinaFlo construction ERP service.

Duration. For the term of the subscription, plus the retention periods in Schedule 4.

Nature of the processing. Collection, recording, organisation, structuring, storage, retrieval, consultation, calculation, use, transmission, alignment, restriction, erasure and destruction — by automated means, within the application, and by our personnel where necessary for support.

Purposes. Operating the modules the Controller has enabled: projects, sites, employee records, attendance, payroll, WPS file generation, gratuity, leave, invoicing, quotations, purchase orders, subcontracts, petty cash, equipment, materials, documents, safety incidents and reporting.

Categories of Data Subject

• the Controller's employees and workers, including site workforce
• the Controller's own administrative and office staff
• the Controller's customers' contact persons
• the Controller's suppliers' and subcontractors' contact persons

Categories of Personal Data

Sensitive Personal Data. None is intended to be processed. BinaFlo uses QR-code and manual attendance and does not process biometric data. See clause 13.6.

Frequency. Continuous, for the term of the subscription.

Schedule 2 — Technical and organisational security measures

Implemented under Article 13 of the Law.

Encryption

• TLS on all connections; plain HTTP redirected, never served
• Backups encrypted with age before leaving the server; the decryption key is held separately from the backup storage and is not held by the storage provider
• Passwords stored only as salted hashes; recovery is by reset, never by disclosure

Access control

• Role-based permissions with per-user overrides, enforced server-side on every request, not only in the interface
• Every operational record carries a company identifier; queries are scoped to it so one Controller's data is not reachable from another's session
• Access tokens last 15 minutes and are kept in memory only; the long-lived sign-in is an opaque token kept in an httpOnly cookie, replaced on every use, and revoked at once if an old one is ever presented again. Tokens carry a version claim, so a password change or a forced sign-out invalidates existing sessions immediately
• The optional quick-unlock PIN is stored only as a slow hash on the server, works only on the device it was set on, and is removed (and the device signed out) after five wrong tries
• Administrative access to servers by SSH key only; password authentication disabled
• Administrative access limited to named personnel

Resilience

• Daily automated database and file backups
• Local retention plus offsite encrypted retention — periods in Schedule 4
• Production and staging are separate environments with separate databases and separate credentials
• Deployment is automated, takes a database snapshot before applying changes, and can roll back

Monitoring

• Sign-in successes and failures logged with account, timestamp and source IP
• Account lockout after repeated failed sign-in attempts
• Changes to records logged with the acting user, the time and the previous value where applicable
• Rate limiting and standard HTTP security headers on all endpoints

Application security

• Input validation and parameterised database access
• File upload restrictions by type and size, with filename sanitisation
• Output sanitisation on exports to prevent formula injection in spreadsheet applications
• Dependencies monitored for known vulnerabilities

Organisational

• Written confidentiality obligations for all personnel with access
• Access removed promptly when an engagement ends
• Security measures reviewed at least annually and after any incident
• A documented incident response procedure, with the notification timetable in clause 9

We do not claim certification to ISO 27001, SOC 2 or any other standard, and we hold none. We will say so plainly rather than imply otherwise.

Schedule 3 — Sub-processors

Current as at 19 October 2026. Changes are notified under clause 6.2.

Personnel. Our own personnel access Personal Data from India, for support and administration, under clause 5.3.

Schedule 4 — Retention

The Controller's own retention obligations may be longer than ours. For example Article 52 of the Labour Law (Royal Decree 53/2023) requires an employee's personnel file to be kept for at least one year after employment ends, and tax and payroll records must be kept for ten years. Those obligations sit with the Controller. Export before terminating.

Schedule 5 — Transfer impact assessment (summary)

Prepared under Article 39 of the Executive Regulation. Last reviewed: 19 October 2026.

1. The transfer

2. Legal framework in each destination

India — hosting and personnel access.

India has an omnibus data protection statute, the Digital Personal Data Protection Act 2023, which imposes obligations on data fiduciaries covering purpose limitation, security safeguards, breach notification and data principal rights, and establishes a Data Protection Board. This provides a level of protection that is, in our assessment, not less than the standard required by the PDPL for the categories of data concerned.

Government access: the Information Technology Act 2000 (notably ss. 69 and 69A) and the Telegraph Act 1885 permit interception and monitoring on specified grounds, subject to a written authorisation procedure. Access is not unrestricted and is subject to procedural requirements and judicial review.

Practical mitigations: the data is held on infrastructure operated by a commercial datacentre provider under contract, not by a state entity; no Omani-specific data localisation or disclosure obligation attaches; and both the hosting and our personnel access sit in the same jurisdiction, so there is one destination to assess rather than two.

No sanctions or export control regime restricts the placement of this software or data in India.

United States. Sectoral rather than omnibus data protection law. Government access powers include FISA Section 702 and the CLOUD Act. Mitigations: Amazon SES (region us-east-2) and Resend receive only recipient name, email address and message content — not payroll, banking or identity document data. Cloudflare R2 receives only the Controller's files and backups encrypted on our server before transmission, with the key held by us and never by Cloudflare, so it cannot read the contents and a compelled disclosure would yield ciphertext.

Personnel access. Access by our personnel is remote, role-limited and logged. No bulk copy of Controller data is held on personnel devices. Because our personnel and the hosting infrastructure are both in India, this adds no further destination to assess.

3. Safeguards

• Written contracts with every Sub-processor imposing PDPL-equivalent obligations, breach notification, confidentiality, audit rights and restrictions on onward transfer
• TLS in transit, age encryption at rest for backups with separated key custody
• Least-privilege access and logging of administrative access
• The government-demand procedure in clause 5.6 — notify the Controller, seek waiver where prohibited, challenge unlawful or overbroad demands, disclose the minimum compelled
• Express consent of the Data Subject to the transfer, obtained by the Controller under clause 13.3

4. Conclusion

Having assessed the legal framework in each destination and the safeguards in place, we conclude that the transfer of Personal Data to India, and to the United States (Amazon SES, Resend and Cloudflare R2) for the limited purposes described, provides a level of protection not less than that required by the Personal Data Protection Law. The principal residual risk is lawful access by public authorities in each destination, which is mitigated by the procedural safeguards in those jurisdictions, by the limited categories of data reaching the United States, and by the government-demand procedure in clause 5.6 of this Agreement. This assessment will next be reviewed on or before 19 October 2027.

5. Review

Reviewed annually, and additionally on: any change of Sub-processor or destination; any material change in a destination's law affecting government access or data protection; any government demand received; and any Personal Data Breach.

BinaFlo is a product of Mivi Tech Labs L.L.C., Wyoming, USA. Version 1.3, effective 19 October 2026. Data Protection Officer: privacy@binaflo.com