Jurídico
Data Processing Agreement
Last updated: 23 October 2026
Este documento está disponível em inglês, e prevalece o texto em inglês.
This Data Processing Agreement (DPA) forms part of the Blitz 5 Subscription Terms between Blitz Technology Solutions LLC (trading as Blitz Armada), CR 226940, Cairo Investment Commercial Registry (Blitz) and the Customer. It applies to personal data that Blitz processes on the Customer's behalf through Blitz 5 (Customer Personal Data). Terms not defined here have the meaning given in the Subscription Terms, or in the data protection law that applies.
Data protection law means the personal data laws that apply to the processing, including Egypt's Personal Data Protection Law (Law No. 151 of 2020) and, where they apply, the laws of the Customer's country.
1. Roles
The Customer is the controller of Customer Personal Data. Blitz is its processor.
For the data Blitz collects to run the Customer's account (sign-up, billing, support), Blitz is a controller, and the Privacy Policy applies instead of this DPA.
2. Instructions
Blitz processes Customer Personal Data only on the Customer's documented instructions. The Subscription Terms, this DPA and the Customer's use and configuration of Blitz 5 are those instructions.
Blitz will tell the Customer if it believes an instruction breaks data protection law, and may decline to follow it.
Where the law requires Blitz to process data other than on instructions, Blitz will tell the Customer first, unless the law forbids it.
3. Confidentiality
Blitz ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality, and gives access only to those who need it to provide, secure or support Blitz 5.
4. Security
Blitz applies the technical and organisational measures in Annex 3, and may update them as long as protection does not decrease.
The Customer is responsible for its own users, passwords, permissions and the data it chooses to put into Blitz 5.
5. Sub-processors
The Customer authorises Blitz to use the sub-processors in Annex 2.
Blitz will give at least 30 days' notice by email before adding or replacing a sub-processor. The Customer may object on reasonable data-protection grounds within that time. If the parties cannot resolve it, the Customer may cancel and receive a pro-rated refund of prepaid fees for the remaining period.
Blitz binds each sub-processor to data protection terms at least as protective as this DPA, and remains responsible for its sub-processors.
6. Location and transfers
Blitz stores Customer Personal Data in Oracle Cloud Infrastructure's Jeddah region, Saudi Arabia.
Blitz staff access the data from Egypt to operate and support Blitz 5. Some sub-processors in Annex 2 process data outside Saudi Arabia.
Blitz will only transfer Customer Personal Data out of the country where it is stored, or allow access to it from another country, in line with the transfer rules of data protection law, including by putting contractual safeguards in place with each sub-processor.
7. Personal data breaches
Blitz will notify the Customer without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
The notice will describe, as far as known, what happened, the data and people affected, the likely consequences and what Blitz is doing about it. Blitz will update it as it learns more.
8. Help with requests and compliance
Blitz 5 lets the Customer find, export, correct and delete records. Where the Customer cannot answer a data-subject request that way, Blitz will provide reasonable help.
If Blitz receives a request directly from a person whose data the Customer controls, it will pass it to the Customer and not answer it itself, unless the law requires otherwise.
Blitz will provide reasonable information the Customer needs for impact assessments or consultations with a regulator.
9. Audits
Blitz will make available the information needed to show it complies with this DPA, including Oracle Cloud Infrastructure's certifications and our written answers to a reasonable security questionnaire.
If that is not enough, or a regulator requires it, the Customer may audit Blitz once a year, on 30 days' notice, at its own cost, under confidentiality, in a way that does not disrupt the Service or expose other customers' data.
10. End of service
When the subscription ends, the Customer may export its data under clause 9 of the Subscription Terms.
Blitz will then delete Customer Personal Data within the periods in that clause: 90 days from the live Service and up to 60 more days from backups, unless the law requires Blitz to keep it.
On request, Blitz will confirm the deletion in writing.
11. Liability and precedence
Each party's liability under this DPA is subject to clause 15 of the Subscription Terms.
On personal data, this DPA prevails over the Subscription Terms.
Annex 1: Processing details
| Item | Detail |
|---|---|
| Subject matter | Providing Blitz 5 to the Customer |
| Duration | The subscription, plus the deletion periods in clause 10 |
| Nature and purpose | Hosting, storing, organising, displaying and transmitting data so the Customer can run its business; sending WhatsApp and email messages the Customer triggers; answering users' questions through the AI assistant; support and security |
| People concerned | The Customer's own customers, guests and contacts; the Customer's staff and users |
| Personal data | Names, phone numbers, email addresses, bookings, payment records, messages; for airport fast track, passport and visa details |
| Sensitive data | Passport and visa details, only where the Customer uses airport fast track. The Customer decides whether to collect them and must have a lawful basis to do so |
Annex 2: Sub-processors
| Sub-processor | What it does | Customer Personal Data | Location |
|---|---|---|---|
| Oracle Cloud Infrastructure | Hosts the database (Oracle Autonomous Database) and the application; sends account emails (Oracle Email Delivery) | All Customer Personal Data; email address and message content | Jeddah region, Saudi Arabia; email sending may use other Oracle regions |
| YCloud | Carries the product's WhatsApp inbox | Phone numbers, message content | May be outside Saudi Arabia |
| Anthropic | Answers questions in the AI assistant | The question and the data needed to answer it | May be outside Saudi Arabia |
| Google Maps Platform | Shows maps and suggests addresses in limousine bookings | Addresses typed into a booking | May be outside Saudi Arabia |
| Meta (WhatsApp Business Platform) | Carries WhatsApp messages sent and received through Blitz 5, via YCloud | Phone numbers, message content | May be outside Saudi Arabia |
Paymob, Cloudflare Turnstile, Google Analytics and Microsoft Clarity handle sign-up, billing or website data for which Blitz is the controller. They do not receive Customer Personal Data, so they are covered in the Privacy Policy, not here.
Annex 3: Security measures
- Database, file storage and application servers hosted in Oracle Cloud Infrastructure's Jeddah region.
- Data encrypted in transit and at rest.
- Each organisation's data kept separate at database level; users see only what their permissions allow; the AI assistant follows the same permissions and is read-only.
- Passwords stored only in hashed form, using an industry-standard algorithm; accounts verified with a one-time code at sign-up.
- Sign-in attempts limited, with a temporary lock after repeated failures.
- Rate limits and bot checks on sign-up.
- Staff access limited to those who need it; changes made by staff are recorded in an audit log.
- Card data never stored by Blitz; held by Paymob.
- Backups kept for up to 60 days.