Data Processing Addendum

This Data Processing Addendum (DPA) forms part of the agreement between SkyStruct QSTP-LLC (SkyStruct) and the Customer identified in the accepted Order (Customer). It applies whenever SkyStruct processes personal data on behalf of the Customer in providing the contracted services. Acceptance of an Order incorporating this DPA, or execution of this DPA, makes it binding. Its operational schedules must be completed for the relevant deployment before the affected processing begins.

1. Definitions, roles and precedence

1.1 Applicable Data Protection Law means a personal-data-protection law that applies to the relevant processing, including Qatar's Law No. 13 of 2016 and applicable implementing requirements, and GDPR where applicable. Terms such as personal data, controller, processor, processing and personal data breach have the meanings assigned by the applicable law. Customer Personal Data means personal data processed by SkyStruct on the Customer's behalf under the agreement.

1.2 The Customer is the controller and SkyStruct the processor, unless the Customer lawfully acts as a processor for another controller, in which case SkyStruct acts as its subprocessor. The Customer must possess the authority to appoint SkyStruct and communicate instructions. Each party remains responsible for obligations imposed directly on it by law.

1.3 This DPA does not govern processing for which SkyStruct genuinely acts as an independent controller, such as its own invoicing records. That exclusion does not permit SkyStruct to reclassify Customer Personal Data for unrelated purposes or evade processor duties. Any new independent purpose requires a lawful basis, appropriate transparency and compliance with the agreement.

1.4 On personal-data-processing matters, this DPA prevails over conflicting general contract provisions. Mandatory law and an applicable executed data-transfer instrument prevail over this DPA where required. Customer-specific schedules may add safeguards but must not reduce a protection required by law or an applicable transfer instrument.

2. Subject matter and documented instructions

2.1 Schedule A describes the subject matter, purposes, processing operations, data categories, data subjects and duration. Schedules B and C identify the security measures, deployment responsibilities, processing locations and authorised subprocessors. The Order and schedules form the Customer's initial documented instructions.

2.2 SkyStruct shall process Customer Personal Data only on documented instructions to provide, maintain, secure and support the contracted service, including instructions concerning international transfers. Instructions may be recorded through authorised configuration settings, support requests or written communications. The Customer's authorised instruction contacts must be identified in Schedule C.

2.3 SkyStruct shall promptly inform the Customer if an instruction appears to infringe Applicable Data Protection Law and suspend the affected instruction pending clarification where necessary. It shall not silently implement a new incompatible purpose. Unrelated advertising, sale of data and general-purpose or third-party AI model training are prohibited without a separate lawful written agreement.

2.4 If a binding legal demand requires processing or disclosure outside the Customer's instructions, SkyStruct shall assess its validity, disclose only what is lawfully required, notify the Customer in advance where permitted and take available reasonable steps to challenge an unlawful or disproportionate demand. Where GDPR or an applicable transfer instrument governs, any legal-compulsion exception is limited by that law or instrument; this clause does not make every third-country demand a valid GDPR processing instruction.

3. Customer responsibilities

3.1 The Customer shall ensure that its collection, use and disclosure of Customer Personal Data, and its instructions to SkyStruct, are lawful. It shall give required notices, establish an applicable lawful basis, obtain required permissions and provide accurate instructions. It shall limit information to what is necessary, manage user permissions, and maintain a current contact for privacy and incident matters.

3.2 Personal data of a special nature under Qatar law and other restricted data may be processed only after the parties agree the specific categories, purpose, safeguards and legal permissions in writing. The Customer shall not assume that a permitted document type authorises sensitive information within it. SkyStruct shall not proceed with agreed restricted processing before the requirements applicable to its role are satisfied.

3.3 The Customer shall determine its record-retention needs and communicate lawful deletion, restriction and return instructions. It remains responsible for the legality of decisions made using the service. These responsibilities do not reduce SkyStruct's independent obligations under this DPA or Applicable Data Protection Law.

4. Confidentiality, personnel and security

4.1 SkyStruct shall restrict access to personnel who need it for an authorised purpose and ensure that they are subject to enforceable confidentiality obligations or an appropriate statutory duty. It shall provide suitable security and data-protection guidance and remove access when no longer required.

4.2 SkyStruct shall implement and maintain the technical and organisational measures in Schedule B, appropriate to the processing risks and applicable law. Where GDPR applies, the measures shall meet the requirements applicable under Article 32. Measures must protect confidentiality, integrity, availability and the ability to restore access after an incident.

4.3 Measures may evolve to address threats and improve the service, but SkyStruct shall not materially reduce the agreed overall level of protection during the term. A material change affecting processing locations, subprocessors, data use or the Customer's legal requirements must follow the applicable approval and notice procedure, not merely a website update.

5. Subprocessors

5.1 The Customer authorises only the subprocessors identified in a completed Schedule C and any subsequently authorised under this clause. The identity, service, data access and processing countries of each provider must be disclosed. An incomplete register is not permission to use undisclosed providers.

5.2 Subject to the prior written general authorisation granted through the completed Schedule C, SkyStruct shall give at least 30 calendar days' advance notice of a proposed addition or replacement. The Customer may object within 15 calendar days on reasonable, substantiated data-protection grounds. Specific authorisation must be obtained instead where required by law or the Order.

5.3 The parties shall seek a reasonable solution to an objection, such as a different provider or configuration. SkyStruct shall not give the proposed provider access to the affected data while an unresolved, timely objection prevents the required authorisation. If no lawful, commercially reasonable solution is available, either party may terminate only the affected service, and SkyStruct shall refund unused prepaid subscription fees for it. An urgent operational need does not override required authorisation or transfer safeguards.

5.4 Each subprocessor shall be bound by a written agreement imposing data-protection obligations no less protective than those relevant to its work under this DPA. SkyStruct remains responsible to the Customer for that subprocessor's performance. Providers contracted independently by the Customer are not SkyStruct subprocessors merely because they integrate with the service.

6. Processing countries and international transfers

6.1 SkyStruct shall process Customer Personal Data only in the countries, environments and remote-access arrangements recorded in Schedule C or subsequently approved under this DPA. That record must include relevant production, backup, disaster-recovery, logging, support and AI-processing locations. A cloud-region label alone is not a complete processing-location schedule.

6.2 Before a restricted international transfer or remote access begins, the parties shall implement the mechanism and safeguards required by Applicable Data Protection Law. Where appropriate, this includes executing the applicable standard contractual clauses with the correct parties, roles, modules and completed annexes, and assessing any necessary supplementary measures. This DPA does not purport to incorporate an unspecified or incomplete transfer instrument.

6.3 SkyStruct shall provide reasonable information needed for a transfer assessment and promptly inform the Customer if it can no longer meet an agreed safeguard. The affected transfer or access shall be suspended where no lawful solution is available. Required safeguards must also apply to onward transfers. A general consent in website terms does not replace these requirements.

7. Personal-data incidents

7.1 SkyStruct shall notify the Customer immediately on becoming aware of a breach of protective safeguards or a risk threatening Customer Personal Data where Qatar's law requires that notification, and in all cases without undue delay on awareness of a personal data breach. Notification shall not be delayed until an investigation is complete or conditioned on proof of harm. Ordinary unsuccessful attacks that do not meet an applicable notification trigger need not be reported individually.

7.2 Available information shall be supplied progressively, including the nature and timing of the event, affected systems, categories and approximate numbers of individuals and records where known, likely consequences, containment and remedial steps, a contact point and recommended protective actions. SkyStruct shall investigate, preserve relevant evidence lawfully, take appropriate corrective action and provide material updates.

7.3 The Customer determines notifications for which it is the responsible controller; SkyStruct shall provide the assistance reasonably necessary to meet applicable deadlines and shall comply with its own direct notification obligations. SkyStruct shall not notify individuals on the Customer's behalf without instruction unless law requires it. Neither party may prevent the other from making a legally required report. Initial notification is not an admission of liability.

8. Individual rights and regulatory assistance

8.1 SkyStruct shall promptly pass to the Customer a request relating to Customer Personal Data received from an individual or authority, unless prohibited by law. It shall not decide the Customer's response without instruction, except where required by law. It shall provide appropriate technical and organisational assistance with access, correction, deletion, objection, restriction, portability and other applicable rights.

8.2 Taking account of the processing and information available to it, SkyStruct shall assist with security obligations, incident notifications, data-protection impact assessments, prior regulatory consultation and enquiries by competent authorities. Assistance must be supplied in time to support the relevant legal deadline.

8.3 Ordinary assistance needed to meet SkyStruct's obligations under this DPA is included in the service. Substantial additional work arising from a new Customer requirement may be separately scoped and reasonably charged where lawful, but a fee negotiation must not obstruct a mandatory right, urgent incident response or compliance with a legal deadline. SkyStruct bears the reasonable cost of remedial assistance necessitated by its own breach.

9. Information, audits and corrective action

9.1 SkyStruct shall maintain relevant compliance records and make available the information reasonably necessary to demonstrate compliance with this DPA. This may include written responses, agreed technical documentation and relevant independent assurance material that actually exists. No certification or report is deemed to exist merely because the Customer requests it.

9.2 SkyStruct shall allow and contribute to audits, including inspections, by the Customer or an independent auditor bound by appropriate confidentiality duties. Routine audits should normally occur no more than annually, on reasonable advance notice, during reasonable hours and with safeguards for other customers' information. Those administrative arrangements do not restrict an audit needed after a material incident, reasonably suspected non-compliance, a competent authority's request or an applicable legal requirement.

9.3 The parties shall avoid unnecessary disruption and use equivalent documentary evidence where it adequately answers the issue, without substituting such evidence for a legally required inspection. Identified material deficiencies shall be addressed through a documented corrective-action plan appropriate to the risk. Audit arrangements do not limit the powers of a competent authority.

10. Return, deletion and retention

10.1 During the service, SkyStruct shall act on lawful, documented deletion or restriction instructions within the agreed functionality and any applicable legal deadline. At the end of the processing services, the Customer may choose return or deletion of Customer Personal Data. The default choice is return through supported export or reasonable assistance during a 30-calendar-day retrieval window, followed by deletion. The Customer may instead instruct earlier deletion or agree a lawful alternative schedule.

10.2 Unless a different lawful schedule is documented, active copies shall be deleted no later than 30 calendar days after that retrieval window ends. Residual copies in backups shall be isolated from ordinary use and securely expire no later than 90 calendar days after the retrieval window ends. These are maximum periods, not permission to retain information longer than necessary or contrary to a mandatory deadline. Earlier mandatory deletion takes priority.

10.3 During residual backup retention, data shall remain protected and be processed only for lawful recovery or mandatory retention. If a backup is restored, applicable deletions and restrictions must be reapplied before the data returns to ordinary use. SkyStruct shall apply corresponding return and deletion requirements to its subprocessors.

10.4 Information may be retained beyond these periods only to the extent required by applicable law, subject to any stricter rule in an applicable transfer instrument. SkyStruct shall identify the legal basis and expected retention period where lawful, isolate the retained information, restrict its use to the required purpose and delete it when the obligation ends. A general preference to keep historical customer data is not a legal-retention requirement.

10.5 On request, SkyStruct shall confirm completion of deletion in writing, identifying any remaining lawful retention and its basis. Customer-controlled infrastructure remains the Customer's deletion responsibility, but SkyStruct remains responsible for any copies it holds and assistance expressly assigned to it. An unpaid ordinary commercial invoice does not authorise withholding a return required by applicable law.

11. Liability, duration and governing law

11.1 Contractual liability between the parties follows the agreement, subject to rights and liabilities that cannot lawfully be limited. No cap or exclusion restricts the rights of an individual, a regulator's powers, or a right or liability protected by applicable mandatory transfer clauses.

11.2 This DPA continues for as long as SkyStruct or its subprocessors retain Customer Personal Data. Confidentiality, restricted use, assistance and deletion duties survive termination as necessary. Qatar law and the dispute provisions of the agreement apply except where mandatory data-protection law or an executed transfer instrument requires a different governing law, authority or forum.

Schedule A — Processing description

Parties and roles. SkyStruct QSTP-LLC is the processor or subprocessor. The Customer's legal identity and address are those in the accepted Order. The Customer is the controller unless its authorised processor role and the relevant controller are recorded in Schedule C.

Subject matter and purpose. Provision of the purchased SkyStruct project-management services, including authorised workspace administration, project collaboration, document and workflow management, reporting, customer support, service security and agreed recovery activities. An optional integration or AI activity is included only where expressly authorised and described in the deployment schedule.

Processing operations. Collection through authorised use, recording, organisation, storage, retrieval, display, controlled sharing, transmission, support access, backup, restoration, return and deletion, limited to the purchased services and documented instructions. Processing is ongoing during service delivery and any permitted exit or residual-retention period.

Categories of individuals. Customer employees and representatives; project owners and their representatives; consultant, contractor, subcontractor and supplier personnel; authorised external users; and other individuals whose information the Customer lawfully includes in project records. Children and other restricted categories are excluded unless separately approved.

Ordinary data categories. Names, work contact details, organisation, professional role, account identifiers, permissions, project communications, approvals, business records, access and activity records, and personal information incidentally contained in authorised documents or site photographs. This description does not authorise unnecessary identity, medical, criminal or other restricted records.

Restricted data. None authorised by default. Any additional category requires a written description of the data, necessity, lawful basis, regulatory permission where required, access limits, retention and additional safeguards before processing.

Duration and exit. The subscription and service period stated in the Order; then the Customer's return or deletion instructions and the maximum periods in clause 10. An agreed lawful retention variation must state specific periods and must not be left open-ended.

Schedule B — Minimum contractual security measures

B1. Governance and personnel. SkyStruct shall assign responsibility for security and privacy administration, maintain relevant procedures, provide proportionate personnel training, and review access and confidentiality obligations when people join, change roles or leave.

B2. Access control. Access to Customer Personal Data shall be individually attributable, limited by business need and subject to approval. Privileged access to SkyStruct-operated production systems shall use multi-factor authentication or an explicitly agreed equivalent control providing comparable protection. Credentials and secrets shall be protected, and obsolete or unnecessary access revoked promptly. Customer-user authentication features are separately specified for the selected service.

B3. Encryption and keys. Customer Personal Data transmitted over public networks shall use appropriately configured, current secure transport protocols. SkyStruct-operated production storage and backups holding Customer Personal Data shall use encryption at rest. Keys and secrets shall be access-controlled and managed separately from unrestricted application content. The Customer is responsible for corresponding controls on infrastructure and exports it operates unless the parties assign them otherwise.

B4. Separation and system protection. SkyStruct shall use measures appropriate to separate customer environments or records, restrict network and administrative access, protect against malicious software, and prevent accidental exposure of production data. Live personal data shall not be placed in development or testing environments without an authorised purpose and equivalent appropriate safeguards.

B5. Logging and detection. Relevant administrative access and security events shall be logged to support investigation and accountability. Logs shall be access-controlled and reviewed using measures proportionate to risk. The retained event types, monitoring responsibilities and retention periods shall be documented for the deployment. This clause does not create an unagreed 24-hour staffed security-operations service.

B6. Vulnerabilities and changes. SkyStruct shall use a risk-based process to identify and address vulnerabilities, maintain supported components, test relevant changes and control production releases. Material security risks shall receive appropriate prioritisation. Assessment and remediation records shall be retained as necessary to demonstrate the process; particular test frequencies and independent assessments require an agreed schedule.

B7. Backup and recovery. For data within its managed service, SkyStruct shall maintain protected backups and a documented restoration process appropriate to the agreed service. Backup scope, frequency, retention, restoration testing and any recovery-point or recovery-time objectives shall be recorded in Schedule C or its expressly incorporated deployment schedule. Backup copies must satisfy the location and deletion obligations of this DPA.

B8. Incident handling. SkyStruct shall maintain a procedure for identifying, containing, investigating and remediating relevant incidents, notifying the Customer as required by clause 7, preserving appropriate evidence and recording corrective actions.

B9. Suppliers, facilities and disposal. SkyStruct shall assess providers relevant to processing, impose the contractual protections in clause 5, and apply appropriate safeguards to physical access where it operates facilities. Disposal of records, credentials and media within its control shall prevent unauthorised recovery where reasonably practicable and respect documented retention instructions.

B10. Effectiveness and shared responsibilities. Measures shall be reviewed and tested at intervals appropriate to risk and material change. The deployment schedule shall allocate each material control to SkyStruct, the Customer or an identified provider. A dependency on the Customer does not excuse a control expressly assigned to SkyStruct, and a supplier's certification is not a substitute for this schedule.

Schedule C — Deployment, locations and authorisations

This schedule is completed per customer, either below or by express reference to a dated, versioned deployment schedule and subprocessor register supplied to and accepted by the Customer. A reference must identify a retrievable document; “as applicable”, a generic cloud-provider name or an unspecified website list is not sufficient.

C1. Customer and instruction contacts: [Customer legal name and address; controller or authorised processor role; relevant controller where different; authorised instruction contact; privacy contact; monitored incident-notification address].

C2. Contract and service boundary: [Order reference; product; cloud or customer-managed deployment; environments and integrations included; dated responsibility matrix; service start and end dates].

C3. Processing locations: [Legal provider and country for production, backups, recovery, logs, support and remote administration; any AI processing; any restrictions on onward access]. Identify each activity even where all occur in one country.

C4. Authorised subprocessors: [For each provider: exact legal entity; contracted function; data categories or access; processing and support countries; appointment date; required transfer mechanism; relevant safeguards]. State whether authorisation is specific or general under clause 5. Record “none” only after verification.

C5. Recovery and retention: [Backup scope and frequency; operational retention; restoration-test arrangements; log retention; agreed recovery objectives, if any; any lawful variation from the exit periods in clause 10]. Do not infer a recovery commitment from an availability percentage.

C6. Transfers and restricted processing: [Any applicable transfer instrument, version, parties, module and completed annexes; assessment and supplementary measures; any authorised restricted categories, permissions and additional safeguards]. Record “not applicable” only with a documented basis.

C7. Acceptance and changes: [Date and version accepted by the Customer; acceptance method or signatories; referenced documents]. Changes follow this DPA's instruction, subprocessor and transfer procedures. The affected activity must not begin until the necessary particulars and approvals are complete.