Last updated: 13 October 2026. When banks and lenders use our platform, they control their borrowers' data and we process it only on their instructions, under a Data Processing Addendum (DPA) signed with every client. This page summarises its terms; the full DPA is available on request at privacy@bstech.world.
1. Roles. The client is the controller; BSS Tech World is the processor. We act only on the client's documented instructions.
2. Key commitments in the DPA.
- Confidentiality — staff with access are bound by confidentiality and trained in data protection.
- Security — technical and organisational measures described in the DPA's security annex, including tenant isolation, encryption and access control.
- Data location — data is hosted in the region agreed with the client and not moved without the client's consent.
- Sub-processors — only those on our Sub-processor List; clients get 30 days' notice of new ones and may object.
- Breach notification — we notify the client without undue delay, and within 48 hours of becoming aware of a personal-data breach.
- Assistance — we help clients answer data-subject requests, carry out impact assessments and respond to regulators.
- Audit — clients may review our security documentation and audit reports, and audit on reasonable notice.
- Return and deletion — at contract end, data is returned and then deleted within 90 days, unless the law requires retention.
- International transfers — protected by Standard Contractual Clauses or other mechanisms required by the applicable law.
3. Laws covered. UAE PDPL, KSA PDPL, EU and UK GDPR, US state privacy laws and other applicable data-protection laws.