Data Processing Agreement

Scope & Roles

This Data Processing Agreement ("DPA") forms part of the agreement between your organization ("Customer," acting as Data Controller) and Buildera ("Processor") governing Buildera's processing of Client Data on Customer's behalf, as described in our Terms of Service and Privacy Policy. Where applicable law (including Saudi Arabia's Personal Data Protection Law, "PDPL") uses different terminology for these roles, that terminology applies equally to the roles described here.

Definitions

• Controller — the Customer, who determines the purposes and means of processing personal data within Client Data.
• Processor — Buildera, who processes personal data within Client Data solely on the Controller's documented instructions.
• Personal Data — any information relating to an identified or identifiable natural person contained within Client Data.
• Processing — any operation performed on Personal Data, including collection, storage, indexing, and analysis by Buildera's AI agents.

Processing Instructions

Buildera processes Personal Data within Client Data only to provide the Service — document Q&A, submittal compliance checking, delay analysis, and report generation — as instructed by the Customer through its use of the Service, and as otherwise required by applicable law. Buildera will not process Personal Data for any other purpose, including training AI models shared across other customers.

Confidentiality

Buildera ensures that personnel authorized to process Personal Data are bound by appropriate confidentiality obligations, whether contractual or statutory.

Security Measures

Buildera implements the technical and organizational measures described in the Privacy Policy's Data Security section, including encryption in transit, role-based access control, and organization-level data isolation, to protect Personal Data from unauthorized access, disclosure, or loss.

Subprocessors

Buildera engages subprocessors by category — cloud hosting and storage providers, AI/large language model providers, and error monitoring providers — to operate the Service, as described in the Privacy Policy. Buildera remains responsible for subprocessors' compliance with obligations equivalent to those in this DPA. A current named subprocessor list is available on request at legal@buildera.ai and will be published here once infrastructure vendor selection is finalized.

Data Subject Requests

Where Buildera receives a request from an individual seeking to exercise rights over their Personal Data within Client Data, Buildera will promptly forward that request to the Customer and provide reasonable assistance in responding to it, as the Customer is best positioned to fulfill such requests as Controller.

Data Return & Deletion

On termination of the Service, Buildera will, at the Customer's choice, delete or return all Client Data in its possession, except to the extent applicable law requires continued storage, consistent with the Data Retention section of the Privacy Policy.

International Transfers

Personal Data may be processed outside Saudi Arabia by the subprocessors described above. Where this occurs, Buildera takes contractual, technical, and organizational measures designed to protect Personal Data in accordance with applicable law, including the PDPL, consistent with the Privacy Policy's International Data Transfers section.

Liability

Liability under this DPA is governed by the limitation of liability terms in the Terms of Service.

Term & Termination

This DPA remains in effect for as long as Buildera processes Personal Data on the Customer's behalf under the Terms of Service, and terminates automatically when that processing ends.

Governing Law

This DPA is governed by the laws of Saudi Arabia, consistent with the Terms of Service, without regard to its conflict of law provisions.

Contact

Questions about this DPA, or requests for a signed copy, can be sent to legal@buildera.ai.