ProfoundOS legal
Data Processing Terms
Effective 20 September 2026
These Data Processing Terms form part of the agreement under which Profound WLL provides ProfoundOS to a business Customer. They apply when Profound WLL processes personal data submitted to a Customer workspace on the Customer's behalf.
1. Roles and instructions
The Customer is the data controller or business owner of submitted personal data and Profound WLL is the data processor or service provider where those concepts apply. Profound WLL will process that data only to provide, secure, maintain and support ProfoundOS, to follow the Customer's documented lawful instructions, or as required by applicable law. If a legal requirement prevents notice of an instruction, notice may be withheld only to the extent the law requires.
2. Processing details
Processing continues for the service term and any limited return, deletion, backup or legal-retention period. It may include collection, recording, organization, storage, retrieval, consultation, use, transmission, reconciliation, restriction, export and deletion. Data subjects may include the Customer's users, staff, customers, prospects, suppliers and business contacts. Data may include identity and contact information, user and employment-related records entered by the Customer, transaction and payment records, service history, and operational data.
3. Confidentiality
Personnel and contractors authorized to process Customer personal data must be subject to appropriate confidentiality duties and may access the data only as needed for their assigned responsibilities.
4. Security
Profound WLL will maintain reasonable technical and organizational measures appropriate to the service and processing risk. These include company-scoped access controls, secure authentication and password storage, encrypted network transport in production, controlled privileged access, logging, protected secrets and operational backup procedures. The measures may evolve as technology, threats and the service change, without materially reducing overall protection.
5. Subprocessors
The Customer authorizes the use of hosting, database, email, backup and support subprocessors reasonably required to provide ProfoundOS. Profound WLL will impose appropriate data-protection obligations on subprocessors according to their role and remains responsible for its obligations under these Terms. Material changes that create a materially different processing risk will be communicated through a reasonable channel where practicable.
6. International processing and transfers
The Customer authorizes processing in locations used by approved cloud and service providers, subject to Bahrain PDPL requirements. Profound WLL will use applicable contractual, organizational and technical safeguards and will cooperate with the Customer where consent, authorization or another lawful transfer condition is required. The Customer must disclose any location restriction before submitting affected data.
7. Data-subject and regulatory assistance
Taking account of the nature of the processing and information available, Profound WLL will reasonably assist the Customer with valid data-subject requests, security obligations and inquiries from the competent Bahrain authority. Profound WLL will not independently respond on the Customer's behalf unless authorized or legally required.
8. Personal-data breach cooperation
After confirming a personal-data breach affecting Customer Data, Profound WLL will notify the Customer without undue delay where required, provide reasonably available information about its nature and likely effects, and cooperate on containment, remediation and legally required notices. Notice is not an admission of fault or liability.
9. Return and deletion
On termination or a valid written instruction, Profound WLL will delete or make available a reasonable return of Customer Data, subject to service capabilities, applicable fees agreed for exceptional assistance, legal retention requirements and protected backup cycles. Backup copies will remain isolated from ordinary use and expire through normal rotation unless law requires longer retention.
10. Customer obligations
The Customer must process and submit personal data lawfully; give required notices and obtain required permissions; issue lawful, clear instructions; configure access appropriately; protect user devices and credentials; maintain accurate data; avoid submitting unnecessary or unlawfully obtained data; and assess whether ProfoundOS is suitable for any specially regulated processing. The Customer remains responsible for its decisions as controller.
11. Information and precedence
Profound WLL will provide information reasonably necessary to demonstrate compliance with these Terms, subject to confidentiality, security and protection of other customers. If these Terms conflict with the general Terms of Use on personal-data processing, these Data Processing Terms control for that subject. Mandatory Bahrain law prevails over conflicting contractual language.
12. Contact
Data-processing questions may be directed to Profound WLL, Kingdom of Bahrain, at +973 77933777. Privacy contact email and registered-office details: [to be configured in the applicable service communication or order form].