1. Scope and binding effect
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Hakim ("Hakim," "processor") and the Customer ("you," "controller"). It applies whenever Hakim processes personal data that you submit through the Hakim API, dashboard, or any other interface to the service. Where this DPA conflicts with the Terms of Service or any order form on a question of personal-data processing, this DPA controls. Where an enterprise customer signs a counter-signed DPA in an order form, that bespoke version supersedes this page for that customer only.
2. Definitions
Capitalised terms used in this DPA carry the meanings given in the EU GDPR, the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), and the KSA Personal Data Protection Law where applicable. "Customer Personal Data" means personal data submitted to the service by you or your end-users. "Sub-processor" means a third party engaged by Hakim to process Customer Personal Data on Hakim's behalf. "Standard Contractual Clauses" means the Module 2 (controller-to-processor) clauses adopted by the European Commission.
3. Subject matter, duration, nature, and purpose of processing
The subject matter of the processing is the provision of Hakim's Arabic-first voice AI services, text-to-speech synthesis, speech-to-text transcription, and voice cloning. The duration of the processing is the term of your Hakim account plus the retention windows specified in the Privacy Policy and any enterprise order form. The nature of the processing is automated synthesis, transcription, storage, transmission, and access control. The purpose is to fulfil API requests you make and to operate the service securely. Categories of Customer Personal Data may include voice recordings, transcripts, and any personal data contained therein. Categories of data subjects include your end-users, employees, customers, and any individual whose voice you are authorised to process.
4. Processor obligations
Hakim will process Customer Personal Data only on your documented instructions, including the instructions implicit in your use of the service consistent with the Terms of Service and this DPA. Hakim will not process Customer Personal Data for any other purpose, including training any machine-learning model. Hakim ensures that personnel authorised to process Customer Personal Data are subject to confidentiality obligations equivalent to those in this DPA. Hakim will assist you, taking into account the nature of the processing, in fulfilling your obligations to respond to data-subject access, rectification, erasure, restriction, portability, and objection requests within statutory deadlines.
5. Security measures (Article 32)
Hakim implements appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include: TLS 1.3 in transit and AES-256-GCM at rest on every storage tier; production access gated behind FIDO2 hardware keys with no SMS or TOTP fallback; a documented IAM model with least-privilege access reviews on a weekly cadence; quarterly third-party penetration tests against the API and dashboard; SIEM-ingested audit logs with a 365-day retention; and an incident-response plan exercised at least annually. The full security control mapping lives at /security.
6. Sub-processors
You give Hakim a general authorisation to engage sub-processors to process Customer Personal Data, subject to this section. The current list of sub-processors, including the regional partner running each GCC region, our hyperscaler in EU-Frankfurt, our billing processor, and our observability vendors, is published at /compliance#subprocessors with a 30-day change-notification track. Hakim will give you at least 30 days' written notice before adding or replacing any sub-processor (notice via the dashboard banner, email to workspace owners, and a pinned changelog entry under the subprocessors tag). You may object in writing within 30 days of notice; if Hakim cannot provide a commercially reasonable alternative, you may terminate the affected service for convenience without penalty. Hakim remains liable to you for the acts and omissions of every sub-processor as if they were Hakim's own.
7. International data transfers
Customer Personal Data is processed in the region you pick when you create a workspace. UAE, KSA, Qatar, or EU-Frankfurt. Customer content does not leave that region; there is no silent cross-region routing. The only exception is account-level metadata (your email, billing address, workspace name) which sits in GCC-UAE for all customers because that is where the billing system is homed. Where any cross-border transfer occurs in support of the service (e.g. an EU customer accessing a GCC region they explicitly chose, or a support engineer based outside your chosen region with rotating, audited access), the Standard Contractual Clauses (Module 2) are incorporated by reference and apply automatically without further signature. Hakim conducts and documents transfer-impact assessments for every transfer corridor.
8. Assistance with data-subject rights
Hakim provides API and dashboard tooling that lets you action data-subject rights without contacting support: per-recording deletion, full workspace deletion (with a 72-hour cleanup receipt), and per-call audit-trail export. Where you cannot self-serve a request, for example, locating a specific transcript across an enterprise tenancy. Hakim will assist within five business days at no additional charge. Requests received directly by Hakim from a data subject of yours will be forwarded to you without action and within five business days; we will not respond to such requests on your behalf unless an enterprise order form expressly assigns that obligation to us.
9. Personal data breach notification
Hakim notifies you of any confirmed personal-data breach affecting Customer Personal Data within 24 hours of confirmation by our incident-response team. The notification is made by email to every workspace owner, with a follow-up via Slack Connect for enterprise customers. The notification describes: the nature of the breach including categories and approximate number of data subjects affected; the likely consequences; the measures taken or proposed to address it; and the contact point for further information. Hakim assists you in fulfilling your own statutory notification obligations to supervisory authorities and affected data subjects on the regulator's timeline (72 hours under GDPR Article 33).
10. Audit and compliance evidence
Hakim makes available the information necessary to demonstrate compliance with this DPA. Standard evidence, the SOC 2 Type II report (in progress; Type I available on request), the ISO 27001 readiness assessment, the sub-processor inventory, the incident-response runbook, and the most recent third-party penetration-test summary, is shared under NDA on request to compliance@tryhakim.ai. Where applicable law or your regulator requires a supervised on-site visit, Hakim cooperates on reasonable advance notice (no less than 30 days except for regulator-driven inspections), restricted to working hours, restricted to areas where Customer Personal Data is processed, and at the auditor's expense unless the audit reveals material non-compliance.
11. Return and deletion on termination
On termination of your Hakim account, you have 30 days to export Customer Personal Data via the API. After 30 days, or sooner on your written instruction, Hakim deletes all Customer Personal Data within 72 hours and purges associated telemetry within 30 days. Both operations are logged in a deletion receipt available via the API. Sub-processors are required to delete on the same timeline. Hakim retains backups for the standard backup-rotation window (35 days) after which copies are cryptographically shredded; restoration from backup during that window is only triggered by a documented disaster-recovery event and never includes resurrected Customer Personal Data once the primary delete has run.
12. Precedence, liability, and changes
This DPA prevails over the Terms of Service and any order form on questions of personal-data processing, except where an enterprise order form expressly modifies a clause for that customer. The limitation-of-liability provisions in the Terms of Service apply to claims under this DPA, except that breaches of confidentiality, security, or international-transfer obligations are not subject to the indirect-damages exclusion to the extent prohibited by applicable law. Hakim may update this DPA on 30 days' written notice for material changes (notification by email to workspace owners + a pinned changelog entry under the dpa tag); non-material changes (typo fixes, link rewrites) ship without notice and the effective date at the top of this page is always authoritative. Continued use of the service after the effective date constitutes acceptance.