Effective 16 September 2026. Ameen is business software; this page is not legal, tax, or accounting advice.

Data Processing Addendum

This addendum applies whenever you use Ameen to hold personal data about other people, typically your employees, customers, and suppliers. For that data you decide what is collected and why; Ahmad Abu Rabee processes it only on your behalf. It forms part of the Terms of Service.

What we process for you

• Types of data: identification and contact details, employment details including salary, and transaction records.
• People affected: your staff and users, your customers and suppliers, and their contact persons.
• Purpose: providing the Ameen service described in the Terms.
• Duration: for as long as your organisation exists, plus the retention periods in the Privacy Policy.

Our commitments

We process personal data only on your instructions, and your use of the service is that instruction, unless the law requires otherwise. If that happens we will tell you, unless we are forbidden from doing so.

Everyone with access is bound by confidentiality. We apply the safeguards described in the Privacy Policy: Argon2 password hashing, database-level separation between organisations, HTTPS in transit, hashed identifiers in security logs, separate and time-limited administrative access recorded in an audit log, and regular backups.

We will not add a new sub-processor without telling you first and giving you a chance to object.

Sub-processors

• Contabo, server hosting, European Union (France).
• Resend, transactional email delivery.

Helping you meet your obligations

We will help you answer requests from individuals about their data, and assist with security, breach notification, and impact assessments, to the extent the information is available to us. The workspace already lets you export and delete your organisation's data yourself.

Breaches

If we become aware of a breach affecting your personal data, we will notify you without undue delay, with what we know at the time and what we are doing about it.

Deletion and return

You can export your data at any time, in a machine-readable form. On a confirmed deletion request we remove your organisation's data after the 30-day recovery window described in the Privacy Policy, unless the law requires us to keep it. Copies may remain in backups until those are rotated out.

International transfers

Your data is stored in the European Union. We will not move it outside the EU without telling you beforehand.

Audit

We will provide the information needed to show that we are meeting this addendum, and answer reasonable questions about how we process your data.