Data Processing Agreement
This Data Processing Agreement (the “Agreement”) forms part of the Terms of Service between Interworking AI Solutions Limited (“Lanpages”, the processor) and each user of Lanpages (the “Agent”, the controller). It applies to the personal data of the people who enquire through the Agent's Lanpages and web forms and of the contacts the Agent adds or imports into the Lanpages CRM (“Lead Data”). It is written to meet Articles 23 to 25 of the DIFC Data Protection Law, DIFC Law No. 5 of 2020 (the “Law”). Words defined in the Law have the same meaning here. For Lead Data, this Agreement prevails over the Terms where they differ.
1. Roles
The Agent decides why and how Lead Data is used and is its controller. Lanpages processes Lead Data only on the Agent's behalf, to provide the Services, and is its processor. If Lanpages ever decided the purposes or means of processing Lead Data itself, it would be treated as a controller for that processing.
2. Details of the Processing
The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of people concerned are set out in Annex 1.
3. Instructions
Lanpages processes Lead Data only on the Agent's documented instructions. The Terms, this Agreement and the settings the Agent chooses in the workspace (alerts, automatic replies, integrations, imports, exports and deletions) are those instructions; an instruction sent in writing, including by email, is one too. This includes transfers outside the DIFC, which are made as described in section 9.
If a law requires Lanpages to process Lead Data otherwise, Lanpages tells the Agent before doing so, unless that law forbids it on important grounds of public interest. Lanpages tells the Agent immediately if it believes an instruction breaks the Law.
4. Confidentiality
Lanpages allows access to Lead Data only to the staff and contractors who need it to provide, support or secure the Services, and only after they have committed to confidentiality or are under a legal duty of confidentiality.
5. Security
Lanpages keeps in place the technical and organisational measures in Annex 2, suited to the risks of the processing, and reviews them regularly. It may improve them, but will not reduce the overall level of protection.
6. Sub-processors
The Agent gives Lanpages a general authorisation to use the sub-processors listed in Annex 3. Lanpages informs the Agent of any intended addition or replacement at least 14 days in advance, by email to the account address and by updating Annex 3, and takes into account any objection the Agent raises in good faith. If the Agent's objection cannot be resolved, the Agent may export its Lead Data and close its account before the change takes effect.
Lanpages binds each sub-processor in writing to data protection obligations equivalent to those in this Agreement, and remains fully liable to the Agent for the performance of each sub-processor's obligations.
7. Helping the Agent Answer People's Requests
Taking into account the nature of the processing, Lanpages helps the Agent answer requests from people exercising their rights under the Law. The workspace lets the Agent, for each lead: download a copy of everything held about the person; correct it; pause its use; mark it “do not contact”, which keeps the person off later imports even after deletion; and delete it with its notes, files and WhatsApp conversation. If a person sends Lanpages a request about Lead Data, Lanpages passes it to the Agent without undue delay and does not answer it on the Agent's behalf unless the Agent asks.
8. Helping the Agent Meet Its Other Duties
Lanpages gives the Agent reasonable help, using the information available to it, with the Agent's duties on security (Article 14), data protection impact assessments and prior consultation of the Commissioner (Articles 20 and 21), and personal data breaches (Articles 41 and 42).
Lanpages notifies the Agent of a personal data breach affecting the Agent's Lead Data without undue delay after becoming aware of it, and where possible within 72 hours, with what is known at the time: what happened, the data and people concerned, the likely consequences, and the measures taken or proposed. It adds further information as it becomes available.
9. Transfers Outside the DIFC
Lead Data is processed by the sub-processors in Annex 3, some outside the DIFC. Where a destination is not recognised by the DIFC as giving adequate protection, Lanpages makes the transfer under an appropriate safeguard under Article 27 of the Law, in particular standard data protection clauses in its terms with each sub-processor, and provides a copy of the relevant safeguard to the Agent on request.
10. Requests from Public Authorities
If a public authority asks Lanpages for Lead Data, Lanpages checks that the request is valid and proportionate, gives no more than it requires, tells the Agent with reasonable notice before disclosing anything unless the law forbids it, and keeps a record of its decision, as Article 28 of the Law requires.
11. End of the Processing
The Agent can export its Lead Data at any time. When the Agent deletes a lead or closes its account, Lanpages erases the Lead Data concerned from the Services at once. Copies in the platform's backups are put beyond use and overwritten as the backups rotate, within about ten days. Lanpages keeps Lead Data longer only where a law requires it, and then only for that purpose.
12. Information and Audits
Lanpages makes available to the Agent the information needed to show compliance with this Agreement and Article 24 of the Law, and allows and contributes to audits and inspections by the Agent, an auditor it appoints or the DIFC Commissioner of Data Protection. An audit by or for the Agent is requested in writing with at least 30 days' notice, no more than once a year unless a breach or the Commissioner requires otherwise, during business hours, without access to other users' data, and at the Agent's cost. The Commissioner may inspect at any time as the Law allows.
13. The Agent's Responsibilities
The Agent is responsible for its use of Lead Data and in particular:
- has a lawful basis for the Lead Data it collects, adds or imports, and does not import bought, rented, scraped or copied lists;
- gives the people concerned the information the Law requires, including, for contacts it imports, within one month or with the first message;
- contacts people only as they would expect from their enquiry or as their consent allows, and honours every request to stop at once;
- answers the requests people make about their information within the times the Law sets; and
- does not enter special categories of personal data (such as health, religion or criminal records) in the CRM unless the Law allows it.
14. Liability
Each party is liable as the Law provides, including Article 64: Lanpages is liable for damage caused by the processing only where it has not complied with the Law's obligations directed at processors or has acted outside or contrary to the Agent's lawful instructions. Otherwise the limitations of liability in the Terms apply, to the extent the Law allows. Nothing in this Agreement reduces either party's own duties under the Law.
15. Duration, Changes and Law
This Agreement applies for as long as Lanpages processes Lead Data for the Agent. Lanpages may update it to reflect changes in the Law or the Services, telling users in the same way as for the Terms. It is governed by the laws of the DIFC, and the DIFC Courts have jurisdiction, as in the Terms.
Annex 1. Details of the Processing
| Subject matter | Hosting and managing the Agent's leads and contacts in the Lanpages Services |
|---|---|
| Duration | For as long as the Agent's account is open, and until erasure as in section 11 |
| Nature | Collection through Lanpages and web forms, import from files the Agent provides, storage, organisation, display in the CRM, sending alerts and automatic replies by email or WhatsApp as the Agent sets up, export, deletion |
| Purpose | To let the Agent receive, manage and answer enquiries about properties and keep its client records |
| Types of personal data | Name, email address, telephone number, project or property of interest, message and answers to the Agent's questions, files the person attaches, campaign or source, date and time, WhatsApp messages through the Services, marketing preference, and the notes, stages, tags and deals the Agent records |
| People concerned | Prospective buyers, sellers, tenants and investors who enquire, and the contacts the Agent adds or imports |
| Special categories | None are needed or requested by the Services |
Annex 2. Security Measures
- Encrypted connections (HTTPS) for the workspace, the Lanpages and every form, with browsers told to use HTTPS only.
- Passwords stored only as salted one-way codes (PBKDF2); one-time codes stored only as one-way codes and valid for 10 minutes.
- A code by email to confirm each new browser, automatic sign-out after inactivity, and a limit on repeated wrong passwords.
- The administration area needs both a staff role and a separate password; support staff see only support tickets.
- Each account's data kept in its own folder; documents and backups in a private storage bucket, served only through short-lived signed links.
- Protection against automated abuse on forms: robot checks, hidden traps, timing checks and per-connection limits.
- Screening of page text and images before publication.
- Nightly backups to separate storage, kept in rotation; erasure that zeroes the freed space in the database.
- A register of incidents and a procedure for breaches, including notice to the Commissioner and to the Agents concerned.
Annex 3. Sub-processors
The sub-processors that may process Lead Data, as listed in section 6 of the Privacy Policy:
| Sub-processor | For Lead Data | Location |
|---|---|---|
| Render Services, Inc. | Hosting of the application and database | United States |
| Cloudflare, Inc. | File storage (attached files), backups, robot checks | Worldwide data centres |
| Resend, Inc. | Lead alerts and automatic replies by email | United States |
| Meta Platforms, Inc. (WhatsApp Business Platform) | WhatsApp lead alerts to the Agent and automatic WhatsApp replies to people who enquire, when the Agent switches them on: telephone number, name, project and message text | United States and other countries where Meta operates |
Anthropic, Stripe and Google do not receive Lead Data; integrations the Agent connects itself (for example advertising platforms) act under the Agent's own arrangements with them.
Cookie preferences
You can choose which cookies we may use. Your choice can be changed at any time.
Necessary cookies
Required for core functions such as security, authentication, session management, account access, and saving your privacy preferences.
Analytics cookies
Help us understand which pages are visited, how visitors move through the site and how it performs, so we can improve it.
Functional cookies
Remember choices such as language or display settings and enable extra personalisation.
Marketing and advertising cookies
May be used to measure advertising, understand campaign performance and show more relevant advertising. They may be set by us or by third-party advertising and analytics providers.