MASAR policies
Data Processing Agreement
This DPA is part of the Terms when a business customer uses MASAR for personal data in its support workspace. The customer is the controller and MASAR is the processor.
1. Scope
MASAR processes data to provide support software during the service and agreed closure and backup periods. Processing includes collection through the widget, hosting, display, transmission, backup, return, and deletion. People may include the customer's staff, contacts, and support visitors. Data may include names, contact details, messages, ticket history, files, and other content the customer submits. The parties are the subscribing business and Masar as the provider of MASAR, KVK 96831685, business address Kraijenhoffstraat 38, 5612 PZ Eindhoven, Netherlands.
2. Instructions and confidentiality
MASAR processes workspace data only on the customer's documented instructions, including product settings and authorized user actions, unless law requires otherwise. MASAR informs the customer of a legal requirement when permitted and flags instructions it believes breach data-protection law. People authorized to access the data must be bound by confidentiality.
3. Security and assistance
MASAR applies appropriate security measures, including authenticated access, workspace permissions, private storage, encrypted transport, and recovery arrangements. Taking account of the processing and information available, MASAR helps the customer with rights requests, security duties, breach assessment, impact assessments, and prior consultation when applicable. MASAR informs the customer without undue delay after becoming aware of a breach affecting workspace data.
4. Subprocessors and transfers
The customer generally authorizes the providers on the Subprocessors page where they process workspace data for MASAR. MASAR places equivalent data-protection duties on those subprocessors and remains responsible for their work. Primary application data is hosted in Frankfurt, Germany, and encrypted recovery backups are stored in Cloudflare R2's EU jurisdiction. These locations do not mean that every provider operation stays within the EEA. MASAR gives notice of material subprocessor additions or replacements and a reasonable chance to object before they take effect. Transfers outside the EEA use an applicable GDPR mechanism; information about safeguards is available on request.
5. Return and deletion
At verified closure, the customer may choose return or deletion of workspace data. If return is chosen, MASAR provides a secure temporary download for 30 days from notice of availability, then deletes live data without needing download confirmation. MASAR deletes copies under its control except records the law requires it to keep and recovery backups that expire under the normal rotation. Completed deletions are reapplied before reopening a restored service.
6. Information and audits
MASAR provides information reasonably needed to show compliance with this DPA and cooperates with proportionate customer or independent audits, with appropriate confidentiality, security, and scheduling safeguards.
7. Priority, language, and contact
For workspace personal data, this DPA takes priority over conflicting general Terms; mandatory law takes priority over both. English controls if the English and Arabic versions differ. Send DPA notices and requests to contact@masarhelp.io.
Questions about this document?