Last Updated: 14.10.2026
This Data Processing Addendum (the “DPA”) forms part of and is incorporated by reference into the agreement governing Customer’s use of the services provided by Alayof Digital Ltd. (“Alayof”), operating under the Pioneera brand, including the applicable terms of use, order or other agreement (the “Agreement”).
This DPA applies only to the extent Alayof processes Customer Personal Data on behalf of Customer.
1. DEFINITIONS AND ROLES
“Applicable Data Protection Law” means applicable laws governing the processing of Customer Personal Data, including, where applicable, the GDPR, UK GDPR and applicable U.S. state privacy laws.
“Customer Personal Data” means Personal Data processed by Alayof on behalf of Customer in connection with the Services.
“Personal Data Breach” has the meaning given under Applicable Data Protection Law.
Capitalized privacy terms not defined here have the meaning given under Applicable Data Protection Law.
As between the parties, Customer is the Controller or Business and Alayof is the Processor, Service Provider or Contractor, as applicable, with respect to Customer Personal Data.
Alayof shall, where required by Applicable Data Protection Law, designate a data protection officer (“DPO”). Contact details for Alayof’s DPO or applicable data protection contact point are available upon written request.
Alayof may process account, billing, security, support and business relationship information as an independent Controller where Alayof independently determines the purposes and means of such processing.
2. PROCESSING INSTRUCTIONS
Alayof shall process Customer Personal Data only:
1. to provide, operate, maintain, secure, troubleshoot and support the Services;
2. to perform actions initiated or configured by Customer through the Services;
3. in accordance with the Agreement, this DPA and Customer’s documented instructions; or
4. as otherwise required by applicable law.
The Agreement, Customer’s use and configuration of the Services, and written instructions consistent with the Agreement constitute Customer’s documented instructions.
If applicable law requires Alayof to process Customer Personal Data contrary to Customer’s instructions, Alayof shall inform Customer before doing so unless prohibited by law.
Alayof shall inform Customer if, in its reasonable opinion, an instruction infringes Applicable Data Protection Law.
3. CUSTOMER RESPONSIBILITIES
Customer is responsible for:
1. the lawfulness, accuracy and content of Customer Personal Data;
2. providing all required notices and obtaining all necessary rights, consents and lawful bases for the processing;
3. determining whether the Services are appropriate for Customer’s intended processing;
4. configuring and using the Services in accordance with Applicable Data Protection Law; and
5. responding to Data Subjects except to the extent Alayof is required to assist under this DPA.
Unless Alayof expressly agrees otherwise in writing, Customer shall not use the Services to process:
• special categories of Personal Data under Article 9 GDPR or equivalent sensitive data;
• criminal conviction or offence data;
• payment card data subject to PCI DSS;
• government identification numbers; or
• other highly sensitive Personal Data.
4. CONFIDENTIALITY AND SECURITY
Alayof shall ensure that persons authorized to process Customer Personal Data are bound by appropriate confidentiality obligations.
Alayof shall implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data, taking into account the nature of the processing and the risks involved.
Alayof may modify its security measures from time to time, provided that it does not materially reduce the overall level of protection for Customer Personal Data.
Customer remains responsible for the security of its accounts, credentials, devices and configuration of the Services.
5. SUBPROCESSORS
Customer grants Alayof general authorization to engage Subprocessors to process Customer Personal Data.
Alayof shall maintain a current list of its Subprocessors at https://security.pioneera.io/.
Alayof shall enter into appropriate written agreements with its Subprocessors imposing data protection obligations required by Applicable Data Protection Law.
Alayof remains responsible for its Subprocessors’ compliance with such obligations to the extent required by Applicable Data Protection Law.
Alayof shall update the list of subprocessors with any intended new Subprocessor at least ten (10) days before that Subprocessor begins processing Customer Personal Data.
Customer may object during that period solely on reasonable and documented data protection grounds. The parties shall attempt in good faith to resolve the objection.
If the objection cannot reasonably be resolved, Alayof may elect not to provide the affected functionality, or Customer may terminate the affected Service. This shall be Customer’s sole remedy in connection with the objection.
Where advance notice is impracticable because of an emergency concerning security, availability or legal compliance, Alayof may engage the Subprocessor and provide notice as soon as reasonably practicable.
6. ASSISTANCE
Taking into account the nature of the processing and information available to Alayof, Alayof shall provide reasonable assistance required under Applicable Data Protection Law in connection with:
1. Data Subject requests;
2. security obligations and Personal Data Breaches;
3. data protection impact assessments; and
4. consultations with competent supervisory authorities.
Alayof shall use commercially reasonable efforts to assist Customer with Data Subject requests within the timeframe required by Applicable Data Protection Law, and in any event within a period that allows Customer to meet its own applicable deadlines for responding to Data Subjects.
If Alayof receives a Data Subject request concerning Customer Personal Data, Alayof may refer the Data Subject to Customer unless legally required to respond directly.
To the extent permitted by Applicable Data Protection Law, Customer shall reimburse Alayof for reasonable costs incurred in providing assistance requiring material resources beyond the ordinary functionality of the Services, except to the extent caused by Alayof’s breach of this DPA.
7. PERSONAL DATA BREACHES
Alayof shall notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data for which notification to Customer is required under Applicable Data Protection Law.
Alayof shall provide, to the extent information is available to it, such information as Customer reasonably requires to satisfy its applicable notification obligations, including: (a) the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects and Personal Data records concerned; (b) the name and contact details of the applicable data protection officer or other relevant contact point; (c) the likely consequences of the Personal Data Breach; and (d) the measures taken or proposed to address the Personal Data Breach, including measures to mitigate its possible adverse effects. Where not all information can be provided simultaneously, it may be provided in phases without undue further delay. Alayof shall take reasonable steps to mitigate the effects of the Personal Data Breach.
Unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, including unsuccessful login attempts, scans, probes and similar events, are not Personal Data Breaches for purposes of this DPA.
Notification or response to a Personal Data Breach does not constitute an acknowledgment of fault or liability.
8. RETURN AND DELETION
Upon termination or expiration of the applicable Services, Customer may request return of Customer Personal Data within thirty (30) days, to the extent such data remains available to Alayof.
Upon completion of deletion of Customer Personal Data from Alayof’s active systems, Alayof shall, upon Customer’s written request, provide Customer with written confirmation that deletion has been completed in accordance with this Section 8.
Unless Customer requests return during that period, Customer instructs Alayof to delete Customer Personal Data, and Alayof shall delete Customer Personal Data from its active systems within thirty (30) days following termination or expiration of the applicable Services. Customer Personal Data contained in operational logs may remain until deleted in the ordinary course of Alayof’s log retention cycle, which as of the date of this DPA does not exceed thirty (30) days following termination or expiration.
Customer may instead instruct Alayof to delete Customer Personal Data earlier.
Customer Personal Data contained in backups may remain until overwritten or deleted through Alayof’s ordinary backup cycle, and in any event for no longer than ninety (90) days following the applicable deletion obligation, provided that such data remains protected under this DPA, is put beyond ordinary use and is not otherwise processed except for disaster recovery, security or legal compliance.
Alayof may retain Customer Personal Data to the extent required by applicable law.
9. COMPLIANCE INFORMATION AND AUDITS
Alayof shall make available information reasonably necessary to demonstrate its compliance with its obligations as a Processor under Applicable Data Protection Law.
Customer shall first use reasonable documentary means to verify compliance, including Alayof’s standard security and compliance documentation and responses.
If additional verification is reasonably required under Applicable Data Protection Law, Customer may conduct an audit no more than once in any twelve-month period, unless additional review is reasonably required following a material Personal Data Breach or by a competent supervisory authority.
Any audit shall:
1. be limited to processing of Customer Personal Data;
2. be conducted on at least thirty (30) days’ prior written notice unless a shorter period is legally required;
3. occur during normal business hours and avoid unreasonable disruption;
4. be conducted by Customer or an independent auditor that is not a competitor of Alayof and is subject to confidentiality obligations;
5. not provide access to information concerning other customers, source code, trade secrets or information whose disclosure would create a security risk; and
6. be conducted at Customer’s expense.
Alayof may charge its reasonable costs of supporting an audit unless prohibited by Applicable Data Protection Law.
Nothing in this Section requires Alayof to provide Customer with any particular third-party audit report, certification or confidential report.
10. INTERNATIONAL TRANSFERS
Alayof may process Customer Personal Data in Israel and in countries in which Alayof or its authorized Subprocessors operate, as identified in Alayof’s Subprocessor list.
Alayof shall ensure that any international transfer of Customer Personal Data, including any access to Customer Personal Data by a Subprocessor located outside Israel, is made in accordance with Applicable Data Protection Law.
Where an applicable adequacy decision permits the transfer, the parties may rely on such adequacy decision. Where additional safeguards are required, Alayof shall implement an applicable lawful transfer mechanism, including, where appropriate: (a) the European Commission’s Standard Contractual Clauses for the transfer of personal data to third countries adopted pursuant to Commission Implementing Decision (EU) 2021/914 (“EU SCCs”); (b) the UK International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner’s Office (“UK IDTA”); or (c) such other appropriate safeguards as permitted under Applicable Data Protection Law.
Alayof shall also comply with applicable Israeli requirements concerning transfers of Personal Data outside Israel, including the requirements of the Privacy Protection Law, 5741-1981, and the Privacy Protection Regulations (Transfer of Data to Databases Abroad), 5761-2001, as amended or replaced from time to time.
The foregoing transfer mechanisms shall apply only to the extent legally required.
11. U.S. PRIVACY LAWS
To the extent Alayof processes Personal Information as a Service Provider, Contractor or equivalent under applicable U.S. privacy law, the parties agree that the specific business purposes for the processing are:
• providing and operating the Services;
• performing data synchronization, integration and other functions configured or initiated by Customer;
• maintaining, securing and troubleshooting the Services; and
• providing Customer support relating to the Services.
Customer discloses Personal Information to Alayof solely for these limited and specified purposes.
To the extent required by applicable U.S. privacy law, Alayof shall:
1. not sell or share Customer Personal Information;
2. not retain, use or disclose it for purposes other than the specified business purposes or as otherwise permitted by applicable law;
3. not retain, use or disclose it outside the direct business relationship between Customer and Alayof except as permitted by applicable law;
4. not combine it with Personal Information received from another person or collected through Alayof’s own interaction with a consumer except where permitted by applicable law;
5. provide the level of privacy protection required of a Service Provider or Contractor;
6. assist Customer with applicable consumer requests as required by law;
7. notify Customer if Alayof determines that it can no longer meet its applicable obligations; and
8. permit Customer, upon reasonable notice, to take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Information.
The compliance rights provided in Section 9 satisfy Customer’s right to take reasonable and appropriate steps to verify Alayof’s processing, except to the extent Applicable Data Protection Law requires otherwise.
12. LIABILITY AND GENERAL
Each party’s liability arising from or relating to this DPA is subject to the exclusions, limitations and aggregate liability cap contained in the Agreement.
THIS DPA DOES NOT CREATE A SEPARATE OR ADDITIONAL LIABILITY CAP.
To the maximum extent permitted by law, all liability arising from this DPA shall count toward, and not be in addition to, the aggregate liability cap under the Agreement.
If this DPA conflicts with the Agreement regarding the processing of Customer Personal Data, this DPA controls solely to the extent necessary to resolve that conflict.
Nothing in this DPA expands Alayof’s obligations beyond those applicable to Alayof under Applicable Data Protection Law.
This DPA terminates automatically when Alayof ceases processing Customer Personal Data on Customer’s behalf.
Alayof may update this DPA from time to time to reflect changes in law or the Services, provided that no update materially reduces the data protection obligations required by Applicable Data Protection Law.
The governing law and dispute resolution provisions of the Agreement apply to this DPA except where Applicable Data Protection Law requires otherwise.
SCHEDULE 1
DETAILS OF PROCESSING
Item | Description |
|---|---|
Subject Matter | Processing of Customer Personal Data in connection with providing the Services. |
Duration | The term of the applicable Services, plus the limited deletion and backup periods described in this DPA. |
Retention Period | For the duration of the applicable Services, plus the deletion and backup retention periods described in Section 8, and any additional period required by applicable law. |
Nature and Purpose | Accessing, transmitting, synchronizing, organizing, displaying, storing where applicable, retrieving, deleting and otherwise processing Customer Personal Data as necessary to provide, maintain, secure, troubleshoot and support the Services and perform actions configured or initiated by Customer. |
Categories of Data Subjects | Customer’s personnel, users, contractors, customers, prospective customers, suppliers, business partners and other individuals whose Personal Data Customer chooses to process through the Services. |
Types of Personal Data | Personal Data submitted to, contained in, or made accessible through Customer’s use of the Services, including names, contact information, identifiers, communications, project and task information, and other content as determined by Customer. |
Sensitive Data | Not intended or permitted except where Alayof expressly agrees otherwise in writing. |
Frequency | As initiated by Customer or its configuration of the Services, and on a periodic scheduled basis for synchronization integrity checks. |
Customer’s Rights and Obligations | As set forth in the Agreement and this DPA. |
SCHEDULE 2
SUBPROCESSORS
Alayof maintains its current list of authorized Subprocessors at:
The Subprocessor list is incorporated into this DPA by reference and may be updated in accordance with Section 5.