1. Parties

Data Processor: BashWeather, operated by Bashar Sawaqed, Hashemite Kingdom of Jordan ("Processor").

Data Controller: The B2B client or partner organisation entering into this agreement ("Controller"). Details to be specified in the signed agreement.

2. Definitions

• Personal Data: Any information relating to an identified or identifiable natural person.
• Processing: Any operation performed on personal data, including collection, storage, retrieval, use, disclosure, or deletion.
• Data Subject: The individual whose personal data is being processed.
• Sub-Processor: A third party engaged by the Processor to carry out processing activities.
• GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council.

3. Subject Matter, Duration & Nature of Processing

BashWeather processes personal data on behalf of the Controller solely for the purposes of providing weather data services, user account management, push notification delivery, and location-based services as described in the agreed service scope. Processing shall continue for the duration of the service agreement and cease upon its termination.

4. Type of Personal Data Processed

• Name and email address (from Google Sign-In)
• Geographic location data (city name, coordinates)
• Device and browser identifiers
• Usage and interaction data
• Push notification subscription endpoints
• Language and preference settings

5. Processor Obligations

• Process personal data only on documented instructions from the Controller
• Ensure that persons authorised to process data are bound by confidentiality
• Implement appropriate technical and organisational security measures (Article 32)
• Assist the Controller in responding to data subject rights requests
• Delete or return all personal data upon termination of services
• Provide all information necessary to demonstrate compliance with this Agreement
• Notify the Controller without undue delay of any personal data breach

6. Sub-Processors

BashWeather currently uses the following approved sub-processors:

The Controller will be notified of any changes to this sub-processor list with at least 14 days' notice.

7. Data Breach Notification

In the event of a personal data breach, BashWeather will notify the Controller without undue delay and within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33. Notification will include: nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed.

8. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA), BashWeather ensures appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) with Google LLC and Cloudflare, Inc., and reliance on the Swiss adequacy decision for Open-Meteo data.

9. Governing Law & Request a Signed DPA

This Agreement is governed by the laws of the Hashemite Kingdom of Jordan, without prejudice to mandatory data protection provisions of the applicable EU/EEA law.