Skip to content
Sovereign route — served only inside the KingdomInternational route — frontier models, served abroad

Legal

Data processing addendum

Last updated

The terms that apply where you are the controller of personal data and Sigmix processes it on your instructions, written to the shape required by the Saudi PDPL.

This build carries draft wording. Every section marked as a placeholder must be settled with Saudi counsel before launch.

01Roles

For personal data contained in the requests you send to the API, you are the data controller and Sigmix is your data processor.

For the account and billing data described in our privacy notice, Sigmix is the controller in its own right and this addendum does not apply.

02Scope and duration

This addendum applies for as long as we process personal data on your behalf, and it survives termination for as long as we still hold any of that data.

03Our instructions

We process personal data only on your documented instructions, which are the terms of service, this addendum, and the configuration you set in the console.

If we believe an instruction breaches the PDPL or another applicable law, we will tell you and may pause that processing until it is resolved.

We will not use personal data you send for our own purposes, and we will not use it to train or fine-tune any model.

04Confidentiality

Everyone we authorise to process personal data is bound by a written confidentiality obligation, is trained on it, and has access only to what their role requires.

05Security measures

We maintain the technical and organisational measures set out in Annex II. We may change a measure, but not in a way that materially reduces the protection given.

06Subprocessors

Placeholder — counsel review required

You give general authorisation for us to engage subprocessors. Each one is engaged under a written contract that imposes obligations no weaker than this addendum, and we remain liable for what they do.

[PLACEHOLDER — counsel and engineering to confirm: the current subprocessor list, the notice period before a new subprocessor is added, and your right to object. A list that is not published and not kept current fails an enterprise review.]

07Assisting you with data subject requests

If a data subject contacts us directly about data we hold on your behalf, we will not respond substantively. We will pass the request to you promptly.

We will help you meet the rights of access, copy, correction, completion, update and destruction, using the tools in the console and, where those are not enough, by reasonable manual assistance.

08Personal data breach

Placeholder — counsel review required

We will notify you without undue delay after becoming aware of a personal data breach affecting data we process for you, with the facts we hold at the time, the likely consequences and the steps taken.

[PLACEHOLDER — counsel to confirm: the contractual notification deadline, and how it lines up with the regulator deadline in the Implementing Regulations.]

09Deletion and return

On termination, and at your choice, we delete or return the personal data we process for you, and delete existing copies, unless we are required by Saudi law to keep some of it. Where we must keep it, we keep it only for that purpose and continue to protect it.

10Audit and information rights

Placeholder — counsel review required

We will make available the information reasonably needed to demonstrate compliance with this addendum.

[PLACEHOLDER — counsel to confirm: the audit mechanism. Options are a third-party assurance report, a questionnaire, or an on-site audit with notice and frequency limits. Do not promise an assurance report until an auditor and a standard can be named.]

11Transfers outside the Kingdom

Placeholder — counsel review required

Personal data in requests on the sovereign route is processed inside the Kingdom of Saudi Arabia only. Requests on the international route are transferred outside the Kingdom to the providers named for that route, on your instruction, given by using an international key.

[PLACEHOLDER — counsel to confirm: the Article 29 basis and safeguards for international-route transfers, and the published list of international providers with their processing locations.]

12Annex I — details of the processing

  • Subject matter — provision of model inference through the Sigmix Inference API.
  • Duration — the term of the agreement, plus any retention period required by law.
  • Nature and purpose — transmission, in-memory processing, metering and billing of the requests you send.
  • Categories of data subject — determined by you; typically your employees, your customers and your end users.
  • Categories of personal data — determined by you, being whatever your requests contain.
  • Sensitive data — only where you have told us in advance and the key data classification has been set accordingly.
  • Frequency — continuous, for as long as you send requests.

13Annex II — technical and organisational measures

  • Encryption of traffic in transit, and of stored credentials at rest using AES-256-GCM with a key held outside the database.
  • Individually authenticated, least-privilege access to production, with access logged.
  • Passwords stored only as one-way hashes; API keys shown in full once and stored encrypted.
  • Per-key policy controls: concurrency limits, spend caps, cost ceiling per request and data classification.
  • Segregation of customer data at the account and key level.
  • Logged administrative actions, retained for audit.
  • Backup and restore procedures, tested periodically.
  • Documented incident response, with a named accountable owner.

14Order of precedence

If this addendum conflicts with the terms of service, this addendum prevails for the processing of personal data. Everything else in the terms of service stands.