Bektav — Data Processing Agreement

Bektav and tScribe are two names of the same Service, provided by the same company from the same systems: an account made under either name is one account, kept in one database and managed by the same administrators; this document applies to both.

Last updated: 1 November 2026

This Data Processing Agreement ("DPA") forms part of the Bektav Terms of Service (the "Terms") between the Customer ("Controller") and NEXUS IT SOLUTIONS, of Hillel Yaffe 44, Hadera, Israel ("Processor"). Terms not defined here have the meaning given in the Terms.

1. Definitions

• Data Protection Law — the Israeli Protection of Privacy Law, 5741-1981, and its regulations (including the Protection of Privacy (Data Security) Regulations, 5777-2017, and the Transfer of Data Abroad Regulations, 5761-2001), and, where they apply to the Controller, the EU GDPR and the UK GDPR.
• Customer Personal Data — personal data contained in the Content that the Processor processes on the Controller's behalf.
• Security Incident — a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• Sub-processor — a third party engaged by the Processor that processes Customer Personal Data.
• "Controller", "processor", "data subject", "processing" have the meanings in Data Protection Law (in Israeli terms, the Controller is the database owner and the Processor the database holder).

2. Roles and instructions

2.1. The Controller determines the purposes and means of processing Customer Personal Data; the Processor processes it only on the Controller's documented instructions. The Terms, this DPA and the Controller's use and configuration of the Service are the Controller's complete instructions.

2.2. The Processor will tell the Controller if, in its opinion, an instruction infringes Data Protection Law, and is not required to follow it.

2.3. The Controller is responsible for the lawfulness of the Customer Personal Data and of its instructions, including having a legal basis for recording conversations, obtaining messages and creating voice prints, and for giving notices to and obtaining consents from data subjects.

2.4. Details of the processing are in Annex 1.

3. Processor's obligations

The Processor will:

• (a) process Customer Personal Data only to provide the Service, and not sell it, use it for advertising or use it to train or improve machine learning models;
• (b) ensure that persons authorized to process it are bound by confidentiality and access it only as needed to provide support or as required by law; every support visit is recorded and visible to the Controller's administrators;
• (c) implement the technical and organizational measures in Annex 2, and maintain the security documentation required of it under the Data Security Regulations;
• (d) taking into account the nature of the processing, assist the Controller, by appropriate measures, in answering data subjects' requests (the Service lets the Controller find, correct, export and delete Content itself), and in security, impact assessments and consultations with authorities, to the extent the Controller cannot do so itself;
• (e) promptly forward to the Controller any request from a data subject about Customer Personal Data, without answering it except as instructed;
• (f) notify the Controller of a legally binding request by an authority for Customer Personal Data, unless the law forbids it.

4. Sub-processors

4.1. The Controller authorizes the Sub-processors listed in Annex 3.

4.2. The Processor will notify the Controller at least 30 days before adding or replacing a Sub-processor. The Controller may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Controller may terminate the affected subscription and receive a refund of prepaid fees for the remaining term.

4.3. The Processor will bind each Sub-processor by written terms giving at least the same protection as this DPA and remains responsible for its Sub-processors' performance.

4.4. Controller-directed services. Where a User enables a third-party service with the User's or Controller's own account or key (such as translation with Claude by Anthropic), that third party processes data under its own agreement with the User or Controller and is not a Sub-processor of the Processor.

5. Location and transfers

Customer Personal Data is hosted in Israel (Oracle Cloud Infrastructure, Jerusalem region). The Processor will not transfer Customer Personal Data outside Israel except to the Sub-processors in Annex 3, or as directed by the Controller under section 4.4, and in accordance with Data Protection Law. Israel benefits from an adequacy decision of the European Commission.

6. Security Incidents

6.1. The Processor will notify the Controller without undue delay, and in any case within 48 hours after becoming aware of a Security Incident affecting Customer Personal Data, at the e-mail of the Controller's main administrator.

6.2. The notice will describe, as far as then known, the nature of the incident, the data and data subjects concerned, its likely consequences and the measures taken or proposed; further information will follow as it becomes available.

6.3. The Processor will take reasonable steps to contain the incident and mitigate its effects, and will cooperate with the Controller in any notification to the Privacy Protection Authority, other authorities or data subjects. Notifying the Controller is not an acknowledgement of fault.

7. Deletion and return

7.1. During the term the Controller can export its Content (project exports and encrypted project backups) and delete it at any time. A project the Controller archives is kept in its organization's archive for 30 days (or the period shown in the Service) and then deleted, unless the Controller brings it back first.

7.2. On termination the Processor will delete Customer Personal Data as described in section 11.4 of the Terms — from the live systems at once when the Controller closes its account, and from automatic backups within 3 days — unless the law requires it to be kept, or the Controller has instructed the Processor to archive it. An archived organization's Customer Personal Data is kept unchanged and out of use (no one can sign in to it) for the retention period the Controller instructs (7 years unless agreed otherwise, at most 30 years), restored only on the Controller's instruction, and deleted automatically at the end of that period — or earlier on the Controller's instruction — and from automatic backups within 3 days after.

8. Audits

8.1. On request, no more than once a year, the Processor will answer a reasonable written security questionnaire and provide the information necessary to demonstrate compliance with this DPA.

8.2. Where that information is not sufficient, or where an authority requires it, the Controller may carry out an audit, by itself or an independent auditor bound by confidentiality, on 30 days' notice, during business hours, at its own cost and without access to other customers' data.

9. Liability, term and precedence

9.1. Each party's liability under this DPA is subject to the limitations in the Terms, to the extent permitted by Data Protection Law.

9.2. This DPA applies for as long as the Processor processes Customer Personal Data.

9.3. If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails. Where the GDPR applies to the Controller and requires standard contractual clauses or other terms, the parties will agree on them.

Annex 1 — Details of the processing

Annex 2 — Technical and organizational measures

Access control

• Sign-in with passwords stored as scrypt hashes; password rules and expiry (default 90 days, set by the Service operator); sign-out after inactivity (default 60 minutes).
• Two-step sign-in by SMS code, which an organization may make mandatory; "trusted browser" for at most 30 days.
• Role-based access (administrator, editor, viewer…) and per-project membership; users see only the projects they are members of.
• Staff support access only when needed; each visit recorded and shown to the organization's administrators.
• Administrative access to the infrastructure limited to the Processor's named personnel, with individual credentials and multi-factor authentication for the cloud console.

Separation

• Each organization's data is kept apart from other organizations'; each project has its own database schema and file storage.

Encryption

• HTTPS (TLS) for all access to the Service.
• Data at rest encrypted by Oracle Cloud Infrastructure storage and database encryption.
• Project backups made by users encrypted with the user's passphrase (age format).

Integrity and logging

• A change log in every project (who changed what, when).
• Sign-in sessions with IP address, device and times visible to the user and administrators.
• Sealed projects: a fingerprint of the content that reveals later changes.

Availability and resilience

• Hosted on managed Kubernetes in Oracle Cloud Infrastructure, Jerusalem region.
• Automatic daily database backups, kept for up to 3 days.

Processing locally

• Speech recognition, speaker identification, reading of pictures and the built-in translation run on the Processor's own servers; Content is not sent to third-party AI services unless a user enables one under section 4.4.

Organizational

• Personnel bound by confidentiality.

Annex 3 — Authorized Sub-processors