Verifier Agreement & Data Processing Addendum

Parties: Clyro (operated by Clyro Trade & Technology S.A.E.) and the Verifier (the individual/firm accepting). Acceptance: recorded electronically with timestamp/IP (verifier_agreement_acceptances).

PART A — Verifier Agreement (all verifiers)

A1. Role

You are engaged to review verification evidence assigned to you on the Clyro platform (documents, certificates, registry checks within your competencies and assigned countries) and to record a decision (verify / reject / request more). You act as a reviewer of evidence; you do not represent that Clyro guarantees any outcome.

A2. The AI assistant is advisory only

Where an AI document-scan recommendation (Thoth) is shown beside an assigned check, it is recommend-only — it never decides. You, the human verifier, make the determination. You must not defer your judgment to the AI suggestion.

A3. Confidentiality

Verification evidence and the personal/business data within it are confidential. You agree to: access only checks assigned to you; not copy, download (except via the platform's controls), retain, or disclose the evidence outside the platform; and use it solely to perform the assigned verification. Confidentiality survives termination. [LEG CONFIRM term/survival.]

A4. Integrity & anti-circumvention

You agree to verify honestly and competently, to declare any conflict of interest, and not to use platform data or contacts to solicit, circumvent, or transact outside Clyro. Falsifying a verification or leaking data is grounds for immediate termination and may incur liability.

A5. Security

You will protect your account (strong credentials; MFA where required), not share access, and report any suspected compromise immediately. Document links are short-lived and access is logged; misuse is detectable.

A6. Independence & status [LEG CONFIRM]

[For external verifiers] You are an independent contractor, not an employee/agent of Clyro; nothing here creates a partnership or authority to bind Clyro. [Define fees/scope in a separate engagement schedule if applicable.]

A7. Term, suspension & termination

Clyro may suspend, freeze, or revoke your verifier access at any time (e.g. on suspected breach, expiry, or end of engagement); on revocation your access ends immediately and your open checks are reassigned. You may stop at any time on notice.

A8. Liability & governing law [LEG CONFIRM]

[Limitation of liability; indemnity for breach of confidentiality/misuse; governing law = [LEG CONFIRM — Egypt]; dispute resolution.]

☐ I have read and accept this Verifier Agreement.

PART B — Data Processing Addendum (external verifiers only)

Where you (the Processor) process personal data contained in verification evidence on behalf of Clyro (the Controller), this DPA applies. [LEG CONFIRM against Egypt PDPL / GDPR / KSA PDPL as applicable.]

B1. Scope & roles

Clyro is the Controller; you are a Processor acting only on Clyro's documented instructions (the assigned verification tasks). Subject matter: review of exporter/supplier/facility verification documents. Data subjects: individuals named in those documents. Data types: identity, business, and document data; potentially sensitive identifiers [LEG CONFIRM].

B2. Processor obligations

You will: (a) process only on instruction and only for the assigned verification; (b) keep the data confidential (Part A3); (c) implement appropriate security measures (MFA, no local retention, access only via the platform, no export); (d) not retain any copy after the task — work only within Clyro's environment; (e) not engage sub-processors without Clyro's prior written authorization; (f) assist Clyro with data-subject requests and security/breach obligations; (g) notify Clyro without undue delay of any personal-data breach; (h) delete/return all data on completion or termination and retain nothing.

B3. Step-up MFA & access controls

You must enrol and use step-up MFA. Access is least-privilege (assigned checks only), time-limited, and fully logged. Clyro may freeze access instantly.

B4. International transfers [LEG CONFIRM]

If you are outside the Controller's jurisdiction, appropriate transfer safeguards apply ([SCCs / equivalent]).

B5. Audit & liability [LEG CONFIRM]

[Audit rights; liability allocation; indemnity for Processor breach; term tied to the engagement + Part A.]

☐ I have read and accept this Data Processing Addendum (external verifiers).

☐ I confirm I will enrol step-up MFA before accessing any documents.

Clyro Verifier Agreement & Data Processing Addendum v1.0. Under formal legal review; revisions published as version updates.