Roles
The workspace owner decides what data their surveys collect and why — they are the controller. Jawab stores and processes that data on the owner's documented instructions — it is the processor. Jawab never uses a workspace's respondent data for its own purposes.
Scope of processing
Processing covers storing responses and uploaded files, aggregating them into charts and exports, maintaining contact lists the controller's surveys create, and sending the notifications the controller configures — and nothing else.
Sub-processors
The current sub-processor list is published on the sub-processors page and on the security page. The controller is notified of additions with reasonable advance notice and may object on reasonable data-protection grounds.
Security measures
Encryption in transit, role-based access with fresh permission checks on privileged actions, tenant isolation enforced structurally in the data layer, audit logging of administrative actions, and no personal data in technical logs.
Data subject rights
Jawab assists the controller in honouring access, rectification and erasure requests: deleting a response deletes the contact entry it created, and self-serve export and erasure tooling is on the published roadmap.
Breach notification
The processor notifies the controller of any personal data breach affecting their workspace without undue delay, with what happened, what was affected, and the measures taken.
Deletion on termination
When a workspace is deleted, its data is removed from production systems, with backup copies expiring on the backup provider's rotation schedule.
Governing law
This agreement is governed by the laws of the Sultanate of Oman, with jurisdiction in the courts of Muscat. The Arabic text prevails.
Contact
If you have any questions about this page, contact the Jawab team through our official channels, or reach out to the person or programme that shared the survey with you.