GOVERNMENT & ENTERPRISE SERVICES ADDENDUM

What should enterprises know about gOVERNMENT & ENTERPRISE SERVICES ADDENDUM?

(To the Master Terms & Conditions)

What should enterprises know about 1. Purpose & Applicability?

Where there is a conflict, this Addendum prevails over standard consumer terms.

What should enterprises know about 2. Regulatory & Legal Alignment (Saudi-First)?

Kenzie operates services in alignment with, where applicable:

What should enterprises know about 3. Data Sovereignty & Residency Commitments?

For government and regulated enterprise customers:

Which governance and security controls matter for GOVERNMENT & ENTERPRISE SERVICES ADDENDUM?

Government and enterprise environments include:

What should enterprises know about government-Critical Incidents?

For government workloads, escalation paths may include:

1. Purpose & Applicability

• Saudi government entities
• Semi-government bodies
• State-owned enterprises
• Regulated industries (finance, healthcare, telecom, energy)
• Large enterprises requiring enhanced governance

2. Regulatory & Legal Alignment (Saudi-First)

• Saudi Personal Data Protection Law (PDPL)
• Saudi National Cybersecurity Authority (NCA) frameworks
• Cloud Computing Regulatory Framework (CCRF)
• Communications, Space & Technology Commission (CST)
• Vision 2030 digital infrastructure objectives

3. Data Sovereignty & Residency Commitments

• Data residency requirements must be specified in writing
• Sovereign workloads may be restricted to KSA-only infrastructure
• Cross-border processing is disabled unless contractually approved
• Backup and DR locations are disclosed and governed

4. Access Control & Governance

• Named access control (no shared admin accounts)
• Role-based access enforcement
• Privileged access logging
• Geographic access restrictions (where required)
• Separation of duties
• Audit-ready access records

Security & Availability Incidents

• Detect, classify, and respond to incidents promptly
• Notify customers within contractually agreed timelines
• Preserve evidence for regulatory or legal review
• Support investigations and audits

Government-Critical Incidents

• Dedicated response channels
• Executive-level notification
• Regulatory coordination (where legally required)