Data Processing Agreement

1. What we process and why

Purpose: to run the Managed service: connect Customer's systems, answer questions, build reports and dashboards, and keep them running.

Data: business records in the systems Customer chooses to connect. By default we connect business tables only. We do not connect columns that hold names, email addresses, phone numbers or ID numbers unless Customer asks in writing.

People the data may be about: Customer's own customers, suppliers and staff, where such data is in the connected tables.

Contact data: names and work emails of Customer's staff who send us questions or receive reports.

Duration: while the Managed service or trial runs, plus the deletion period in clause 9.

2. Customer's instructions

We process Customer's data only to provide the Managed service and on Customer's documented instructions. These Terms, this agreement and Customer's written requests by email are the instructions. If we think an instruction breaks the law, we will tell Customer and wait. Customer confirms it has the right to share the data with us and has given any notices its law requires.

3. Our duties

Only staff and systems that run the service can access the data. Everyone with access is bound by confidentiality.

We use read-only access only. We never ask for passwords by email.

We do not sell the data, use it for any other customer, put it in any public material, or use it to train any AI model.

The answers are produced by an AI data analyst that we run. Our team sets it up, checks its work and fixes errors.

4. Security

Data is encrypted in transit (TLS). Connection credentials and keys are encrypted at rest (AES-256-GCM). Customer data is stored in Singapore. Each customer's data is kept separate. We check every day that syncs and reports ran, and we fix faults the same day.

5. Sub-processors

Customer agrees that we use these sub-processors.

Anthropic: the AI model that writes queries and answers. It receives questions, table and column names, and the query results needed for the answer. It may process data outside Singapore.

Render: runs our application. It holds data in memory while an answer is produced, and our application logs. Singapore.

Neon: our database. It holds saved answers, reports, settings and encrypted credentials. Singapore.

Google Workspace: our email, where questions and answers are sent. It holds the emails and attachments Customer sends us and our replies. It may process data outside Singapore.

Each sub-processor is bound by written terms that protect the data at least as well as this agreement. We stay responsible for their work. We will email Customer 14 days before adding or replacing a sub-processor. Customer may object; if we cannot resolve it, Customer may stop the service and we will refund any fees paid for the period after the change.

6. Transfers outside the country

Some processing happens outside Malaysia, Singapore or the UK, as shown in clause 5. We transfer data only to the sub-processors listed there, under terms that give comparable protection. On request we give Customer the information it needs to record or assess a transfer under the Malaysia Personal Data Protection Act 2010 (as amended), the Singapore Personal Data Protection Act 2012 or the UK GDPR.

7. Data breaches

If we become aware of a breach affecting Customer's data, we will tell Customer by email within 72 hours. We will say what happened, what data is affected, and what we are doing about it, and we will keep Customer updated. We will help Customer meet its own duty to notify a regulator or the people affected.

8. Help and audits

We will help Customer answer requests from people to access, correct or delete their data, and with any impact assessment, at no extra charge for reasonable requests. Once a year, or after a breach, Customer may send a written security questionnaire and we will answer it within 30 days. We will also give a regulator the information it lawfully asks for.

9. When the service ends

On the last day of the service we remove our access to Customer's systems and give Customer its metric definitions and the logic (SQL) behind every report. We delete Customer's data, including copies held by sub-processors, within 30 days and confirm in writing. We keep only billing records that the law requires.

10. Liability and law

Liability under this agreement is subject to the limits in the Terms of Service. If this agreement and the Terms conflict on data protection, this agreement wins. This agreement is governed by the laws of Malaysia, without prejudice to data-protection law that applies to Customer.