Version 1.0 · forms part of the Terms of Service
This Data Processing Addendum ("DPA") forms part of the Terms. Terms not defined here have the meanings given in the Terms or in the Personal Data Protection Act 2010, as amended (the "PDPA").
1. Roles. With respect to Customer Data, Customer is the data controller and Provider is the data processor. Processing by Provider as a data controller under Part C is governed by Part C.
2. Instructions. Provider will process Customer Data only on Customer's documented instructions, being these Terms and Customer's configuration and use of the Services, unless otherwise required by law. Provider will inform Customer if, in its opinion, an instruction infringes the PDPA.
3. Security. Provider will implement technical and organisational measures in accordance with Section 9 of the PDPA, including: (a) encryption of data in transit and of backups; (b) a separate database for each customer; (c) role-based access controls and audit logging; (d) restriction of uploaded files from public access; and (e) daily backups retained for 30 days.
4. Personnel. Provider will limit access to Customer Data to personnel who require it to provide the Services and who are bound by obligations of confidentiality.
5. Sub-processors. Customer authorises Provider to engage the sub-processors listed below. Provider will give Customer at least 30 days' notice before adding or replacing a sub-processor and will impose on each sub-processor data protection obligations no less protective than this DPA.
| Sub-processor | Purpose | Location |
|---|---|---|
| SYOKHOST | Hosting, databases and backups | Malaysia |
| Anthropic, PBC | AI features | United States |
| SYOKHOST | System email | Malaysia |
6. Cross-Border Transfers. Customer acknowledges that AI features transfer relevant Customer Data to Anthropic, PBC in the United States. Provider will carry out any transfer of personal data outside Malaysia in accordance with Section 129 of the PDPA and applicable guidelines. Under its commercial terms, Anthropic may not train its models on data submitted through the Services.
7. Personal Data Breach. Provider will notify Customer without undue delay, and in any event within 24 hours, after becoming aware of a personal data breach affecting Customer Data, and will provide reasonable assistance to enable Customer to meet its notification obligations to the Commissioner and to affected data subjects.
8. Data Subject Requests. Provider will provide reasonable assistance to enable Customer to respond to requests from data subjects to access, correct or port their personal data, or to withdraw consent. Provider will promptly refer to Customer any such request it receives directly.
9. Audit. On Customer's written request, not more than once per year or following a personal data breach, Provider will provide within 30 days the information reasonably necessary to demonstrate its compliance with this DPA.
10. Return and Deletion. Within 30 days after termination, Provider will make Customer Data available for export and will then delete it from production systems. Backup copies will be deleted in the ordinary course within 30 days thereafter. This Section does not apply to De-identified Data under Part C.