Data Processing Agreement

Parties and scope

Between you (the "Organisation") and [OPERATING COMPANY LEGAL NAME] (UEN [UEN]), [REGISTERED ADDRESS], Singapore (the "Processor"), for the personal data the Organisation puts into its Optivis workspace.

Instructions

The Processor processes that data only to provide Optivis CMS as the Organisation uses and configures it, and on its documented instructions.

Security

Each workspace's data is separated at the database level (row-level security) as well as in the application; access is by role; staff access needs the Organisation's time-limited permission and is recorded in its audit log.

Data is encrypted in transit; credentials the Organisation stores (e.g. for its own e-mail server or Xero) are encrypted at rest; backups are encrypted and kept off-site. [FURTHER MEASURES.]

Sub-processors

The Processor uses the sub-processors listed on its sub-processors page and will give [NOTICE PERIOD] notice of changes, during which the Organisation may object.

Breaches

The Processor will notify the Organisation without undue delay, and in any case within [72 HOURS], of a data breach affecting its data, with the information it needs to meet its own obligations under the PDPA.

Assistance, return and deletion

The Processor helps the Organisation respond to individuals' requests. The Organisation can export all its data at any time.

When the Organisation deletes its workspace the data is deleted after 30 days, and from backups as they roll over.

Audit

[AUDIT RIGHTS: to be drafted by counsel.]