Data Processing Agreement

1. Parties and roles

Between you (the business customer) and Novatise. For personal data your sites and phones send to the dashboard, you decide and we process it for you: under APPI we are entrusted with it, under the PDPA we are your data intermediary.

2. Subject matter, duration and purpose

We process your data only to provide Cyber Securitise, for as long as you have an account and then until it is deleted (section 9). Never for advertising, profiling, sale or sharing, or to train AI models.

3. Data and people

We do not intend to process sensitive personal data, and you agree not to send it on purpose.

• Visitors to and users of your sites: IP addresses (shortened by default), usernames in sign-in events, user agents in security events.
• Your staff and members: name, email, role, sign-in and audit records.
• Users of protected phones, where you buy phone protection: device name and model, app version and counts of what was blocked or hidden.
• Personal data that happens to appear in a file excerpt of up to 300 characters (keys and passwords masked).

4. Our obligations

• Act only on your documented instructions (the agreement, the terms and your dashboard settings).
• Confidentiality for everyone with access; staff see your data only with your permission, and every access is logged.
• The security measures on the Security page.
• Help you answer requests from the people the data is about, including the dashboard’s data download and account deletion.
• Help with breaches, impact assessments and regulators’ questions, as far as reasonable.

5. Sub-processors

You authorise the providers listed on the Data Processing page. We tell you at least 30 days before adding or replacing one that handles personal data; you can object, and if we cannot solve it, end the affected service with a pro-rata refund. Each is bound to terms at least as protective as ours, and we remain responsible for them.

6. International transfers

The dashboard runs on a server in Japan (Tokyo). Where a sub-processor handles data outside Japan or Singapore, it is bound by contract to protection comparable to APPI and the PDPA.

7. Breaches

We tell you without undue delay, within 72 hours where possible, with what we know, and keep you updated, so you can meet your own duties to regulators and the people affected.

8. Audits

We give you the information reasonably needed to show compliance, including answers to a security questionnaire once a year; an on-site audit is possible where a regulator requires it or after a breach.

9. Deletion and return

You can download your data at any time. After the account is deleted or closed, your data is deleted within 30 days; on request before then we return it as JSON. Stripe keeps invoices as tax law requires.