Data Processing Addendum

This Data Processing Addendum ("DPA") applies to all customers who use the Zaapi platform. It forms part of the Zaapi Terms of Use or any other agreement under which Zaapi provides its services (the "Agreement"). If a customer has signed a separate data processing agreement with Zaapi, that signed agreement applies instead of this DPA. Customers who need a countersigned copy of this DPA can request one at hello@zaapi.com.

1. Parties and scope

1.1 This DPA is between Zaapi Pte. Ltd. (UEN 202041177W), 68 Circular Road, #02-01, Singapore 049422 ("Zaapi" or the "Processor"), and the customer that has accepted the Agreement (the "Customer" or the "Controller"). By accepting the Agreement, the Customer accepts this DPA.

1.2 This DPA governs Zaapi's processing of personal data on the Customer's behalf through the Zaapi platform (the "Platform"), including the personal data of the Customer's end customers who contact the Customer through channels connected to the Platform ("Customer Personal Data").

1.3 If this DPA and the Agreement conflict on the processing of personal data, this DPA prevails. If this DPA and the Standard Contractual Clauses or UK Addendum referred to in Section 7 conflict, those clauses prevail.

1.4 This DPA applies for as long as Zaapi processes Customer Personal Data.

2. Definitions

2.1 "Data Protection Laws" means all laws that apply to the processing of Customer Personal Data under the Agreement, including, to the extent applicable: the Singapore Personal Data Protection Act 2012; the personal data protection laws of Thailand, Malaysia, the Philippines, Vietnam and Indonesia; the EU General Data Protection Regulation 2016/679 ("GDPR"); the GDPR as retained in UK law and the UK Data Protection Act 2018 ("UK GDPR"); and the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its regulations ("CCPA").

2.2 "Personal data", "processing", "controller", "processor", "data subject" and "supervisory authority" have the meanings given in the applicable Data Protection Laws. Under the CCPA, "personal data" means "personal information", "controller" means "business" and "processor" means "service provider".

2.3 "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

2.4 "Sub-processor" means any third party Zaapi engages to process Customer Personal Data.

2.5 "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for transfers of personal data to third countries adopted by the European Commission in Implementing Decision (EU) 2021/914.

2.6 "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018.

3. Roles and processing on instructions

3.1 Roles. For Customer Personal Data, the Customer is the controller (or, where it acts for its own client, a processor) and Zaapi is the processor (or sub-processor). Annex A describes the processing.

3.2 Instructions. Zaapi processes Customer Personal Data only on the Customer's documented instructions, including on international transfers, unless the law Zaapi is subject to requires otherwise. In that case Zaapi will tell the Customer of the legal requirement before processing, unless that law prohibits it. The Agreement, this DPA and the Customer's configuration and use of the Platform are the Customer's complete instructions.

3.3 Zaapi will tell the Customer if it believes an instruction infringes Data Protection Laws.

3.4 Customer responsibilities. The Customer is responsible for the lawfulness of the Customer Personal Data it brings to the Platform, including giving any required notices to data subjects and obtaining any required consents.

3.5 No AI training. Zaapi does not use Customer Personal Data to train, fine-tune or improve any AI model shared with other customers. Zaapi uses Customer Personal Data with AI features only to deliver those features to the Customer.

3.6 Confidentiality. Everyone Zaapi authorises to process Customer Personal Data is bound by a duty of confidentiality. Access is limited to personnel who need it to provide, support or secure the Platform.

3.7 Records. Zaapi keeps a record of the processing it carries out for its customers, as required by Article 30(2) of the GDPR and the UK GDPR where they apply.

4. California (CCPA) terms

4.1 Where the CCPA applies, Zaapi acts as the Customer's service provider. The Customer discloses Customer Personal Data to Zaapi only for the limited and specified business purpose of providing the Platform, as described in the Agreement and Annex A.

4.2 Zaapi does not: (a) sell or share Customer Personal Data, as "sell" and "share" are defined in the CCPA; (b) retain, use or disclose Customer Personal Data for any purpose other than the business purposes in the Agreement, or outside the direct business relationship between Zaapi and the Customer, except as the CCPA permits; or (c) combine Customer Personal Data with personal information it receives from or on behalf of others, or collects from its own interactions with consumers, except as the CCPA permits.

4.3 Zaapi complies with the CCPA's obligations that apply to service providers and provides the same level of privacy protection the CCPA requires of the Customer. Zaapi will notify the Customer if it determines it can no longer meet these obligations, and the Customer may then take reasonable and appropriate steps to stop and remediate any unauthorised use of Customer Personal Data.

4.4 Zaapi certifies that it understands and will comply with the restrictions in this Section 4.

5. Security and Personal Data Breaches

5.1 Security. Zaapi implements and maintains appropriate technical and organisational measures to protect Customer Personal Data, including the measures in Annex B. Zaapi may update these measures, provided the overall level of protection does not decrease.

5.2 Breach notification. Zaapi will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach. Where available, the notice will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point for further information. Where Zaapi cannot provide all the information at once, it may provide it in phases.

5.3 Zaapi will cooperate with the Customer to investigate and remediate a Personal Data Breach, and to meet any obligation to notify supervisory authorities or data subjects. Zaapi's notice of, or response to, a Personal Data Breach is not an admission of fault or liability.

6. Sub-processors

6.1 Authorisation. The Customer gives Zaapi general written authorisation to engage Sub-processors. Zaapi's current Sub-processors are listed at www.zaapi.com/sub-processors (Annex C).

6.2 Changes. Zaapi will update that page at least 14 days before a new Sub-processor processes Customer Personal Data, and will email the change to any Customer contact who has subscribed to updates by writing to hello@zaapi.com.

6.3 Objection. The Customer may object to a new Sub-processor on reasonable data protection grounds within that 14-day period. The parties will discuss the objection in good faith. If they cannot resolve it, the Customer may terminate the affected services on written notice.

6.4 Flow-down. Zaapi binds each Sub-processor by written contract to data protection obligations no less protective than those in this DPA, to the extent applicable to the services the Sub-processor provides. Zaapi remains liable to the Customer for each Sub-processor's performance of those obligations.

7. International transfers

7.1 Customer Personal Data is primarily hosted in Singapore (Amazon Web Services and MongoDB Atlas). Some Sub-processors process Customer Personal Data in other countries, as listed in Annex C.

7.2 Zaapi transfers Customer Personal Data internationally only in compliance with Data Protection Laws, including, under the Singapore Personal Data Protection Act, by ensuring the recipient is bound by legally enforceable obligations giving comparable protection.

7.3 EU transfers. Where the GDPR applies and Customer Personal Data is transferred to Zaapi in a country without an adequacy decision, the SCCs are incorporated into this DPA as set out in Annex D. Module 2 (controller to processor) applies where the Customer is a controller, and Module 3 (processor to processor) applies where the Customer is a processor.

7.4 UK transfers. Where the UK GDPR applies, the SCCs apply as amended by the UK Addendum, as set out in Annex D.

7.5 Onward transfers. Where a Sub-processor receives Customer Personal Data subject to the GDPR or UK GDPR in a country without an adequacy decision, Zaapi puts in place an appropriate transfer mechanism with that Sub-processor, such as the SCCs and, where relevant, the UK Addendum.

8. Data subject requests and assistance

8.1 The Platform lets the Customer access, correct, export and delete Customer Personal Data, so that it can respond to data subject requests (including CCPA requests to know, delete and correct). Where the Customer cannot respond using these features, Zaapi will provide reasonable assistance, taking into account the nature of the processing. Zaapi may charge reasonable fees for assistance beyond the Platform's standard features, where Data Protection Laws allow.

8.2 If Zaapi receives a request directly from a data subject about Customer Personal Data, it will forward it to the Customer and will not respond, except to confirm receipt, unless the Customer instructs it to or the law requires it.

8.3 Taking into account the information available to it, Zaapi will give the Customer reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, where Data Protection Laws require these of the Customer.

9. Audits

9.1 On written request, no more than once in any 12-month period, Zaapi will provide the information reasonably necessary to demonstrate compliance with this DPA, such as written responses to a reasonable security questionnaire and relevant policies or summaries of independent security assessments.

9.2 Zaapi will allow an on-site audit by the Customer or an independent auditor it mandates only where a supervisory authority requires it, where Data Protection Laws (including the SCCs) require it, or after a Personal Data Breach caused by Zaapi. Such audits require at least 30 days' written notice, take place during business hours, are subject to Zaapi's reasonable security and confidentiality requirements, give no access to other customers' data, and are at the Customer's cost.

10. Return and deletion

10.1 Before the Agreement ends, the Customer can export Customer Personal Data using the Platform's export features.

10.2 Zaapi will delete Customer Personal Data within 90 days after the Agreement ends, unless the law requires Zaapi to keep it. Copies in backups are deleted on the normal backup rotation cycle and remain protected under this DPA until deleted.

11. Liability and governing law

11.1 Each party's liability under this DPA is subject to the exclusions and limitations of liability in the Agreement, except where Data Protection Laws or the SCCs do not allow such limitation.

11.2 This DPA is governed by the laws of Singapore, and the parties submit to the exclusive jurisdiction of the Singapore courts. The SCCs and the UK Addendum are governed by the law and forum specified in Annex D.

11.3 Zaapi may update this DPA from time to time, provided an update does not materially reduce the protection given to Customer Personal Data. The version published on this page applies.

Annex A - Details of processing

• Subject matter: provision of the Zaapi AI-powered omnichannel customer engagement platform under the Agreement.
• Duration: the term of the Agreement, plus the deletion period in Section 10.
• Nature and purpose: hosting, storing, routing and displaying customer conversations; AI-assisted replies, translation and summaries; automation; broadcasts; analytics and reporting; customer support and troubleshooting.
• Categories of data subjects: the Customer's end customers and prospects who contact the Customer through connected channels; the Customer's staff who use the Platform.
• Categories of personal data: names; contact details (phone, email, social and messaging handles); message content and attachments; order, delivery and transaction details from connected marketplaces and stores; device and usage data; any other personal data the Customer or its end customers submit through connected channels.
• Special categories: not intended to be processed. The Customer must not submit special category data unless agreed in writing.
• Frequency: continuous, for the duration of the Agreement.

Annex B - Technical and organisational security measures

• Encryption: data encrypted in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent).
• Access control: role-based access with least privilege; multi-factor authentication for privileged access; access limited to engineering staff who need it, with access logging.
• Tenant isolation: every record is tagged to the Customer's store and checked on every request; Customers can limit their staff to specific channels.
• Infrastructure: hosting with Amazon Web Services and MongoDB Atlas in Singapore; network segmentation and firewall controls.
• Monitoring: logging and monitoring of production systems; error and performance monitoring.
• Vulnerability management: regular security updates and patching; periodic independent application security assessments.
• Resilience: backups and disaster recovery procedures; separation of production and development environments.
• People: confidentiality obligations for all staff and contractors; security and data protection training.
• Incident response: a documented incident response process supporting the breach notice in Section 5.
• AI: Customer Personal Data is not used to train or fine-tune shared AI models.

Annex C - Sub-processors

The current list of Sub-processors, with their purpose and location, is published at www.zaapi.com/sub-processors.

Annex D - EU Standard Contractual Clauses and UK Addendum

EU SCCs. For transfers under Section 7.3, the SCCs (Module 2 or Module 3, as applicable) are completed as follows:

• Data exporter: the Customer. Data importer: Zaapi.
• Clause 7 (docking clause): included.
• Clause 9(a): Option 2 (general written authorisation), with the 14-day notice period in Section 6.2.
• Clause 11(a): the optional language is not included.
• Clause 13: the competent supervisory authority is determined under Clause 13(a).
• Clause 17: Option 1; the law of Ireland. Clause 18(b): the courts of Ireland.
• Annex I.A: the parties to this DPA. Annex I.B: Annex A of this DPA. Annex I.C: as determined under Clause 13. Annex II: Annex B of this DPA. Annex III: Annex C of this DPA.

UK Addendum. For transfers under Section 7.4, the UK Addendum is completed as follows:

• Table 1: the parties are the Customer (exporter) and Zaapi (importer), with the details set out in this DPA.
• Table 2: the Approved EU SCCs, with the modules and options set out above.
• Table 3: the information in Annexes A, B and C of this DPA.
• Table 4: neither party may end the UK Addendum under its Section 19.
• Part 2: the Mandatory Clauses of the Approved Addendum (template Addendum B1.0, issued by the UK Information Commissioner).

Questions about this DPA: hello@zaapi.com.