Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Customer") and EASTAR ASSET MANAGEMENT LIMITED ("GeneX", "we", "us") and applies where GeneX processes personal data on your behalf in connection with the Services. Where this DPA conflicts with the Terms of Service on data-protection matters, this DPA prevails.

1. Roles of the parties.

For personal data contained in Customer Data (the conversations, contacts and content you process through the Services), you are the controller and GeneX is the processor, acting only on your instructions. For your account, billing and website-visit data (such as your account email, IP address and marketing-attribution parameters), GeneX acts as an independent controller under our Privacy Policy.

2. Details of processing.

• Subject matter: hosting, transmitting and processing Customer Data through the GeneX platform.
• Purposes: providing, securing and supporting the Services under the Terms of Service.
• Categories of data subjects: your customers and contacts ("End Users"), your staff members ("Agents").
• Categories of data: contact identifiers (names, phone numbers), message and conversation content, media files, device and usage metadata, and Agent account data.
• Special categories: you must not submit special-category personal data (health, biometric, political, religious and similar) through the Services without our prior written agreement.

3. Processing instructions.

We process Customer Data only to provide the Services, as documented in the Terms of Service, this DPA, and your product configuration. We will inform you if we believe an instruction infringes applicable data-protection law.

4. Confidentiality.

Our personnel who process Customer Data are bound by confidentiality obligations and granted access strictly on a need-to-know basis.

5. Security measures.

We maintain technical and organisational measures including: encryption of data in transit (TLS) and at rest; role-based access control and multi-factor authentication for administrative access; audit logging of administrative actions; IP-address truncation in analytics and marketing-attribution records; automatic deletion of unregistered-lead data within 90 days; least-privilege and secure development practices; and encrypted backups. We may update these measures from time to time, but will not materially reduce their overall level of protection.

6. Sub-processors.

You give us general written authorisation to engage sub-processors. We maintain the current list in Appendix A and give at least 30 days' notice before adding or replacing a sub-processor that processes Customer Data; you may object on reasonable data-protection grounds, in which case we will work with you in good faith and, if the objection cannot be resolved, you may terminate the affected Services with a pro-rata refund of prepaid fees. We remain responsible for our sub-processors' performance of these obligations as if it were our own, and impose data-protection terms at least as protective as this DPA on each of them.

7. Data subject requests.

If we receive a request from one of your End Users or Agents relating to their personal data in Customer Data, we will notify you (unless legally prohibited) and, where possible, direct the individual to you. We provide self-service tools for access, rectification, export and deletion, and will otherwise provide reasonable assistance with such requests.

8. Personal data breaches.

We will notify you without undue delay, and where feasible within 72 hours, of becoming aware of a personal-data breach affecting Customer Data, including what we know about the nature of the breach, the categories and approximate number of records and individuals affected, likely consequences, and measures taken or planned. We will take reasonable steps to assist you with your own notification obligations.

9. International transfers.

We host Customer Data and account data on secure servers in Singapore, with encrypted backups. Singapore benefits from the European Commission's adequacy decision. Where personal data is transferred to a service provider located outside the EEA, the United Kingdom or Switzerland (for example, our email delivery provider in the United States), the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914, Module 2 where you are a controller and Module 3 where you are a processor) and, for the UK, the International Data Transfer Addendum, apply and are incorporated by reference. Our security measures in Section 5, and transfer-impact assessments available on reasonable request, serve as supplementary measures.

10. Audits and certifications.

We maintain third-party certifications at group level, including ISO/IEC 27001. On reasonable request and subject to confidentiality, we will provide our security documentation and applicable audit reports. Where your obligations under applicable law cannot be met through such documentation, we will agree an audit procedure with you in advance.

11. Deletion and return of data.

During your subscription you can export Customer Data using the tools in the product. After termination or expiry you have a 30-day export window; after that we delete Customer Data within 90 days, except backups, which are deleted on their regular rotation cycle not exceeding 90 days, and except data we must retain by law. We will confirm deletion on request.

12. Records of processing.

We maintain records of our processing activities for the Services, in line with Article 30(2) GDPR, and make the relevant information available to you on reasonable request.

13. Order of precedence.

On data-protection matters: the Standard Contractual Clauses (where they apply) prevail over this DPA, and this DPA prevails over the Terms of Service.

14. Contact.

Data-protection questions: info@eastarasset.com.

Appendix A. Sub-processors.

Current sub-processors that may process personal data in Customer Data or account data (as at the effective date of this DPA):

• Alibaba Cloud — cloud infrastructure (ECS) hosting our production systems. Processing location: Singapore. Data-processing terms: Alibaba Cloud Data Processing Addendum (includes EU SCCs and the UK Addendum).
• Resend, Inc. — transactional and notification email delivery. Processing location: United States. Data-processing terms: Resend Data Processing Agreement (includes EU SCCs; SOC 2 Type II certified).

Planned: Airwallex (payment processing) — not yet engaged and processing no data; it will be added to this list before we transmit any personal data to it, together with its data-processing terms (Global Privacy Centre).

Notes. (i) Our domain registrar and DNS provider (Namecheap) and our TLS certificate authority (Let's Encrypt) do not process end-user personal data and are listed here for transparency only. (ii) Core service components (databases, cache and web serving) are self-hosted open-source software running on the infrastructure above. (iii) GeneX product systems, including genex.eastarasset.com, are operated by EASTAR ASSET MANAGEMENT LIMITED or its group companies and are not third-party sub-processors; where a group company other than EASTAR ASSET MANAGEMENT LIMITED processes Customer Data, it is added to this list under the same notice and objection rights as Section 6.

Draft for review · EASTAR ASSET MANAGEMENT LIMITED