Data Processing Agreement

1. Roles

For the personal data of the client's customers and contacts, the client is the data controller (data user under the Personal Data Protection Act 2010) and doTask is the data processor. doTask processes that data only to provide the service and only on the client's documented instructions, which are the client's use and settings of doTask, the Terms of Use and this agreement. If an instruction appears to break the law, doTask will say so.

2. Subject matter, purpose and duration

Purpose: receiving and sending messages on the channels the client connects, answering with the AI Agent from the client's own knowledge, bookings, sales and invoices, customer records, email marketing to contacts who agreed to receive it, social posting, reports, and support.

Data: names, phone numbers, email addresses, messages and attachments, bookings, purchases and payments, notes and records the client keeps, form answers (which may include health details), and usage of the client's website where the client installs our widget.

People: the client's customers, prospects and contacts, and the client's own team.

Duration: for as long as the client uses doTask, and until deletion under section 10.

3. Confidentiality

Everyone at doTask who can reach client data is bound to keep it confidential. doTask staff do not look at a client's data in normal operation; we access it only to resolve a support request the client raised, to investigate a security incident, or where the law requires it.

4. Security

doTask protects client data with the measures described on the Security page, which forms part of this agreement: every connection over HTTPS, data and backups encrypted at rest with AES-256, connected-platform credentials encrypted again with AES-256-GCM, each workspace walled off from every other in the database, signed messages from the platforms, per-member permissions, two-step sign-in, daily backups, and a written incident response plan. doTask may improve these measures but will not reduce the overall level of protection.

5. Subprocessors

The client allows doTask to use the subprocessors listed on the Subprocessors page. doTask binds each to data protection terms at least as protective as these, and remains responsible for them. doTask will tell the workspace owner by email at least 30 days before adding a subprocessor that will process the client's customers' data. If the client objects on reasonable data protection grounds and we cannot resolve it, the client may end its subscription before the change takes effect, with a refund of any prepaid fees for the remaining period.

6. Requests from people

doTask helps the client answer requests from people to access, correct, delete, export (portability) or stop the processing of their data: the client can export a customer's data and delete it in the dashboard. If a request reaches doTask directly, we pass it to the client without answering it ourselves, unless the client asks us to.

7. Personal data breaches

doTask tells the client without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting the client's data, with what happened, the data and people affected, the likely consequences and what we have done. We help the client meet its own duties: to notify the Personal Data Protection Commissioner within 72 hours and the people affected within 7 days where the breach is likely to cause significant harm, and the equivalent duties under the UK GDPR and EU GDPR. doTask keeps a record of every breach.

8. Transfers outside Malaysia

Client data is stored in Singapore and processed by the subprocessors in the countries listed on the Subprocessors page (including Australia and the United States). doTask transfers data only to providers bound by contractual data protection terms and holding independent security certifications, as the Personal Data Protection Act 2010 allows. For clients in the United Kingdom or the European Union, transfers use the UK International Data Transfer Addendum or the EU Standard Contractual Clauses. A transfer impact assessment is available on request.

9. Information and audits

On request, once a year, doTask gives the client the information needed to show that this agreement is kept: a completed security questionnaire, our subprocessors' certificates or reports where they allow it, and the status of our ISO/IEC 27001 work. Where the law or a regulator requires more, the client may audit, with 30 days' notice, at its own cost, during business hours, without access to other clients' data and under confidentiality.

10. Return and deletion

The client can export its data at any time. When the client closes its workspace or its subscription ends, doTask deletes the client's data within 30 days, unless the law requires us to keep part of it (for example invoices, for tax), and it leaves our backups within a further 7 days. On request, doTask confirms the deletion in writing.

11. Clients in the UK or EU

Where the UK GDPR or EU GDPR applies, this agreement is doTask's commitment under Article 28: processing only on documented instructions, confidentiality, security under Article 32, the subprocessor terms above, help with people's rights and with security, breach notice and impact assessments, deletion or return at the end, and information for audits.

12. Contact and order

doTask's Data Protection Officer is Zack Lam, at [email protected]. If this agreement and the Terms of Use differ on personal data, this agreement applies. It is governed by the laws of Malaysia.