Data Processing Agreement

Under the Personal Data Protection Act 2010 of Malaysia, as amended ('PDPA'), your business is the data controller of your customers' personal data, and we act as your data processor.

This DPA covers the personal data Watson processes for you in running the service: conversations across phone, WhatsApp, Messenger, and Instagram, bookings and appointment records, customer contact records, payment and deposit records, reminders, and promotion responses ('Customer Data').

It does not cover data for which we are the controller in our own right, such as your account details as our customer. That data is covered by our Privacy Policy.

We process Customer Data only to provide, secure, and support the Watson service for your business, according to the Terms, this DPA, the settings you choose in your dashboard, and the business profile you approve. These are your documented instructions to us.

We do not use Customer Data for our own advertising, and we do not sell it.

If a law requires us to process Customer Data other than on your instructions, we will tell you before we do, unless that law prevents us from telling you. If we believe an instruction from you breaches the PDPA, we will tell you and may pause that instruction until it is resolved.

Data subjects: your customers and patients, prospective customers who contact your business, and your staff members who appear in bookings, rosters, and conversations.

Types of personal data: name, phone number, email address, appointment details such as service, date, time, and staff member, conversation content and call recordings on the channels you connect, payment references and amounts, and any other personal data your customers share in conversations with your business.

Where your business is a clinic or other healthcare provider, appointment and conversation content may reveal information about a person's health. We treat all Customer Data from healthcare businesses with the safeguards the PDPA requires for sensitive personal data.

Watson is administrative only and is not configured to solicit clinical information. Where a customer volunteers it, it is processed only to carry out the administrative task at hand and to hand the conversation to your team where needed.

We implement and maintain technical and organisational measures to protect Customer Data against loss, misuse, and unauthorised access, alteration, and disclosure, consistent with our obligations as a data processor under the PDPA and with the Personal Data Protection Standard issued by the Commissioner. Those measures include, at minimum:

• Encryption of data in transit.
• Access controls, so that Customer Data is accessible only to personnel who need it to operate and support the service, under confidentiality obligations.
• Logical separation of each business's data within our multi-tenant systems.
• Logging and monitoring of access to production systems.
• Credential management and revocation procedures for staff.
• Backup and recovery procedures.

We review these measures periodically and improve them as the service and threats evolve. We will not materially reduce the overall level of protection during your subscription.

Every person we authorise to process Customer Data, including employees and contractors, is bound by written confidentiality obligations or is under an appropriate statutory duty of confidentiality.

You authorise us to engage the sub-processors listed in the annex below to help us provide the service. We remain responsible to you for their performance.

Before engaging a sub-processor, we impose on it, by written contract, data protection obligations that protect Customer Data to a standard no lower than this DPA requires of us.

We will give you at least 14 days' notice before adding or replacing a sub-processor, by email or in your dashboard, and we keep the current list published on this page. If you reasonably object on data protection grounds and we cannot offer an alternative, you may terminate the affected service and receive a pro-rata refund of prepaid fees for the unused period.

The Watson engine and database are hosted in Malaysia, on Amazon Web Services in the Kuala Lumpur region. Some sub-processors process Customer Data outside Malaysia, as set out in the annex below.

Where Customer Data is transferred outside Malaysia, we transfer it only in accordance with section 129 of the PDPA as amended: to places with laws substantially similar to the PDPA or that ensure an equivalent level of protection, or under another lawful basis, and always subject to contractual safeguards with the recipient.

This information is provided so that you can meet your own obligations as a controller, including describing overseas transfers in your registration with the Personal Data Protection Commissioner and in your privacy notices.

If we become aware of a personal data breach affecting Customer Data, we will notify you without undue delay, and in any case within 24 hours of confirming the breach, by email to your registered address and, where appropriate, by phone.

Our notice will describe, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures we have taken or propose to take, and a contact point for more information. We will update you as our investigation progresses.

We will give you reasonable assistance with your own obligations arising from the breach, including your notification to the Personal Data Protection Commissioner and, where required, to affected individuals, within the timelines that apply to you.

We will not notify a regulator or data subjects of a breach affecting Customer Data on your behalf unless you ask us to or the law requires us to.

If a data subject contacts us directly about personal data we process for your business, we will redirect them to you and tell you, unless the law prevents it.

We will give you reasonable assistance in responding to data subject requests under the PDPA, including requests for access, correction, and withdrawal of consent, through the export, correction, and deletion capabilities of the service, and directly where those are not enough.

During your subscription, we keep Customer Data for as long as needed to provide the service and as configured by you.

On termination of your subscription, you can export your Customer Data for 30 days. After that period, we delete Customer Data from live systems, and it is removed from backups in the ordinary course of backup rotation, except for records we are required by law to keep.

At any time, you can ask us to delete specific Customer Data, and we will do so within 30 days of a verified request, except for records we are required by law to keep.

On written request, no more than once in any 12-month period unless a breach has occurred, we will make available the information reasonably necessary to demonstrate our compliance with this DPA: a description of our security measures, our current sub-processor list, and copies of relevant certifications or assessment summaries we hold.

Where that information is not reasonably sufficient, we will cooperate with an audit conducted by you or an independent auditor you appoint, at your cost, during business hours, on at least 30 days' notice, under confidentiality, and no more than once in any 12-month period. Audits may not access another customer's data or compromise the security of the service.

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms, except where the PDPA does not permit liability to be limited.

This DPA starts when you accept the Terms and lasts as long as we process Customer Data for you. The obligations on breach notification, retention and deletion, and audit survive until deletion is complete.

This DPA is governed by the laws of Malaysia.

These are the sub-processors we currently use to run Watson, what each does, and where it processes data. We update this list when the service changes, with the notice described above.

• Amazon Web Services, Inc.: cloud infrastructure hosting the Watson engine and database. Malaysia (Kuala Lumpur region).
• OpenAI, L.L.C.: AI processing of conversations and voice calls. United States.
• Twilio Inc.: phone call connectivity and call recording. United States and global.
• Meta Platforms, Inc.: WhatsApp, Messenger, and Instagram message delivery. United States and global.
• Google LLC: Google Calendar and Gmail integrations, only where your business connects them. United States and global.
• Vercel Inc.: hosting of the web dashboard and this website. United States and global edge network.
• Resend, Inc.: transactional email delivery, such as notifications to your business. United States.

Payment providers behind FPX, DuitNow, Touch 'n Go, GrabPay, and card payments process payment transactions under their own terms when your business connects them; payment card details are handled by those providers, not stored by Watson.

If your business registers as a data controller with the Personal Data Protection Commissioner through the SPDP portal, you can reuse the following wording in your application.

• Purposes (Section B): 'Providing customer service, appointment booking, appointment reminders, payment collection, and marketing to opted-in customers, through an appointed service provider (AlphaSquadX Sdn. Bhd., operating the Watson service) acting as data processor.'
• Types of personal data (Section C): 'Full name, phone number, email address, appointment details, conversation records and call recordings, payment references.'
• Disclosure (Section D): 'AlphaSquadX Sdn. Bhd. (service provider and data processor operating the Watson service), and its sub-processors as published by it.'
• Transfer outside Malaysia (Section E): 'Singapore and the United States: contact details and conversation content are processed by cloud, AI, and telephony providers engaged by our data processor, for the purpose of operating our customer service and booking system.'

Data protection matters under this DPA are handled by our data protection contact: hello@watson.my.