Watchpost Data Processing Agreement

Key points

This summary is for convenience; the numbered clauses are the agreement.

1. About this DPA

1.1 This Data Processing Agreement ("DPA") is between XYZ Sdn Bhd, Company Registration No. 202601000000, of Malaysia ("Watchpost", "we", "us"), and the Customer that accepted our Terms of Service ("you").

1.2 This DPA forms part of the Terms (Terms clause 20.3) and applies automatically whenever we process Customer Personal Data. You accept it electronically by accepting the Terms (Electronic Commerce Act 2006 ss.7 and 9). It is a written contract for GDPR Art. 28(9) and SG PDPA s.4(2). For a countersigned copy, email [email protected].

1.3 It implements the processor duties in the PDPA (ss.5(1A), 9, 12B), GDPR and UK GDPR Art. 28(3) and SG PDPA ss.4(2), 24–26C, cited where applied.

2. Definitions

Terms clause 2 defines Account Data, Agency, Client, Connected Account, Customer Content, Fees, Member, Platform, Platform Data, Platform Terms, Service, Subscription, Workspace and Workspace Owner. In addition:

3. Roles and scope

3.1 Controller and Processor. For Customer Personal Data, you decide why and how it is processed, and we process it only on your behalf (PDPA s.4; GDPR Art. 28; SG PDPA s.4(2)).

3.2 Agencies. If you act for a Client that is the controller, you are its Processor and we are your Sub-processor. You warrant the Client authorised you to engage us on these terms, and you remain our only contact unless the law requires otherwise or you cease to exist.

3.3 Our own data. We are a Controller for Account Data (Members' details, billing records, security logs) under our Privacy Policy.

3.4 Platforms. Connecting an account, publishing or syncing analytics instructs us to exchange data with that Platform. Each Platform is an independent controller under its own Platform Terms, not our Sub-processor, and we are not responsible for its processing. Our payment processor receives no Customer Personal Data.

3.5 Details. Annex A sets out the subject matter, duration, nature and purpose of processing, the personal data types and the Data Subject categories (GDPR Art. 28(3)).

4. Your obligations as Controller

4.1 You must:

(a) have a lawful basis for the Customer Personal Data you put into or retrieve through the Service, including its processing by us and the Platforms (PDPA s.6; GDPR Art. 6);

(b) give Data Subjects the required notices, including that you use a service provider and the Platforms (PDPA s.7; GDPR Arts. 13–14; SG PDPA s.20), and obtain required consents, including explicit consent for sensitive personal data (PDPA s.40; GDPR Art. 9) and a parent's or guardian's consent for anyone under 18 (PDP Regulations reg. 3(3));

(c) not collect personal data unlawfully (PDPA s.130);

(d) give only Instructions that comply with Data Protection Law and the Platform Terms;

(e) hold the owner's authorisation for every Connected Account you do not own (Terms clause 15.2); and

(f) ensure your Members comply with this DPA. Their actions in the Service are your Instructions.

4.2 You answer your Data Subjects and make any breach notifications the law requires of a controller, with our help under clauses 8, 10 and 11.

4.3 The Service is not designed for sensitive, criminal-offence or children's data. We carry out no facial recognition or other biometric processing.

5. Documented Instructions

5.1 We process Customer Personal Data only on your documented Instructions, including on transfers, unless a law applying to us requires otherwise. We will then tell you before processing, unless that law forbids it on important public-interest grounds (GDPR Art. 28(3)(a); SCC Clause 8.1).

5.2 Your Instructions are: (a) the Terms and this DPA; (b) how you and your Members use and configure the Service (connecting, uploading, scheduling, publishing, sharing preview links, exporting, deleting); (c) written instructions sent to [email protected] that we accept; (d) the standing Instructions in clause 15.2; and (e) the limited processing we carry out for security, abuse prevention (including the fair-use checks in Acceptable Use Policy clause 11A, which use publishing counts and one-way codes of post text, never the text), Platform compliance and legal obligations, as Privacy Policy clause 2.3 describes.

5.3 No own use. We do not sell Customer Personal Data, use it for advertising, build profiles from it, train artificial-intelligence models with it or use it for our own purposes beyond clause 5.2(e) (Meta Platform Terms s.3; Google API Services User Data Policy, Limited Use; X Developer Agreement). Where the Platform Terms allow, we may keep fully anonymised, aggregated statistics, such as posts published per Platform.

5.4 Unlawful Instructions. We will tell you immediately if we think an Instruction infringes Data Protection Law, and may suspend it until you confirm or change it (GDPR Art. 28(3)). We do not give legal advice.

5.5 Other requests. If an Instruction needs work outside the Service's normal functions, we will say whether and on what terms we can do it; if we cannot, you may terminate under the Terms.

6. Confidentiality

6.1 Only personnel who need Customer Personal Data to provide, secure or support the Service may access it, and only as far as needed. Each is bound by a continuing written or statutory confidentiality duty (GDPR Art. 28(3)(b)).

6.2 We keep a register of personnel with access, remove access promptly on exit or role change, and train staff (PDP Standard). Support access to a Workspace is limited to named personnel who need it, and changes made through our administration tools are logged (Annex B.3).

7. Security

7.1 As a processor we are directly bound by the Security Principle (PDPA ss.5(1A) and 9). We maintain appropriate technical and organisational measures against loss, misuse, modification, unauthorised or accidental access or disclosure, alteration and destruction, having regard to the nature of the data, potential harm, storage location, equipment security, personnel reliability and secure transfer (PDPA s.9(1); GDPR Art. 32; SG PDPA s.24). Annex B sets out these measures, which are our sufficient guarantees (PDPA s.9(2); GDPR Art. 28(1)).

7.2 Our written security policy follows PDP Regulations reg. 6 and the PDP Standard, is approved by our directors and is reviewed yearly.

7.3 We may update the measures but will not materially reduce overall protection, and we will notify you of material changes.

7.4 You are responsible for your Members and roles, two-factor authentication, preview links and exported data.

8. Personal Data Breaches

8.1 Notice. We will notify you without undue delay after becoming aware of a Personal Data Breach, and in any event within 48 hours, so you can meet your deadlines: 72 hours to the Commissioner and EU/UK authorities, and 3 calendar days after assessment to the PDPC (PDPA s.12B; Commissioner's Guideline on Data Breach Notification; GDPR Art. 33(2); SG PDPA s.26C(3)(a)).

8.2 Content. So far as known, the notice will state: (a) when the breach occurred and was detected, and how; (b) its nature and suspected cause; (c) the data types and approximate numbers of Data Subjects and records; (d) systems affected and likely consequences; (e) containment and mitigation measures; (f) steps Data Subjects can take; and (g) our DPO's contact. Missing information follows in phases, with updates as we investigate.

8.3 Help. We will promptly contain, investigate and remedy the breach (for example by revoking tokens) and help with your notifications (GDPR Art. 28(3)(f)).

8.4 Who notifies. You decide on notifying Supervisory Authorities and Data Subjects about Customer Personal Data; we will not do so in your name unless the law requires. We may inform Platforms or our payment processor as their terms require (for example Meta Platform Terms s.6(b)).

8.5 Records. We log every Personal Data Breach, notifiable or not, in a register kept for at least 2 years (Guideline on Data Breach Notification; GDPR Art. 33(5)).

8.6 Notice is not an admission of fault. We send it to the Workspace Owner's email unless you name another contact.

9. Sub-processors

9.1 Authorisation. You give general written authorisation for Sub-processors (GDPR Art. 28(2); SCC Clause 9(a), Option 2). Annex C lists the categories authorised today, and our Sub-processors page shows the current categories. The current list of named providers, with each one's legal entity, address, processing locations, purpose and transfer safeguard, is available to the Workspace Owner on request at [email protected].

9.2 Notice. We will give the Workspace Owner at least 30 days' notice, by email, before a new or replacement Sub-processor processes Customer Personal Data. The notice names the provider and states its purpose, processing locations, the data involved and the transfer safeguard.

9.3 Objection. You may object on reasonable data-protection grounds to [email protected] within the notice period. We will try in good faith to resolve it, for example by not using that Sub-processor for your data. If we cannot, you may cancel the affected Subscription with immediate effect, with no further charges, or delete the affected Workspace, before the change.

9.4 Emergencies. If we must replace a Sub-processor urgently for security or continuity, we may give shorter notice; clause 9.3 still applies.

9.5 Flow-down. We check each Sub-processor's guarantees and bind it in writing to obligations no less protective than this DPA, including PDPA s.9 security, deletion at the end of the engagement and, for Restricted Transfers, a valid safeguard (GDPR Art. 28(4); PDP Standard). On request we will share a Sub-processor contract's data protection terms, commercial terms removed (SCC Clause 9(c)).

9.6 Liability. We remain fully liable to you for each Sub-processor's data protection obligations (GDPR Art. 28(4)).

10. Data Subject requests

10.1 Tools. You can find, correct and delete Customer Personal Data yourself in the Service, and each Member can export their own data (JSON with their media). A Workspace-wide export is available on request at [email protected]. Together these let you answer requests for access, correction, withdrawal, portability, erasure, restriction and objection (PDPA ss.30–38, 42, 43A; GDPR Arts. 15–22; SG PDPA ss.21–22).

10.2 Requests to us. We will forward any request we receive to you within 5 working days, refer the Data Subject to you, and not answer it ourselves unless you authorise it or the law requires.

10.3 Help. Beyond the tools, we will help by appropriate technical and organisational measures in time for your deadlines: 21 days under the PDPA (plus 14), one month under the GDPR and UK GDPR (plus two) and 30 days under the SG PDPA (GDPR Art. 28(3)(e); SCC Clause 10). We will also help you answer Data Subjects in other countries, who keep the rights their local law gives them. Help is free unless requests are manifestly unfounded or excessive, when we may charge a reasonable fee agreed in advance.

10.4 Platform messages. We will promptly pass on any Meta message about a person's request concerning their Platform Data in your Workspace (Meta Platform Terms s.5(b)), and similar messages from other Platforms.

11. Assessments and regulators

11.1 Considering the nature of processing and the information available to us, we will help you with security, breach notification, impact assessments and prior consultation (GDPR Arts. 28(3)(f), 32–36; Commissioner's DPIA Guideline 2026) and transfer impact assessments (PDPA s.129; Guideline No. 3/2025 on Cross Border Personal Data Transfer; SCC Clause 14), including by providing Annexes A–C, security documentation and our processing records (GDPR Art. 30(2)).

11.2 We will cooperate with a Supervisory Authority's lawful inquiry or inspection concerning Customer Personal Data (PDPA s.101; SCC Clause 13(b)) and, unless prohibited, tell you promptly.

11.3 DPO. We will appoint and register a Data Protection Officer when PDPA s.12A requires (it applies to processors too) and publish the DPO's contact. Until then our privacy contact fills the role. Both are reached at [email protected].

12. International transfers

12.1 Storage and transfers. We store Customer Personal Data on servers we operate or control. Backups are encrypted before they leave our servers, and an encrypted copy is kept by our backup storage provider (Annex C). Our Sub-processors, and the Platforms you connect, may process Customer Personal Data in other countries, but only under the safeguards in this clause 12. A third party starting to host or operate the servers that run the Service is a change under clauses 9.2 and 9.3.

12.2 Malaysia. We transfer Customer Personal Data out of Malaysia only to our Sub-processors (Annex C) and only as PDPA s.129 permits, mainly under contractual clauses requiring PDPA-standard security and processing (s.129(3)(f)) or a documented transfer impact assessment (s.129(2)), and keep transfer records (Guideline No. 3/2025). Data published to a Platform is sent on your behalf; you need a basis for that transfer.

12.3 EU SCCs. For Restricted Transfers under the GDPR from you (data exporter) to us (data importer), the SCCs are incorporated by reference, as follows:

(a) Module 2 where you are a controller; Module 3 where you are a processor (for example an Agency acting for a Client);

(b) Clause 7 (docking) applies;

(c) Clause 9: Option 2, with the notice period in clause 9.2;

(d) Clause 11: the optional independent dispute resolution wording does not apply;

(e) Clause 13: as stated in Annex A, section A.10;

(f) Clause 17: Option 1, Irish law; Clause 18(b): Irish courts; and

(g) Annexes I, II and III are completed by Annexes A, B and C.

SCC Clauses 8.9 (audit) and 8.5 (deletion) operate through clauses 14 and 13, so far as consistent with the SCCs.

12.4 UK Addendum. For Restricted Transfers under the UK GDPR, the UK Addendum is incorporated and applies to the SCCs as completed in clause 12.3: Table 1 by Annex A, Table 2 by clause 12.3, Table 3 by Annexes A–C, and in Table 4 neither party may end it under Section 19.

12.5 Onward transfers. Onward transfers of GDPR or UK GDPR data to Sub-processors outside the EEA or UK use SCCs Module 3 (with the UK Addendum), an adequacy decision or the EU-US Data Privacy Framework (and UK Extension) where the Sub-processor is certified, as Annex C and the named list state (GDPR Arts. 44–46; SCC Clause 8.8).

12.6 Singapore. We protect SG PDPA data to a comparable standard and require the same of onward recipients (SG PDPA s.26; Personal Data Protection Regulations 2021 regs. 10–11).

12.7 Supplementary measures. We maintain a transfer impact assessment of Malaysian law and practice, and the Annex B encryption, access control and logging measures; a summary is available from [email protected] (SCC Clause 14).

12.8 Public authorities. If an authority requests Customer Personal Data, we will notify you unless legally forbidden, challenge unlawful or overbroad requests, disclose the minimum and record the request (SCC Clause 15). We will not voluntarily give any authority direct access to the data or our keys.

13. Deletion and return

13.1 Return. While a Workspace exists, and during the Export Window after deletion or termination, you can export Customer Personal Data with the Service's tools or ask us at [email protected] for a Workspace-wide export (Terms clause 26.5; PDPA s.43A). After a termination by us, the Workspace Owner may ask us for an export within the Export Window.

13.2 Deletion. For a deleted Workspace, the Export Window is also its Deletion Window: until it ends, the Workspace Owner can cancel the deletion in the Service (Data Deletion Instructions clause 4.5). When the Export Window ends, we permanently delete Customer Personal Data from live systems and instruct Sub-processors to do the same; copies in our encrypted backups are deleted as the backups rotate (daily backups within 35 days, monthly backups within 12 months) and are not used meanwhile (GDPR Art. 28(3)(g); SCC Clause 8.5; PDPA s.10; SG PDPA s.25). Platform tokens are revoked and deleted when a Connected Account is removed or the Workspace is deleted.

13.3 Your own deletions and the Platform timelines in clause 15.2 apply sooner. Deleted media stays in trash for 7 days.

13.4 We keep data longer only where a law applying to us requires it, confidentially and only for that purpose.

13.5 On request, we will confirm deletion in writing.

14. Audits and information

14.1 We will make available the information reasonably necessary to show compliance with this DPA and GDPR Art. 28, and allow and contribute to audits, including inspections, by you or an independent auditor you appoint (GDPR Art. 28(3)(h); SCC Clause 8.9).

14.2 Process. (a) We first answer a reasonable written questionnaire and provide our policies, Annex B evidence and any third-party reports we hold. (b) If that is not reasonably sufficient, you may audit on 30 days' written notice, in working hours, normally remotely, once per 12 months, or more often and sooner after a Personal Data Breach or if a Supervisory Authority requires. (c) Auditors must not be our competitors, must keep our information confidential, and may not access other customers' data or weaken our security.

14.3 Costs. Each party bears its own costs; we may charge agreed, reasonable costs only for extra on-site audits beyond clause 14.2(b). We will promptly fix any non-compliance found.

15. Platform commitments

15.1 We keep each Workspace's Platform Data logically separate and process it only on behalf and at the direction of that Workspace (Meta Platform Terms s.5(b), "Tech Provider").

15.2 Standing Instructions. You instruct us to delete or refresh Platform Data as the Platform Terms require, currently:

(a) YouTube: refresh or delete YouTube API data older than 30 days; delete within 24 hours of a disconnection in Watchpost, and within 7 days of a revocation through Google (YouTube API Services Developer Policies III.E.4);

(b) Google Business Profile: delete content older than 30 days (Google Business Profile API policies);

(c) X: delete or modify X content within 24 hours of a written request from X or the account owner (X Developer Agreement s.IV.B);

(d) Meta: delete Platform Data on a valid deletion request, Meta's instruction or when no longer needed (Meta Platform Terms s.3(d));

(e) TikTok: delete TikTok data when TikTok ends our access (TikTok Developer Terms s.VI); and

(f) every Platform: delete Tokens at once and other Platform Data within 24 hours of a disconnection in the Service, and within 7 days of a revocation at the Platform (Data Deletion Instructions clauses 3 and 5).

Changed Platform requirements apply automatically, and we will update this list.

16. Liability

16.1 Liability under this DPA, including under the SCCs and UK Addendum between the parties, is subject to Terms clause 23. The Terms and this DPA share one aggregate cap.

16.2 Nothing limits (a) either party's liability to Data Subjects under the SCCs, the UK Addendum or Data Protection Law (GDPR Art. 82), (b) liability that cannot lawfully be limited, or (c) your indemnity under Terms clause 24.1(c).

16.3 Where both parties caused the same damage to a Data Subject, each bears its share (GDPR Art. 82(4)–(5)). Each party bears fines imposed on it.

17. Other laws

17.1 Singapore. As your data intermediary, we comply with SG PDPA ss.24 and 25 and notify breaches under clause 8 (s.26C(3)(a)).

17.2 United States. Where a US state privacy law makes us your "service provider" or "processor" (for example Cal. Civ. Code s.1798.140(ag)), we will not sell or share Customer Personal Data, will use or combine it only to provide the Service as that law permits, and will tell you if we can no longer comply.

18. Term, changes, precedence and law

18.1 This DPA lasts while we process Customer Personal Data and ends when deletion under clause 13 is complete; clauses meant to survive do so.

18.2 We may change this DPA under Terms clause 27, with 30 days' notice of material changes (for example for new law, guidance, SCCs or Platform rules). If you reject a material change, you may cancel your Subscription with immediate effect, with no further charges (Terms clause 27.2).

18.3 Precedence. For Customer Personal Data, conflicts are resolved in this order: (a) the SCCs and UK Addendum, where applicable; (b) this DPA; (c) the Terms; (d) the Privacy Policy and other policies. Clause 15.2 governs where Platform Terms are stricter.

18.4 Law. Malaysian law governs this DPA, with disputes resolved under Terms clause 28. The SCCs follow clause 12.3(f); the UK Addendum follows the laws of England and Wales.

19. Contacts

Annex A — Details of processing

Also completes Annex I of the SCCs and Tables 1 and 3 of the UK Addendum.

A.1 Parties

A.2 Subject matter. Providing the Watchpost social media scheduling, publishing, collaboration and analytics Service.

A.3 Duration. The term of the Terms, plus the Export Window and the deletion periods in clause 13; items are kept as A.9 states.

A.4 Nature. Collecting content from Members and Platform APIs; storing it; re-encoding and thumbnailing media and stripping metadata (including EXIF location); validating it against Platform rules; scheduling and transmitting it to the Platforms you select; retrieving metrics, including post snapshots for up to 30 days after publishing, and the most recent posts (up to 50) of a newly connected account with their counts; counting publishing activity and hashing post text for the fair-use checks; calculating engagement rates, best-time heatmaps and rule-based insights; displaying data to Members and preview-link holders; sending notification and report emails; producing exports and reports; backing up; deleting.

A.5 Purpose. Providing the Service under the Terms (composing, approving, scheduling and publishing posts, hosting media, collaboration, analytics and reports), supporting and securing it, and complying with law.

A.6 Data Subjects. Your Clients and their owners, staff and representatives; people who appear, are named, tagged, mentioned or quoted in Customer Content (such as customers, staff, models, collaborators, influencers); individuals owning or managing Connected Accounts (such as sole traders or creators); and people who follow, comment on, mention or engage with Connected Accounts, where a Platform returns data identifying them.

A.7 Personal data.

A.8 Sensitive data. None intended. If you include any under clause 4.1(b), the Annex B measures apply; no biometric processing occurs.

A.9 Frequency and retention. Continuous while the Workspace exists.

A.10 Competent supervisory authority (SCC Clause 13). If you are established in the EU, that Member State's authority; if not, but GDPR Art. 3(2) applies and you have an EU representative, the authority where the representative is established; otherwise, the authority of the Member State where the relevant Data Subjects are. For the UK Addendum: the UK Information Commissioner.

Annex B — Technical and organisational measures

Also completes Annex II of the SCCs. Each measure is verified by an automated test or a written procedure.

B.1 Governance. Director-approved security policy reviewed yearly (PDP Regulations reg. 6; PDP Standard); personnel register; confidentiality duties; prompt access removal; incident response plan; breach register; impact-assessment screening; Sub-processor due diligence.

B.2 Authentication. Passwords of 12+ characters checked against common passwords and personal information, and refused if entirely numeric; per-IP and per-account rate limits with progressive lockout and email alerts; no account enumeration; email verification; session rotation; session list with "log out everywhere"; TOTP two-factor authentication for all, mandatory for super-administrators and Workspace Owners, with recovery codes; re-authentication for sensitive actions.

B.3 Access and tenant isolation. Owner, Admin, Editor and Viewer roles; every query scoped to the Workspace; automated tests probing every endpoint with other Workspaces' identifiers; random, unguessable identifiers; administration tools limited to named super-administrators on a non-public address with mandatory two-factor authentication and, where configured, an IP allow-list; every change made through them logged.

B.4 Encryption and secrets. TLS 1.2+ with HSTS; Platform tokens, API keys and webhook secrets encrypted at rest with authenticated encryption and a separately held, rotatable key; secrets never logged, returned by the API or shown in admin, and scrubbed from error reports (error reports also omit local variables and default personal identifiers); backups encrypted with public-key encryption before they leave our servers, the private key kept offline apart from the backups.

B.5 Platform connections. Signed, single-use OAuth state expiring after 10 minutes; PKCE where supported; callbacks validated against session and Workspace; minimum scopes; token deletion on channel removal.

B.6 Application. CSRF protection; Secure, SameSite=Lax cookies, HttpOnly except the CSRF cookie the app must read; nonce-based Content Security Policy; nosniff, referrer, permissions and frame-denial headers asserted by tests; CORS disabled; validation of every request.

B.7 Uploads and minimisation. Content-based type checks; image re-encoding with decompression-bomb limits and metadata (including location) stripped; video probing and transcoding; SVG and HTML rejected; random file names; media served non-executable.

B.8 Outbound requests and webhooks. User-supplied URL fetches block private, loopback, link-local and metadata addresses, re-validate up to 3 redirects and enforce timeouts and size caps; payment processor and Platform webhooks verified in constant time with replay protection and idempotent handling.

B.9 Abuse prevention. Per-user and per-IP API rate limits, stricter on authentication and Platform calls; sign-up honeypot and timing checks; abuse alerts.

B.10 Infrastructure. Non-root containers with read-only file systems where possible; only ports 80 and 443 exposed; database and cache on a private, password-protected network; automatic security updates, firewall and brute-force blocking; request limits and timeouts; physical access to our servers limited to authorised persons, with power backup; where our network security provider's secure connection is used, no inbound port is open.

B.11 Resilience. Daily encrypted database and media backups, kept 14 days on our servers and copied off-site (35 days; monthly copies 12 months), encrypted before they leave our servers; health checks and automatic restarts; recovery runbook.

B.12 Monitoring. Security event log (sign-ins, lockouts, two-factor and role changes, token refreshes, channel connections, admin actions, webhook failures) with anomaly alerts; security.txt and Vulnerability Disclosure Policy.

B.13 Testing. Automated dependency, code and secret scanning on every change, which blocks release on high or critical findings; automated dependency updates.

B.14 Retention. Scheduled deletion jobs enforcing A.9; security logs 2 years; failed sign-ins 90 days; payment notification payloads minimised on receipt and emptied after 30 days.

Annex C — Sub-processors

Also completes Annex III of the SCCs. Our Sub-processors page shows the current categories. The current list of named providers, with each one's legal entity, address, contact, processing locations and transfer safeguard, is available to the Workspace Owner on request at [email protected], and forms part of this Annex.

C.1 Authorised categories of Sub-processors

Servers we operate or control are not Sub-processors. Changes follow clause 9.

C.2 Not Sub-processors. The Platforms (Meta for Facebook Pages, Instagram and Threads; TikTok; Google for YouTube and Google Business Profile; X) are independent controllers receiving what you publish and instruct (clause 3.4). Our payment processor processes Account Data for us and is an independent controller for its own fraud-prevention and regulatory purposes; it receives no Customer Personal Data.

Change log