Watchpost Sub-processors

Key points

This summary is for convenience. The numbered clauses are the binding text.

1. About this page

1.1 This page is published by XYZ Sdn Bhd, Company Registration No. 202601000000, of Malaysia ("Watchpost", "we", "us"), which operates the Watchpost social media scheduling service (the "Service").

1.2 This page is:

(a) our description of the categories of third parties to whom we disclose personal data (PDPA ss.7(1)(e) and 8; PDP Regulations reg. 5);

(b) the "Sub-processors page" referred to in our Terms of Service (clauses 2, 3.3 and 19.1), Privacy Policy (Section 8) and Data Processing Agreement (clause 9 and Annex C); and

(c) for data subject to the GDPR, UK GDPR or SG PDPA, the description of authorised sub-processors and onward transfers (GDPR Art. 28(2); SCC Annex III; SG PDPA s.26).

1.3 This page always shows the current categories. DPA Annex C shows them as at the DPA's date and is updated by this page under Section 10.

1.4 Named providers. The current list of named providers, with each one's legal entity, address, processing locations and transfer safeguard, is available to Workspace Owners on request at [email protected]. We will send it promptly, normally within 5 working days.

2. Definitions

2.1 Words defined in our Terms of Service or DPA (such as Account Data, Customer, Customer Content, Member, Platform, Workspace and Workspace Owner) have the same meaning here. In addition:

3. How we choose and control Sub-processors

3.1 Checks first. We engage only providers that give sufficient guarantees that they will protect personal data, after checking their security and privacy practices (PDPA s.9(2); GDPR Art. 28(1)).

3.2 Written contract. Each Sub-processor is bound by written data protection terms no less protective than our DPA (GDPR Art. 28(4); PDP Standard). It must: process data only on our instructions; keep it confidential; keep it secure to the standard of PDPA s.9; tell us promptly of a personal data breach so we can meet our own deadlines (PDPA s.12B; GDPR Art. 33); help us with data subject requests; delete or return the data when the engagement ends; and use a valid safeguard for any transfer abroad (Section 9).

3.3 Least data. Each provider receives only what it needs.

3.4 Responsibility. We remain responsible to you for each Sub-processor's data protection obligations (DPA clause 9.6; GDPR Art. 28(4)). We review our providers at least yearly, and whenever a provider changes its terms, processing locations or ownership.

4. Where your data is stored

4.1 The Service, including the database and media, runs on servers we operate or control. They are not Sub-processors. Backups are encrypted on our servers, with keys only we hold, before a copy goes to our backup storage provider (Section 5).

4.2 If a third party starts to host or operate the servers that run the Service, we will treat it as a new Sub-processor and give notice under Section 10.

5. Categories of Sub-processors

5.1 A category marked "only where used" receives personal data only while we use that kind of service. We will give notice under Section 10 before we start using a provider in any category.

5.2 Retention. Error reports are kept for no more than 90 days. Encrypted backups rotate: daily copies are deleted after 14 days on our servers and 35 days off-site, and monthly copies after 12 months. Our email delivery provider keeps delivery logs for the period it needs to deliver and secure email, normally no more than 45 days. Our network security provider keeps connection logs for the periods in its own documentation. When an engagement ends, each Sub-processor must delete or return the data (DPA clause 13.2).

6. Our payment processor

6.1 Two roles. Our payment processor is (a) our Sub-processor for the payments we ask it to handle, and (b) an Independent Recipient for its own fraud prevention, anti-money-laundering, know-your-customer and regulatory processing, under its own privacy policy. It may set fraud-prevention cookies on our billing pages (Cookie Policy clause 6).

6.2 Limits. Our payment processor receives no Customer Personal Data (DPA clause 3.4). You enter card details into fields the payment processor hosts, so we never receive or store your full card number or security code.

7. Independent Recipients: the Platforms

7.1 When you connect an account, publish or sync analytics, you instruct us to exchange data with that Platform (DPA clause 3.4). Each Platform is an independent controller under its own terms. It is not our Sub-processor, and we do not control how it uses data. We list them so you can see every company that receives data through Watchpost (PDPA s.7(1)(e); GDPR Art. 13(1)(e)).

7.2 Location. Each Platform processes data where it operates, under its own safeguards (see also Privacy Policy Section 6).

7.3 Your role. For Customer Personal Data you publish, you are the controller and need a lawful basis, including for any transfer abroad, and must give any required notices (DPA clause 12.2; PDPA ss.7 and 129).

7.4 New Platforms. A new connector sends no data until a Member connects an account. Before launch, we will list it here and in our Privacy Policy.

8. Other recipients

8.1 Our professional advisers (under confidentiality), regulators, courts and law-enforcement agencies (where the law requires; PDPA s.39) and a buyer of our business (after we tell you) may also receive personal data. They are not Sub-processors (Privacy Policy Section 8.5; DPA clause 12.8).

9. International transfers and safeguards

9.1 General. Our service providers, and the Platforms you connect, may process personal data in countries other than your own. We allow this only under the safeguards the law requires, as this Section describes.

9.2 Malaysia. We transfer personal data out of Malaysia only as PDPA s.129 permits, usually under contractual clauses requiring PDPA-standard security and processing (s.129(3)(f)), or a documented transfer impact assessment, reviewed at least every three years, showing substantially similar law or adequate protection (s.129(2)). For each transfer we record the recipient, contact, country, data types, purpose and ground relied on (Guideline No. 3/2025 on Cross Border Personal Data Transfer).

9.3 EU and UK. Transfers of GDPR or UK GDPR data to Watchpost are covered by the SCCs (Modules 2 and 3) and the UK Addendum (DPA clauses 12.3–12.4). Onward transfers to Sub-processors outside the EEA or UK use SCCs Module 3 with the UK Addendum, an adequacy decision, or the EU-US Data Privacy Framework (and UK Extension) where the provider is certified (GDPR Arts. 44–46; SCC Clause 8.8). Supplementary measures are in DPA clause 12.7.

9.4 Singapore. Sub-processors must protect transferred data to a standard comparable to the SG PDPA (SG PDPA s.26; Personal Data Protection Regulations 2021 regs. 10–11).

10. Changes to our Sub-processors

10.1 Advance notice. We will give at least 30 days' notice before: (a) a new or replacement Sub-processor starts processing personal data; (b) we start using a provider in a category marked "only where used"; (c) a Sub-processor starts processing personal data in a new country; or (d) a third party starts to host or operate the servers that run the Service. We email each Workspace Owner and update this page. The notice states the provider's name and legal entity, its category and purpose, the processing locations, the data involved, the safeguard, the start date and how to object (DPA clause 9.2; GDPR Art. 28(2); SCC Clause 9(a), Option 2).

10.2 Objections. You may object on reasonable data protection grounds by writing to [email protected] within the notice period. We will try in good faith to resolve it, for example by not using that provider for your data. If we cannot, you may cancel the affected Subscription with immediate effect, with no further charges, or delete the affected Workspace, before the change takes effect (DPA clause 9.3).

10.3 Emergencies. If we must replace a Sub-processor urgently to protect security or keep the Service running (for example, after a provider's breach or failure), we may give shorter notice. We will tell you as soon as we can and explain why. Clause 10.2 still applies (DPA clause 9.4).

10.4 No advance notice needed to stop using a provider, or to update its name, address or certification where its data and processing locations do not change. We record these changes and include them in the named list.

10.5 Account Data. Clause 10.1 also covers Sub-processors that handle only Account Data (Privacy Policy Section 8.2). For those, you may also raise concerns with our Data Protection Officer and use your rights under the Privacy Policy.

10.6 Records. We keep every previous version of this page, of the named list and of our disclosure records. They are available on request and to the Commissioner (PDPA s.44; PDP Regulations reg. 5).

11. More information and contact

11.1 Email [email protected] for: the current list of named providers (clause 1.4); a Sub-processor contract's data protection terms, with commercial terms removed (DPA clause 9.5; SCC Clause 9(c)); a copy of the SCCs and UK Addendum; or a summary of our transfer impact assessment and transfer records.

11.2 Contacts. Data Protection Officer and legal notices: [email protected]. Post: XYZ Sdn Bhd, Malaysia.

11.3 Complaints. Privacy Policy Section 20 explains how to complain to us or to a regulator, including Malaysia's Personal Data Protection Commissioner. People in other countries keep the rights their local law gives them and may contact us to use them.

12. Change log

XYZ Sdn Bhd (Company Registration No. 202601000000) · Malaysia · [email protected] (including our Data Protection Officer)