Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of, and is incorporated into, the Standardise Terms of Service (the “Terms”) between Standardise Pte. Ltd. (UEN 202630608Z) (“Standardise”, “we”, “us”) and you. It applies automatically – no separate signature is required. Capitalised and defined terms used but not defined in this DPA have the meanings given in the Terms.

Where we process personal data in connection with the Service, the parties’ roles are as follows.

1. (a)Personal data in Customer Data: as between the parties, you are the party responsible for that personal data under applicable data protection laws and we are a data intermediary, processing that personal data on your behalf. We process it only on your documented instructions: the Terms, your Orders and your use and configuration of the Service constitute those instructions. The remainder of this DPA applies to this processing.
2. (b)Your personal data: for personal data relating to you and your Authorised Users’ accounts and use of the Service (such as names, business contact details, login records and usage data), we process such personal data in accordance with our Privacy Policy.

1. (a)Nature and purpose: hosting and processing Customer Data to provide the Service, including generating Output, providing support and maintaining security.
2. (b)Duration: the Term, plus the deletion period in this DPA.
3. (c)Individuals concerned: your personnel and Authorised Users, and individuals appearing in the documents you upload, such as clients, counterparties, witnesses and deponents.
4. (d)Categories of data: any personal data contained in those documents, which may include financial, health or other sensitive information typical of legal proceedings.

The Service is designed so that Customer Data is processed automatically, without routine human review of its content. Where access to Customer Data by our personnel is exceptionally required, for example, to resolve a technical issue at your request, to maintain security, or where required by law, we limit that access to personnel or service providers who need it for the purposes in clause 3.2 of the Terms, and ensure they are bound by confidentiality obligations.

We maintain appropriate technical and organisational measures designed to protect Customer Data against unauthorised access, loss and disclosure, including encryption in transit and at rest, and access controls.

You authorise us to use the following sub-processors to process personal data in Customer Data, each bound by written data protection obligations no less protective than this DPA:

1. (a)Microsoft (cloud hosting and storage); and
2. (b)Amazon Web Services (AI processing).

We will give you at least 30 days’ notice before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we cannot resolve the objection, you may terminate the affected subscription.

If an individual contacts us directly with an access, correction or other request concerning personal data in Customer Data, we will redirect them to you and, taking into account the nature of the processing, provide reasonable assistance to help you respond.

We will notify you of a data breach affecting Customer Data without undue delay and, in any event, within 72 hours of becoming aware of it where feasible. The notice will describe the nature of the breach, the data affected and the measures taken or proposed, and we will cooperate reasonably with your own notification obligations under applicable data protection laws.

You acknowledge that personal data in Customer Data may be transferred to us in Singapore, and may be processed by our sub-processors in the locations in which they provide their services, in order to provide the Service for the purposes set out in this DPA. Where personal data in Customer Data is transferred to a recipient outside Singapore (or outside any other jurisdiction whose data protection laws apply to that data), we will ensure that the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to that under the data protection laws applicable to such data, including standard contractual clauses or other appropriate contractual safeguards.

Customer Data and Output are not retained by us following termination of the Terms and will be deleted from our systems. You are responsible for downloading anything you need before termination takes effect.

Liability arising under this DPA is subject to the Terms. On matters of data protection, this DPA prevails over the Terms. This DPA lasts for as long as we process personal data in Customer Data and survives termination of the Terms until deletion of Customer Data is complete.