Data Processing Agreement

Last Updated: Nov 07, 2024

​

This Data Processing Agreement (“DPA”), between (i) Customer (“Data Controller”, or "you") and (ii) Myma Digital Limited (“Data Processor”, "Myma.ai", "we", or "us") collectively known as the “Parties” and individually known as a “Party”.

​

1.    Subject Matter
1.1.    This DPA applies to the processing of personal data subject to the Data Protection Laws in the scope of the agreement between the Parties (“Service Agreement”) governing the provision of our AI Chatbot, Digital Compendium, Digital Vouchers & eGifts, and Space Booking (“Services”). This DPA shall come into effect on the date both parties have signed it. This DPA forms part of and is incorporated into the Service Agreement, and except as modified below, the terms of the Service Agreement shall remain in full force and effect. In the event of any inconsistency between the provisions of this DPA and the provisions of the Service Agreement, the provisions of this DPA shall prevail.

1.2.    The term Data Protection Laws shall mean (i) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (“General Data Protection Regulation” or “GDPR”),  (ii) The Privacy Act 1988 (AU), (iii) The Privacy Act 1993 No 28 (the NZ Privacy Act 2020), (iv) The Personal Data (Privacy) Ordinance (the “PDPO”) regulated by The Office of the Privacy Commissioner for Personal Data, Hong Kong, and (v) to the extent applicable to the Parties, data protection laws of any other country.

1.3.    All capitalized terms that are not expressly defined in this DPA will have the meanings given to them in the Service Agreement. 

​

2.    Processing
2.1.    An overview of the categories of the Personal Data, the categories of data subjects, and the nature and purposes for which the Personal Data are being processed by the Data Processor on behalf of the Data Controller are specified in Annex 1.

2.2.    The Data Processor shall process Personal Data on behalf of the Data Controller and in accordance with its documented instructions, for the sole purpose of performing its obligations under the Service Agreement or as otherwise reasonably instructed by the Data Controller, and not for the Data Processor's own purposes or other commercial exploitation, and always in compliance with all applicable Data Protection Laws. If Data Processor believes an instruction violates the Data Protection Laws, Data Processor shall inform the Data Controller without undue delay.

2.3.    At any time during the term of this DPA at the Data Controller’s request or upon the termination or expiration of the Service Agreement, the Data Processor shall promptly return to the Data Controller all copies, whether in written, electronic or other form or media, of the Personal Data in its possession, or securely dispose of all such copies, and certify in writing to the Data Controller that such Personal Data has been returned or disposed of securely within 7 days of the request. Data Processor shall comply with all directions provided by Data Controller with respect to the return or disposal of the Personal Data. The Data Processor shall notify all third parties supporting its own processing of the Personal Data of the termination of the DPA and shall ensure that all such third parties shall either destroy the Personal Data or return the Personal Data to the Data Controller, at the discretion of the Data Controller. This DPA shall remain in force until the termination of the Personal Data processing and the erasure of the data by the Data Processor and any sub-processors.

2.4.    The Data Processor’s failure to comply with any of the provisions of this DPA shall be deemed to be a material breach of the Service Agreement. In such event, Data Controller may terminate the Service Agreement effective immediately upon written notice to the Data Processor without further liability or obligation to Data Controller.

3.    Confidentiality and Technical and Organizational Measures
3.1.    Without prejudice to any existing contractual arrangements between the Parties, the Data Processor shall treat all Personal Data as confidential and it shall inform all its employees, agents and/or approved sub-processors engaged in processing the Personal Data of the confidential nature of the Personal Data. The Data Processor shall ensure that all such persons or parties have signed an appropriate confidentiality agreement, are otherwise bound to a duty of confidentiality, or are under an appropriate statutory obligation of confidentiality. This confidentiality obligation shall survive the termination of the DPA.

3.2.    Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Data Processor shall implement appropriate technical and organizational measures to ensure a level of security of the processing of the Personal Data appropriate to the risk. Measures shall include, as appropriate, measures for protection against unauthorized or unlawful processing, against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure of, or access to the Personal Data, and measures to ensure confidentiality and integrity of the Personal Data.

3.3.    The Data Processor shall regularly monitor its compliance with the respective technical and organizational measures, the Data Protection Laws, and accepted industry standards or practices, and will verify this monitoring upon the Data Controller’s request. The Data Processor shall not materially decrease the overall security measures during the term of the Service Agreement.

4.    Information and Audit
4.1.    The Data Processor shall make available to the Data Controller on request all information necessary to demonstrate compliance with this DPA and the Data Protection Laws, and shall allow for and contribute to audits, including on-site inspections, by the Data Controller or an auditor mandated by any Data Controller in relation to the Processing of the Personal Data.

4.2.    Upon Data Controller’s written request, Data Processor shall make available to the Data Controller details of technical and organizational measures implemented, all sub-processors engaged, and a copy of Data Processor’s then most recent third-party audits or certifications, as applicable.

4.3.    Data Processor will provide Data Controller with full and prompt cooperation and assistance in relation to any data protection impact assessment or regulatory consultation that the Data Controller is legally required to make.

5.    Sub-processors
5.1.    The Data Processor shall not subcontract any of its Service-related activities consisting (partly) of the processing of the Personal Data or requiring Personal Data to be processed by any third party without the prior written authorization of the Data Controller. The Data Controller’s consent to the engagement of specific sub-processors, if applicable, shall be specified in Annex III.

5.2.    If authorised by the Data Controller, the Data Processor shall enter into a written agreement with each sub-processor on terms which offer at least the same level of protection for Data Controller Personal Data as those set out in this DPA and meet the requirements of the article 28(3) of the GDPR prior to the sub-processor processing any Personal Data, and ensure that the relevant obligations (including but not limited to the information and audit rights) can be directly enforced by the Data Controller against the Data Processor’s sub-processors.

5.3.    The Data Processor remains responsible for its sub-processors and liable for their acts and omissions as for its own acts and omissions and any references to Data Processor’s obligations, acts and omissions in this DPA shall be construed as referring also to the Data Processor’s sub-processors.

5.4.    The Data Processor shall inform the Data Controller of any new sub-processors Data Processor intends to engage to process the Personal Data. The Data Controller may object to the engagement of any new sub-processor but shall not unreasonably withhold its consent to such appointment.

5.5.    The Data Processor shall ensure that the sub-processor is bound by data protection obligations compatible with those of the Data Processor under this DPA, shall supervise compliance thereof, and must in particular impose on its sub-processors the obligation to implement appropriate technical and organizational measures in such a manner that the processing will meet the requirements of Data Protection Law.

5.6.    The Data Controller may request that the Data Processor audit a Third Party Sub-processor or provide confirmation that such an audit has occurred (or, where available, obtain or assist customer in obtaining a third-party audit report concerning the Third Party Sub-processor’s operations) to ensure compliance with its obligations imposed by the Data Processor in conformity with this Agreement.

6.    Data Subject Rights
6.1.    The Data Processor shall assist Data Controller by implementing appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of the Data Controller' obligations, as reasonably understood by Data Controller, to respond to requests to exercise data subject rights under the Data Protection Laws. 

6.2.    The Data Processor shall promptly notify the Data Controller of any data subjects requests or complaints regarding Personal Data. The Data Processor shall not respond to such requests except on the documented instructions of the Data Controller or as required by applicable laws to which the Data Processor is subject, in which case the Data Processor shall inform the Data Controller of that legal requirement before responding to the request. The Data Processor shall upon Data Controller’s request provide reasonable efforts to assist Data Controller in responding to such data subject request.

6.3.    If a data subject or a supervisory authority brings a claim against Data Controller for damages suffered in relation to Data Processor’s breach of this DPA or Data Protection Laws, Data Processor shall indemnify Data Controller and its affiliates and their respective directors, officers, employees, agents and subcontractors,  from and against all losses, damages, liabilities, deficiencies, actions, judgments, interest, awards, penalties, fines, costs or expenses of whatever kind, including reasonable attorneys’ fees, the cost of enforcing any right to indemnification hereunder and the cost of pursuing any insurance providers, arising out of or resulting from any third party claims against Data Controller, its affiliates and their respective directors, officers, employees, agents and subcontractors arising out of or resulting from Data Processor’s failure to comply with any of its obligations under this DPA and/or the Data Protection Law.

7.    Incidents
7.1.    When the Data Processor becomes aware of an incident that has a material impact on the Processing of the Personal Data that is the subject of the Services Agreement, it shall promptly notify the Data Controller about the incident, shall at all times cooperate with the Data Controller, and shall follow the Data Controller’s instructions with regard to such incidents, in order to enable the Data Controller to perform a thorough investigation into the incident, to formulate a correct response, and to take suitable further steps in respect of the incident.

7.2.    The term “incident” used in Article 7.1 shall be understood to mean in any case:

(a)    a complaint or a request with respect to the exercise of a data subject’s rights under Data Protection Law.
(b)    an investigation into or seizure of the Personal Data by government officials, or a specific indication that such an investigation or seizure is imminent.
(c)    any unauthorized or accidental access, processing, deletion, loss or any form of unlawful processing of the Personal Data.
(d)    any breach of the security and/or confidentiality as set out in Article 3 of this DPA leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, the Personal Data, or any indication of such breach having taken place or being about to take place.
(e)    where, in the opinion of the Data Processor, implementing an instruction received from the Data Controller would violate applicable laws to which the Data Controller or the Data Processor are subject. 

7.3.    The Data Processor shall at all times have in place written procedures which enable it to promptly respond to the Data Controller about an incident. Where the incident may require a data breach notification by the Data Controller under Data Protection Laws, the Data Processor shall implement its written procedures in such a way that it is in a position to notify the Data Controller without undue delay after the Data Processor becomes aware of such an incident, and in no event later than 24 hours, after becoming aware of an incident. The local data protection authority shall be notified about the data breach notification. Such notification shall as a minimum:

(a)    describe the nature of the incident, the categories and numbers of data subjects and Personal Data records concerned;
(b)    communicate the name and contact details of Data Processor's data protection officer or other relevant contact from whom more information may be obtained;
(c)    describe the likely consequences of the incident; and
(d)    describe the measures taken or proposed to be taken to address the incident including, where appropriate, measures to mitigate its possible adverse effects.

7.4.    In the event of an incident the Data Processor shall (i) promptly investigate the incident, (ii) assist Data Controller with any investigation, making available all relevant records, logs, files, data reporting and other materials required to comply with applicable law, regulation, industry standards or as otherwise required by Data Controller, and (iii) as soon as possible remedy and take action to prevent any further breach. Data Processor will provide Data Controller with reasonable assistance to satisfy any legal obligations (including obligations to notify supervisory authorities or data subjects) of Data Controller in relation to the incident and reimburse actual costs incurred by Data Controller in responding to, and mitigating damages caused by, any incident, including all costs of notice and/or remediation.

8.    Data Transfers
8.1.    The Data Processor shall promptly notify the Data Controller of any planned permanent or temporary transfers of Personal Data to a third country, including a country outside of the European Economic Area without an adequate level of protection, and shall only perform such a transfer after obtaining authorization from the Data Controller, which may be refused at its own discretion. 

8.2.    Annex 1 provides a list of transfers for which the Data Controller grants its authorization upon the conclusion of this Data Processing Agreement. The Parties shall comply with the Controller-to-Processor EU Standard Contractual Clauses (“Standard Contractual Clauses”) whereby Data Controller will be regarded as the Data Exporter and the Data Processor will be regarded as the Data Importer. In addition, the Data Processor agrees to comply with all applicable Data Protection Laws in respect of such transfers. In the event of inconsistencies between the provisions of the Standard Contractual Clauses, this DPA or the Service Agreements between the parties, the Standard Contractual Clauses shall take precedence. 

8.3.    To the extent that the Data Controller or the Data Processor are relying on a specific statutory mechanism to normalize international data transfers and that mechanism is subsequently modified, revoked, or held in a court of competent jurisdiction to be invalid, the Data Controller and the Data Processor agree to cooperate in good faith to promptly suspend the transfer or to pursue a suitable alternate mechanism that can lawfully support the transfer without undue delay.

8.4.    The Data Controller may by at least 30 (thirty) calendar days' written notice to the Data Processor from time to time make any variations to this DPA as it applies to transfers which are subject to a particular Data Protection Law, which are required, as a result of any change in, or decision of a competent authority under, that Data Protection Law, to allow those restricted transfers to be made (or continue to be made) without breach of that Data Protection Law and propose any other variations to this DPA which the Data Controller considers to be necessary to address the requirements of any Data Protection Law.

9.    Jurisdiction Specific Terms

The terms specified in ANNEX IV with respect to the listed jurisdictions will apply in addition to the terms of this DPA.

10.    Severance
Should any provision of this DPA be invalid or unenforceable, then the remainder of this DPA shall remain valid and in force. The invalid or unenforceable provision shall be either (i) amended as necessary to ensure its validity and enforceability while preserving the parties’ intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein.

​

11.    Counterparts 
This DPA may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same document. Delivery of an executed signature page to this DPA by facsimile or electronic means (e.g. e-mail, PDF) shall be effective to the same extent as if such party had delivered a manually executed counterpart.
This DPA is entered into and becomes a binding part of the Service Agreement with effect from the date first set out above.