Data Processing Addendum

1. Roles

For tenant business data (customers, sales, stock, staff), the tenant is the data controller and SYSTEMMIZER SOLUTIONS is the data processor, processing only on documented instructions. This Addendum forms part of the Terms of Service.

2. Scope and duration

Processing covers hosting, sync, backup, and in-app tickets you file, for the life of the subscription, in the Malaysia/Singapore regions stated in Security & Compliance. Tenant data — including photos and attachments — is stored in that tenant's own database.

3. Our obligations

• Process personal data only per your instructions, including these terms
• Keep it confidential, and bind staff and subprocessors accordingly
• Maintain the technical and organizational measures in Security & Compliance
• Assist with data-subject requests (access, correction, withdrawal) under the PDPA
• Notify you without undue delay — and within 72 hours where notifiable — of any personal data breach affecting your data

4. Subprocessors

You authorize the subprocessors listed in Security & Compliance. We give 14 days' notice of any change, and you may object on reasonable data-protection grounds.

5. International transfers

Personal data stays in-region by default; any cross-border transfer follows section 129 of the amended PDPA or your explicit instruction.

6. Exit and deletion

Export is self-serve at any time. After termination we delete tenant data per the retention schedule and certify deletion on request.

7. Audits

We answer security questionnaires annually; on-premise audits may be arranged where legally required, at cost, with 30 days' notice.