Data Processing Addendum

1. Interpretation

This Addendum ("DPA") governs the processing of personal data by Weave AI Sdn. Bhd. ("Weavey") on behalf of the Client under the Service Terms. Terms defined in the Service Terms have the same meaning here.

"PDPA" means the Personal Data Protection Act 2010 of Malaysia, as amended by the Personal Data Protection (Amendment) Act 2024, together with subsidiary legislation, standards and guidelines issued under it.

"Data Controller" and "Data Processor" have the meanings given in the PDPA.

Where this DPA conflicts with the Service Terms, this DPA prevails in respect of personal data.

2. Roles of the parties

2.1 In respect of End Customer personal data — conversation content, contact details, website behaviour, tracking identifiers, advertising and attribution data and email engagement data — the Client is the Data Controller and Weavey is the Data Processor.

2.2 In respect of the Client's own personnel who use the Weavey console, Weavey is the Data Controller for account, security and billing purposes, as described in Part A of the Privacy Policy.

2.3 Weavey processes End Customer personal data only on the Client's documented instructions, being this DPA, the Order Form, and any further written instruction the Client gives. Weavey will inform the Client if, in its opinion, an instruction infringes the PDPA.

2.4 Change of role. Where Weavey processes personal data for its own purposes rather than the Client's, Weavey acts as a Data Controller for that processing and assumes the corresponding obligations. The only such processing contemplated under this DPA is described in clause 11, and it applies only where the Client has expressly opted in.

2.5 The Client's own obligations. The Client warrants that it has a lawful basis for the processing it instructs, that it has given its End Customers the notice required by the PDPA, that it has obtained any consent required, and that its own privacy notice discloses the use of a service provider such as Weavey and the involvement of AI in responding.

3. Subject matter, duration, nature and purpose

4. Weavey's obligations as Data Processor

Weavey will:

(a) process personal data only on the Client's documented instructions;

(b) take practical steps to protect personal data from loss, misuse, modification, unauthorised or accidental access, disclosure, alteration or destruction, as required by the Security Principle and by the direct obligations imposed on data processors by the PDPA as amended;

(c) ensure that personnel with access to personal data are bound by confidentiality obligations and have received data protection briefing appropriate to their role;

(d) not disclose personal data to any third party except as permitted by this DPA or required by law;

(e) assist the Client in meeting its own PDPA obligations, as set out in clauses 9 and 10; and

(f) maintain a record of the processing it carries out for the Client.

5. Security measures

Weavey implements, at minimum:

• encryption of personal data in transit (TLS) and encryption at rest for stored data;
• role-based access control, with access granted on a need-to-know basis and reviewed regularly;
• multi-factor authentication for administrative and infrastructure access;
• separation of client data by tenant;
• logging of administrative access and of data exports;
• backup of production data on a 14-day retention cycle, with restore testing periodically;
• a documented incident response procedure (clause 7); and
• assessment of sub-processors before engagement.

These controls are organised around the areas covered by ISO/IEC 27001 Annex A. Weavey is not certified to ISO/IEC 27001 and does not represent that it is; the standard is used as a control framework, which is not the same as holding a certificate. Measures may change, provided the level of protection is not materially reduced.

6. Sub-processors

6.1 Consent. The Client authorises Weavey to engage the sub-processors listed below.

6.1A Model providers are not fixed. Weavey uses paid enterprise services from more than one large language model provider — principally OpenAI and Anthropic, and others where a deployment requires them, selected per deployment according to the Client's requirements as to capability, cost, contractual terms or data location. The providers approved for the Client's deployment are listed in the Order Form. The Client may require a specific provider, or exclude one, by written agreement. Weavey will not route the Client's data to a provider not listed for that deployment without first giving notice under clause 6.3.

6.1B Data residency is chosen per deployment. Weavey's default hosting region is AWS Singapore. The Client may specify a different region — including a Malaysian one — before deployment, and the region selected is recorded in the Order Form. Application infrastructure, database and stored Client content sit in that region.

6.1C Inference is not bound to the hosting region. Model providers may process requests at endpoints outside the chosen region. Selecting a hosting region does not confine every AI operation to it. A Client with a strict residency requirement covering inference must state it before deployment so that it can be written into the Order Form; Weavey will decline the engagement rather than accept a requirement it cannot meet.

6.1D Where the chosen region is outside Malaysia, Client data is processed outside Malaysia at rest as well as in transit, and clause 8 applies to that processing as well as to inference.

6.2 Flow-down. Weavey will impose on each sub-processor data protection obligations no less protective than those in this DPA, and remains responsible to the Client for their performance.

6.3 Changes. Weavey will give the Client at least 30 days' written notice before adding or replacing a sub-processor. The Client may object on reasonable data protection grounds within that period, and clause 13.2 of the Terms and Conditions then applies.

6.4 Model training. Weavey will only engage large language model providers whose terms commit that Client data submitted through the API is not used to train their models, and which operate a defined and limited retention period. Weavey will notify the Client if this ceases to be true of a provider in use.

7. Personal data breach

7.1 Weavey will notify the Client without undue delay, and in any event within 24 hours, of becoming aware of a personal data breach affecting the Client's personal data.

7.1A Notification under this clause is not an admission of fault or liability.

7.2 The notification will describe, so far as known: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed.

7.3 Weavey will assist the Client in making any notification the Client is required to make to the Personal Data Protection Commissioner within 72 hours, and to affected data subjects within 7 days where the breach is likely to cause significant harm, in accordance with the PDPA.

7.4 Where the breach concerns personal data for which Weavey is the Data Controller, Weavey makes those notifications itself within the same periods.

7.5 Weavey maintains a written incident response procedure covering detection, containment, assessment, notification and post-incident review, and will make it available to the Client on request.

8. Cross-border transfer

8.1 The Client acknowledges that provision of the Service requires transfer of personal data outside Malaysia, in particular to the large language model provider identified in clause 6.1, and that conversation content leaves Malaysia for this purpose.

8.2 Weavey will make such transfers only in accordance with the PDPA and the Commissioner's cross-border transfer guidelines, and will implement appropriate safeguards with each recipient, including contractual data protection commitments.

8.3 As Data Controller, the Client is responsible for any Transfer Impact Assessment required under the PDPA. Weavey will provide the information about recipients, locations, purposes, retention and safeguards that the Client reasonably requires in order to complete it.

9. Data subject requests

9.1 Where Weavey receives a request directly from a data subject concerning the Client's personal data, it will not respond substantively. It will forward the request to the Client without undue delay and inform the data subject that the Client is the responsible party.

9.1A Messaging opt-out. Where an End Customer asks to stop receiving messages, the Client will instruct Weavey and Weavey will suppress outbound messaging to that End Customer. Suppression is applied at the point of sending and persists across any subsequent import or re-import of contact data by the Client.

9.1B Website tracking. Consent for the tracking script on the Client's website is the Client's responsibility as Data Controller, and is obtained through the Client's own cookie consent mechanism. Weavey will honour a suppression signal passed to it by that mechanism. The Client warrants that it has a lawful basis for the tracking it deploys.

9.2 Weavey will provide reasonable assistance, taking into account the nature of the processing, to enable the Client to respond to requests for access, correction, withdrawal of consent, limitation of processing for direct marketing, deletion and data portability.

9.3 Assistance beyond a reasonable volume of requests is chargeable at the manday rate in the Order Form, on prior notice to the Client.

10. Assistance, audit and cooperation

10.1 Weavey will make available the information reasonably necessary to demonstrate compliance with this DPA.

10.2 The Client may audit compliance once in any twelve-month period, on at least 30 days' written notice, during business hours, at the Client's cost, and subject to confidentiality. Weavey may satisfy an audit request by providing documentation and written responses where these reasonably address the Client's questions.

10.3 Weavey will cooperate with the Personal Data Protection Commissioner in relation to the processing carried out under this DPA.

11. Use of de-identified data to improve the Service

11.1 Where the Client has expressly opted in by ticking the corresponding box in the Order Form, Weavey may use de-identified retrieval logs — records of the types of question asked, with personal identifiers, contact details and free-text personal information removed — to improve the coverage, schema design and retrieval quality of the Service, including for other clients.

11.2 Weavey will not use conversation content, Knowledge Material or End Customer personal data to train any AI model, whether its own or a third party's.

11.3 De-identification will be carried out before the data leaves the Client's tenant environment, and Weavey will not attempt to re-identify de-identified data.

11.4 For processing under this clause, Weavey acts as a Data Controller and assumes the corresponding obligations under the PDPA.

11.5 The Client may withdraw this authorisation at any time on written notice, with effect from the date of notice. Improvements already incorporated into the Service are not reversible and are not affected.

11.6 Where the Client has not opted in, Weavey will not carry out any processing under this clause in respect of the Client's data.

12. Return and deletion

12.1 Personal data processed on the Client's behalf is retained for the duration of the Order Form.

12.2 On termination, Weavey will provide an export of the Client's Knowledge Base and conversation data in a usable format within 14 days of the termination date.

12.3 Weavey will erase personal data held on the Client's behalf from live systems within 30 days of the termination date, and will confirm erasure in writing on request. Encrypted backups still holding a copy are erased on the next full rotation of the backup cycle, which completes within 14 days. Until then a copy may persist in backup, isolated from live systems and not used for any purpose.

12.4 Weavey may retain personal data where required by law, and will keep it only for that purpose and for that period.

12.5 Aggregated and de-identified data processed under clause 11 is not returned or deleted, as it no longer identifies any individual.

13. Minors

13.1 The Client will notify Weavey where the processing it instructs routinely involves personal data of individuals under 18.

13.2 The Client is responsible for obtaining any consent required under the PDPA in respect of a minor, including consent of a parent or guardian where applicable.

13.3 Reserved — to be settled with counsel.

13A. Where the GDPR applies

13A.1 Where the UK or EU General Data Protection Regulation applies to processing under this DPA — because a data subject is in the UK or the EEA, or because the Client is established there — the parties will comply with it in respect of that processing, and this DPA is read as incorporating the obligations Article 28 requires of a processor.

13A.2 Weavey will assist the Client with data subject requests within timescales allowing the Client to respond within one month, and with any data protection impact assessment the Client is required to carry out.

13A.3 Transfers of personal data out of the UK or EEA are made under the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, as applicable, together with any supplementary measures required.

14. Liability

Liability under this DPA is subject to the limitation of liability in clause 19 of the Terms and Conditions.

15. Governing law

This DPA is governed by the laws of Malaysia and is subject to clause 22 of the Terms and Conditions.