/01 Roles
The Client is the controller (data fiduciary in India). Mr.Ooi is the processor. Mr.Ooi processes client personal data only on the Client's documented instructions, which include the Statement of Work.
/02 Data covered
Contact and lead data in the Client's analytics, CRM, forms, ad accounts and Google Business Profiles; website user data in analytics tools; staff contact details. Categories, purposes and duration are as set out in the Statement of Work.
/03 Mr.Ooi's obligations
- Process only for the agreed purposes and keep the data confidential.
- Limit access to staff who need it, under written confidentiality obligations.
- Apply the security measures in the Security Overview and the Client Access and Credentials Policy.
- Use only the sub-processors listed, give 30 days' notice of new ones, and let the Client object.
- Help the Client respond to data subject requests and regulator enquiries.
- Notify the Client without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting client data, with the information the Client needs to meet its own deadlines (for example India's 72-hour report to the Data Protection Board, Malaysia's 72-hour notice, Singapore's 3-day notice after assessment).
- Delete or return client data within 30 days of the end of the engagement, unless law requires retention.
- Make information available to show compliance, and allow one reasonable audit a year on 30 days' notice.
/04 International transfers
Where client data moves across borders, the parties rely on the safeguards required by the laws that apply (for example standard contractual clauses for EU or UK data).
/05 Liability
Liability under this agreement follows the Master Services Terms.
How to sign
Email privacy@mrooi.com for a countersigned PDF with your company details and annexes completed.