Data Processing Terms and Security Annex

1. Purpose and Scope

These Data Processing Terms ("DPA") form an integral part of the service agreement between the subscriber identified in the applicable Order Form or Subscription Agreement ("Customer", "MCST", or "Managing Agent") and Digital Benefits Pte. Ltd. trading as WiBiz and Ai Living.

This DPA applies to the processing of Customer Personal Data by Ai Living on behalf of the Customer in connection with the provision of the Ai Living condominium intelligence platform, WhatsApp communication workflows, and operational management services.

2. Definitions and Interpretation

For the purposes of this DPA:

• "Applicable Data Protection Law" means the Personal Data Protection Act 2012 of Singapore ("PDPA"), the Personal Data Protection Regulations 2021, the Building Maintenance and Strata Management Act 2004 ("BMSMA"), and any binding regulations or statutory guidelines issued by the PDPC of Singapore.
• "Customer Personal Data" means any personal data processed by Ai Living on behalf of Customer in connection with the provision of the Ai Living platform.
• "Data Breach" means a breach of security leading to the accidental, unauthorised, or unlawful destruction, loss, alteration, disclosure of, or access to Customer Personal Data.
• "Data Intermediary" has the meaning assigned to it in Section 2(1) of the Singapore PDPA (an organisation that processes personal data on behalf of another organisation).
• "Organisation" has the meaning assigned to it in Section 2(1) of the Singapore PDPA (any individual, company, association, or body of persons, corporate or unincorporated, including an MCST).
• "Subprocessor" means any verified third-party vendor engaged by Ai Living to process Customer Personal Data in connection with the platform.

3. Allocation of Roles and Responsibilities

3.1 Customer as Organisation (Data Controller)

The Customer (whether the MCST directly or the appointed Managing Agent acting on behalf of the MCST) is the Organisation under the PDPA:

• Customer determines the purposes, legal basis, and means of processing personal data within the condominium estate
• Customer is solely responsible for ensuring that all necessary consents have been obtained before supplying personal data to Ai Living
• Customer maintains and administers estate by-laws, strata rolls, and resident registration databases

3.2 Ai Living as Data Intermediary (Data Processor)

Digital Benefits Pte. Ltd. acts as a Data Intermediary under Section 4(2) of the PDPA in relation to Customer Personal Data:

• Pursuant to Section 4(2) of the PDPA, a Data Intermediary remains directly subject to the Protection Obligation (Section 24) and the Retention Limitation Obligation (Section 25)
• Ai Living undertakes to comply fully with Sections 24 and 25 of the PDPA and with all contractual commitments set forth in this DPA

3.3 Independent Controller Activities

Digital Benefits Pte. Ltd. acts as an independent Organisation for its own legitimate business operations, including billing administration, contract records, corporate fraud prevention, and platform security logging. Such processing is governed by the WiBiz Trust Center (https://trust.wibiz.ai/) and the Ai Living PDPA Notice.

4. Processing on Documented Customer Instructions Only

Ai Living shall process Customer Personal Data strictly:

1. In accordance with Customer's documented instructions set out in the service agreement, this DPA, and approved software configurations
2. To operate, secure, support, and maintain the contracted Ai Living platform features
3. As required by applicable Singapore laws or court orders, in which case Ai Living shall inform Customer of that legal requirement prior to processing, unless prohibited on important public interest grounds

If Ai Living reasonably believes that a Customer instruction infringes the Singapore PDPA, Ai Living shall promptly notify Customer and may suspend implementation of that instruction pending mutual clarification.

5. Personnel Security and Confidentiality

Ai Living ensures that:

• Access to Customer Personal Data is restricted strictly to personnel who require such access to deliver, maintain, or secure the contracted service
• All employees, contractors, and engineers with access to Customer Personal Data are bound by enforceable confidentiality obligations that survive employment termination
• All personnel receive mandatory annual training regarding data privacy, PDPA compliance, and secure information handling

6. Technical and Organisational Security Measures (TOMs)

In satisfaction of the Protection Obligation under Section 24 of the PDPA, Ai Living implements and maintains the following security controls:

1. Encryption Standards:
   • In Transit: All external and inter-service communications are encrypted using TLS 1.3 or TLS 1.2 with strict cipher suites.
   • At Rest: Database records, file storage volumes, and backup snapshots are encrypted using AES-256.
2. Infrastructure Architecture:
   • Primary database clusters are provisioned in AWS Asia Pacific (Singapore) via Neon, ensuring in-country storage of condominium resident records
   • Web application traffic is protected by automated rate limiting, web application firewalls (WAF), and DDoS protection
3. Privileged Access Management:
   • Multi-factor authentication (MFA) is strictly enforced for all administrative and operational access
   • Zero standing database access: production database modifications require elevated, audited administrative credentials
   • Comprehensive audit logging records administrative actions and system modifications
4. Data Isolation:
   • Multi-tenant data architectures are logically separated by condominium estate ID and MCST account boundaries to prevent cross-estate leakage

7. Subprocessing Framework

7.1 Authorised Subprocessors

Customer provides general written authorization for Ai Living to engage third-party Subprocessors to perform specific processing activities essential to the service. The current register of authorised Subprocessors is set out in Appendix B of this DPA and mirrored at https://trust.wibiz.ai/subprocessors.

7.2 Subprocessor Due Diligence and Obligations

For every Subprocessor engaged, Ai Living:

• Conducts thorough security and privacy due diligence prior to engagement
• Imposes written contractual obligations providing a standard of data protection no less stringent than those established under this DPA
• Remains fully responsible to Customer for the performance of the Subprocessor's obligations to the extent required by Singapore law

7.3 Notification of Subprocessor Changes and Objection Rights

Ai Living shall provide Customer with at least thirty (30) calendar days' advance written notice of any intended appointment or replacement of a Subprocessor. Customer may object to such changes on reasonable, documented data protection grounds within the 30-day notice period. If the parties are unable to resolve the objection amicably, Customer may terminate the affected service without penalty.

8. Assistance with Data Subject Rights Requests

Taking into account the nature of the processing, Ai Living shall provide reasonable technical and operational assistance to enable Customer to respond to requests from residents, owners, tenants, or visitors exercising their statutory rights under the Singapore PDPA:

1. Direct Resident Inquiries: If an individual contacts Ai Living directly regarding personal data processed on behalf of Customer, Ai Living will promptly forward the request to Customer's designated administrative contact within five (5) business days.
2. Platform Tools: Ai Living provides built-in administrative tools allowing Managing Agent personnel to search, update, rectify, or purge resident profiles and booking records directly.
3. Engineering Assistance: Where a complex request requires custom engineering extraction outside ordinary platform capabilities, Ai Living shall reasonably assist Customer at standard professional service rates agreed in advance.

9. Data Breach Notification and Incident Management

1. Notification SLA: Ai Living shall notify Customer without undue delay upon becoming aware of a confirmed Data Breach. Ai Living's operational target is to deliver formal notice within seventy-two (72) hours of breach confirmation.
2. Content of Notice: The notification shall contain, to the extent reasonably known at the time:
   • A description of the nature and scope of the Data Breach
   • The categories and approximate number of data subjects and records concerned
   • The likely operational impact or consequences to individuals
   • The containment, mitigation, and remediation measures undertaken or planned
   • Contact details of the WiBiz Security Incident Commander
3. Phased Reporting: Information may be provided in phases as forensic investigations progress. Notification shall not be construed as an admission of fault or liability.
4. Regulatory Reporting: Customer determines whether a breach meets the mandatory notification threshold under Section 26D of the PDPA (significant harm to individuals or scale of 500 or more individuals) and is responsible for notifying the PDPC and affected individuals. Ai Living will cooperate reasonably to supply required technical details.

10. Compliance Assistance and Data Protection Impact Assessments (DPIAs)

Taking into account the nature of processing and information available, Ai Living shall reasonably assist Customer with:

1. Customer's obligations under the Singapore PDPA regarding security assessments
2. Conducting Data Protection Impact Assessments (DPIAs) regarding automated communication workflows
3. Responding to inquiries or formal requests from the Personal Data Protection Commission (PDPC) of Singapore

Standard operational summaries and architecture whitepapers are provided at no charge via the WiBiz Trust Center. Bespoke compliance documentation requiring substantial engineering time may be provided subject to advance written agreement.

11. International Data Transfers

1. Primary Residency in Singapore: Ai Living maintains its primary databases and computing workloads in Singapore (AWS Asia Pacific Singapore).
2. Transfer Limitation Compliance: To the extent that any Customer Personal Data is transferred outside Singapore (such as through international cloud message delivery via Meta WhatsApp Cloud API), Ai Living ensures that the transfer complies with Section 26 of the PDPA and Regulation 10 of the Personal Data Protection Regulations 2021 by ensuring the overseas recipient is bound by legally enforceable obligations providing a standard of protection comparable to the PDPA.

12. Term, Data Export, and Deletion

1. Term: This DPA remains in full force and effect for the duration of the underlying subscription agreement and for so long as Ai Living retains custody or control of Customer Personal Data.
2. Post-Termination Export Period: Upon termination or expiration of the subscription agreement, Customer may, within thirty (30) calendar days, request an export of all Customer Personal Data in a standard machine-readable format (JSON/CSV).
3. Cryptographic Erasure: Following the expiry of the 30-day export window, Ai Living shall securely delete, purge, or irreversibly anonymize all Customer Personal Data from active production databases.
4. Routine Backup Rotation: Residual copies held within automated database backups shall be permanently purged in accordance with routine 30-day backup rotation cycles.

13. Audit and Verification Rights

1. Documentation and Questionnaires: To demonstrate compliance with this DPA, Ai Living makes available current security overviews, architecture summaries, and compliance questionnaires via https://trust.wibiz.ai/.
2. Audit Rights: Where required by applicable Singapore law or regulatory authority, Customer may conduct an audit of Ai Living's data processing activities:
   • Audits require at least thirty (30) calendar days' advance written notice
   • Audits must occur during normal business hours with minimal disruption to ongoing operations
   • Auditors must be independent, qualified, and bound by strict non-disclosure agreements
   • Audits are limited to once every twelve (12) months, unless necessitated by a confirmed security incident
   • Customer bears its own audit costs; each party bears its own personnel expenses

Appendix A: Specification of Condominium Data Processing

The table below describes the mandatory specifications for condominium processing operations under Sections 3.2 and 4 of this DPA:

Appendix B: Authorised Subprocessor Register

Appendix C: Technical and Organisational Security Measures (TOMs)

1. Access Control: Centralized identity management with role-based access control (RBAC), principle of least privilege, and mandatory multi-factor authentication (MFA) on all production consoles.
2. Transmission Security: TLS 1.3 enforced on all REST APIs and webhooks. Unencrypted plain HTTP is permanently redirected.
3. Data Storage Security: AES-256 volume-level and database-level encryption. Encryption keys managed under automated key management systems.
4. Vulnerability Management: Automated dependency vulnerability scanning, regular code reviews, and separation of development, staging, and production environments.
5. Business Continuity: Automated continuous write-ahead logging (WAL) with daily complete database backups retained for 30 days. Recovery Point Objective (RPO) is less than 1 hour; Recovery Time Objective (RTO) is less than 4 hours for primary service restoration.
6. Physical and Facility Security: Hosted on tier-4 equivalent hyperscale data centres operated by AWS with biometric access controls, 24/7 security staff, and environmental redundancy.

Appendix D: Governance Contacts and Operational Channels