Data Processing Agreement

October 13, 2020

Background

  1. Cheqyn and each Client entity have entered into an agreement to establish the terms and conditions of the provision of employee monitoring and/or visitor management services (“Services”) by Cheqyn to the Client (“Agreement”). In the performance of this Agreement, Cheqyn will be Processing Personal Data on behalf of the Client.
  2. Pursuant to Standard 4.1(14) of the Personal Data Protection Standard 2015, the Client agrees to enter into this binding agreement for the operating and carrying out Personal Data Processing activities of any Personal Data provided by Client to Cheqyn.
  3. This Data Processing Agreement details the conditions under which Cheqyn will perform these Processing activities. It forms an integral part of the Agreement.

Operative Provisions

It is hereby Agreed as follows:

1. Definitions
1.1 Definitions under the Terms & Conditions
  1. In this Data Processing Agreement, words with a capital letter, including for:
    1. Cookie Policy;
    2. Data Processor
    3. Data Subject;
    4. Data User;
    5. PDPA;
    6. Personal Data;
    7. Personal Data Protection Legislation;
    8. Privacy Policy; and
    9. Processing.
    and shall have the same meaning ascribed to them under the Terms and Conditions unless the context admits otherwise.
1.2 Incorporation by Reference
  1. This Data Processing Agreement incorporates by reference, and shall be read and construed together with the Privacy Policy and the Cookie Policy.
2. Scope & Objective
2.1 Scope of this Data Processing Agreement
  1. This Data Processing Agreement regulates the relationship between the Parties.
  2. In this regard, Cheqyn as Data Processor shall Process Personal Data on behalf of the Client as Data User.
  3. The Client shall be solely responsible as Data User for complying with its obligations under the Personal Data Protection Legislation, including, but not limited to compliance in transmitting Personal Data to Cheqyn for Processing.
2.2 Personal Data Collected for Employees of the Client (“Employee”)
  1. Under the Agreement, and in the provision of the Services, in particular the employee monitoring functionality, whether or not through the Site, the following Personal Data categories will be collected, Processed and used by Cheqyn under the Agreement:
    1. Employee name;
    2. Employee NRIC/Passport No;
    3. Employee email address;
    4. Employee telephone and mobile phone numbers;
    5. Employee team;
    6. Employee ID number;
    7. Office name, address and Location; and
    8. Body temperature.
2.4 General
  1. In the Processing of Personal Data under this Agreement, all Parties must endeavour to respect the privacy and Personal Data of the Data Subjects, whether Client employees, visitors or otherwise.
  2. In this regard, Client warrants and undertakes that whenever Personal Data Protection Legislation requires the consent of Data Subjects (or express consent, as the case may be), Client shall obtain such consent from the Data Subjects before collecting any Personal Data or providing such Personal Data to Cheqyn.
  3. In addition, Client will respect and pay particular attention to limit the collection of Personal Data to what is relevant to the intended purpose of the Processing and shall pay special attention to the Personal Data of:
    1. Minors; and
    2. Persons with disabilities as defined under the Persons with Disabilities Act 2008 (Act 685).
  4. With regard to data retention, all Parties commit not to keep or retain any Personal Data for longer than necessary under applicable law.
3. Rights & Obligations
3.1 Obligations of Data User
  1. The Client is responsible for the assessment of the lawfulness of any Personal Data Processing as part of the Services in accordance with Personal Data Protection Legislation.
  2. All instructions to Process Personal Data from the Client to Cheqyn must be made in writing. Client shall inform Cheqyn without delay in the event of any mistake or irregularity in the Personal Data provided and with respect to the Processing thereof.
  3. The Client shall keep confidential any and all kinds of proprietary information of Cheqyn if the Client has received or may receive under or pursuant to this Data Processing Agreement.
  4. The Client is not entitled to disclose the security measures taken by Cheqyn with respect to Data Subjects without the prior written consent of Cheqyn.
3.2 Obligations of Data Processor
  1. Cheqyn shall make commercially reasonable endeavours, to the minimum required by law, to:
    1. only use Personal Data to the extent necessary to perform the Services under the Agreement;
    2. not disclose Personal Data to any other third party other than its employees, agents, directors, professional advisors and permitted assigns without notifying the Client, or as expressly required by law;
    3. ensure that none of Cheqyn personnel who have access to any Personal Data use, disclose, transfer or retain such Personal Data except to the extent necessary to perform the Services under the Agreement;
    4. procure that no professional advisor who has access to any Personal Data uses, discloses, transfers or retains such Personal Data except to the extent necessary to perform the Services under the Agreement;
    5. ensure the safety of Personal Data from loss, misuse, modification, unauthorised access and disclosure
    6. notify the Client after Cheqyn becomes aware that a disclosure of Personal Data may be required by law (including under the applicable Personal Data Protection Legislation);
    7. not do any act or engage in any practice that would breach any Personal Data Protection Legislation;
    8. on the completion of the Services under the Agreement, to destroy or otherwise deal with any Personal Data in accordance with the Personal Data Protection Legislation.
Sub-Processing
4.1 Acknowledgement
  1. Client agrees and acknowledges that Cheqyn may engage third-party sub-contractors in connection with the provision of the Services, who may also Process Personal Data.
  2. Client undertakes that it has no objection to Cheqyn’s engagement of any third parties and will have no claim against Cheqyn other than arising from any good faith reasonable belief that Cheqyn’s engagement as described in Clause 4.1(a) will expose the Client to any criminal liability.
Indemnity
5.1 Cheqyn Held Harmless from Liability
  1. To the maximum extent permitted by law, Client shall indemnify and hold Cheqyn harmless against any claims, suits, demands, actions and arbitral proceedings, for any loss or damages howsoever arising from any third party as a result of the Client’s breach of, non-performance of or non-compliance with any term of this Data Processing Agreement.
  2. To the maximum extent permitted by law, the Client’s liability under this Clause 5.1 shall survive the termination, effluxion, discharge, expiry or performance of this Agreement.
  3. For the avoidance of doubt, the Client’s liability under this Clause 5.1 shall not be subject to any financial limits.
Cheqyn's use of Personal Data provided by the Client
  1. Cheqyn may use Personal Data provided by the Client to:
    1. Operate, maintain, and improve the Services and other programmes, features, and functionality related to the Services;
    2. Messaging and interacting with Clients, including answering questions and responding to requests;
    3. Improve privacy;
    4. Perform analytics and conduct Client/User research;
    5. Communicate and provide additional information that may be of interest to the Client about Cheqyn and our business partners, sometimes by combining Personal Data information with information we obtain from other sources;
    6. Send the Client reminders, technical notices, updates, security alerts, support and administrative messages, service bulletins, marketing messages, and requested information, including on behalf of our business partners;
    7. Administer surveys, questionnaires, contests or other promotional activities or events sponsored by us or our business partners;
    8. Manage Cheqyn’s everyday business needs, such as administration of the Services, fulfilment, analytics, fraud prevention, and enforcement of our corporate reporting obligations, the Agreement, or to comply with the law;
    9. Allow potential candidates to apply for a job, make a complaint, participate in any surveys, or sign up for newsletters or updates from Cheqyn, our business partners, or other companies;
    10. Verify the Client’s requests made pursuant to this Data Processing Agreement or Privacy Policy; and
    11. Enable Cheqyn or our business partners to send to any Client, User or Visitor any marketing materials, advertisements or collaterals, including but not limited to, information about the Services.
6.2 Pass-Through Obligations
  1. It is the duty of the Client to ensure that to the extent Cheqyn may Process the Personal Data of a User or Visitor of that Client, including pursuant to Clause 6.1, the Client obtains all necessary consents from that User or Visitor to enable such Processing by Cheqyn.
  2. A Client’s liability under the indemnity under Clause 5.1 shall, for the avoidance of doubt, include its obligations under Clause 6.2(a).
7. General Terms
7.1 Governing Law
  1. This Agreement is governed by and shall be construed in accordance with the laws of Malaysia for the time being in force.
  2. The Client submits to the non-exclusive jurisdiction of the courts of Malaysia.
7.2 Entire Agreement
  1. This Agreement constitutes the entire agreement between the Client and Cheqyn relating to the Client’s use of Services, superseding any prior oral or written agreements between the Client and Cheqyn regarding the subject matter herein. The Parties explicitly exclude the application of any standard terms and conditions of purchase or other conditions of the Client, even if these would have been communicated to Cheqyn at a later date and Cheqyn would not have protested those.
7.3 Severability
  1. If any provision of this Agreement is held to be unlawful, invalid or otherwise unenforceable for any reason whatsoever, it shall be deemed severed from the Agreement and shall not affect the validity, legality and enforceability of the remaining provisions of this Agreement.
  2. To the maximum extent permitted by applicable law, the unlawful, invalid or unenforceable provision shall be amended to achieve as closely as possible the common intentions of the parties as expressed in the original term.
7.4 No Assignment
  1. The Client may not assign or transfer in any other manner any of its rights or obligations under this Agreement, either in whole or in part, to a third party.
7.5 Waivers
  1. A waiver of any right under this Agreement is only effective if it is in writing and it applies only to the party to whom the waiver is addressed and to the circumstances for which it is given.
7.6 No Agency, Partnership or Joint Venture
  1. This Agreement does not create any agency, partnership, or joint venture between the Parties.
7.7 No Third-Party Beneficiaries
  1. There are no third-party beneficiaries to this Agreement.
7.8 Notices
  1. Any notice to be served under this Agreement is to be delivered or sent by registered post or email:
    1. to the Client at the address or email address provided in the Subscription Form; and
    2. to Cheqyn at 5, Jalan Stesen Sentral, East Wing, Level 3, Kuala Lumpur Sentral, 50470, KL or contact@enlightyx.io.