Data Processing Addendum

What this addendum is #

This addendum forms part of the Terms of Service between FLOW FN PTE. LTD. (UEN 202617303Z), a company incorporated in Singapore ("we", the processor) and the customer organization ("you", the controller). It applies whenever we process personal data on your behalf in providing Nayto. Where it conflicts with the Terms on data protection, this addendum wins.

"Personal data", "processing", "controller", "processor" and "data intermediary" have the meanings given by the data protection law that applies - Singapore's Personal Data Protection Act 2012 (PDPA), and, where they apply, the EU or UK GDPR. Under the PDPA we act as your data intermediary.

Roles #

You are the controller of the personal data in your organization's content - the media, names and text you upload and publish - and of the team data you manage in the Service: who is invited, what each person may do, and the record of what each did in your organization. We process it as your processor.

We are the controller of each person's account details - their email address, name and password - and of the sign-in, billing, acceptance and security records we keep to run the Service and to meet our own obligations. Those are described in the Privacy Notice, not here.

What we process, and on whose instructions #

• Subject matter: providing the Service under the Terms.
• Duration: for as long as the Terms last, and afterwards until the data is deleted as this addendum provides.
• Nature and purpose: storing your content, converting it into versions your screens can play, delivering it to your screens on your schedule, and showing your team what happened.
• Kinds of personal data: whatever your content contains - typically images, video, audio and text that may show or name people - and your team data: who belongs to your organization, their roles and permissions, and what each did.
• People concerned: your staff and contractors, and anybody who appears in or is named by your content.

We process this data only on your documented instructions. Using the Service, its settings and these terms are your instructions; anything else must be agreed in writing. If the law requires us to process the data in some other way, we will tell you first unless the law forbids it. If we think an instruction breaks data protection law, we will tell you.

You must have a lawful basis for the data you give us, and you must give the people concerned any notice the law requires. Do not upload special categories of personal data, or Singapore NRIC numbers and other national identifiers, unless the law allows you to display them.

Confidentiality and security #

Only people who need access to run the Service may reach your data, and each of them is bound to keep it confidential.

We keep appropriate technical and organizational measures in place to protect the data against accidental or unlawful destruction, loss, alteration, disclosure or access. They include encryption of every connection; credentials stored only as hashes or digests; access within an organization decided by explicit permissions; separation of each organization's data; and hosting with providers that hold recognised security certifications. Our Security page describes them, and we keep them under review.

Subprocessors #

You authorise us to use the subprocessors on our subprocessors page. Each is bound by a written contract that protects your data at least as well as this addendum does, and we remain responsible to you for what they do.

Before we add or replace a subprocessor, we will update that page and email your organization's owners at least 30 days ahead. If you have a reasonable data protection objection, tell us at privacy@nayto.io within that time. We will try to address it; if we cannot, you may stop using the affected part of the Service.

Where data is processed #

Your content and the Service's database are hosted in Singapore. Some subprocessors process limited data elsewhere, as the subprocessors page shows.

Where personal data is transferred out of Singapore, we make sure the recipient is bound to protect it to a standard comparable to the PDPA.

Where the GDPR or the UK GDPR applies to personal data you give us, the European Commission's standard contractual clauses (Decision (EU) 2021/914), module two (controller to processor), are incorporated into this addendum, with you as data exporter and us as data importer, together with the UK's addendum to them where the UK GDPR applies. Where the clauses conflict with this addendum or the Terms, the clauses prevail.

Helping you meet your obligations #

If somebody asks us to exercise their rights over data we process for you, we will pass the request to you rather than answer it ourselves, unless the law requires otherwise. Taking into account what we process, we will help you answer such requests, carry out data protection impact assessments, and consult regulators where you need to.

Personal data breaches #

If we become aware of a breach affecting personal data we process for you, we will tell you without undue delay, and in any event within 72 hours, with what we know at the time: what happened, the kinds and rough number of people and records affected, the likely consequences, and what we have done and will do. We will add to it as we learn more, and help you notify regulators and the people affected where you must.

Where a breach is notifiable under the PDPA, we will tell you in time for the Personal Data Protection Commission to be notified within three calendar days of the breach being assessed as notifiable.

Return and deletion #

When the Terms end, or earlier if you ask, we will give you a copy of your content in a common format if you ask within 30 days. Within 30 days of your organization being closed, we delete your uploaded media and anonymise the records that remain, as the Data Retention Schedule sets out; records that are kept unaltered, such as activity history, then no longer identify anybody. Copies in our backups are overwritten as the backups expire. We may keep data where the law requires us to, and only for that purpose.

Audits #

We will make available the information you reasonably need to show that we meet this addendum. If that is not enough, you, or an independent auditor bound to confidentiality, may audit our compliance once a year, on 30 days' written notice, during business hours, at your cost, and in a way that does not expose other customers' data or our security to risk. Requests go to legal@nayto.io.

Liability, and the rest #

Each party's liability under this addendum is subject to the limits in the Terms. This addendum lasts as long as we process personal data for you. It is governed by the same law, and disputes are resolved in the same way, as the Terms provide; that does not take away any right a person has under data protection law.

How this document changes #

Every version of this document has a number and the date it applies from, both printed under the title. A change is published as a new version rather than an edit to this one, so what the document said on any day can be checked.

When a change matters to what you have agreed or to how we use your data, we tell you before it takes effect. Earlier versions are available from legal@nayto.io.