Data Processing Agreement

For the purposes of this DPA, the following definitions apply:

1. 1."Controller" means the entity that determines the purposes and means of the processing of Personal Data.
2. 2."Processor" means the entity that processes Personal Data on behalf of the Controller, being MetaComp Pte. Ltd. and its affiliates within the Alpha Ladder Group.
3. 3."Personal Data" means any information relating to an identified or identifiable natural person, as defined under applicable Data Protection Laws.
4. 4."Data Protection Laws" means all applicable laws and regulations relating to the processing of Personal Data, including but not limited to the Personal Data Protection Act 2012 of Singapore ("PDPA"), and any amendments or successor legislation thereto.
5. 5."Data Subject" means the identified or identifiable natural person to whom Personal Data relates.
6. 6."Processing" means any operation or set of operations performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, erasure or destruction.
7. 7."Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
8. 8."Sub-Processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.
9. 9."Standard Contractual Clauses" or "SCCs" means the contractual clauses or equivalent transfer mechanisms approved under applicable Data Protection Laws for the transfer of Personal Data to third countries.

This DPA applies to all processing of Personal Data performed by the Processor on behalf of the Controller in connection with the provision of the services described in the Terms of Use.

The parties acknowledge that, with respect to the processing of Personal Data covered by this DPA:

1. 1.the Controller is the data controller responsible for determining the purposes and means of processing;
2. 2.the Processor acts solely as a data processor, processing Personal Data only on documented instructions from the Controller, unless required to do so by applicable law;
3. 3.where the Processor processes Personal Data for its own purposes (such as operating and improving its platform, complying with legal obligations, or fraud prevention), the Processor acts as a data controller in its own right and such processing is governed by the Privacy Policy.

The Processor shall, with respect to any Personal Data processed on behalf of the Controller:

The Controller represents, warrants and undertakes that:

1. 1.it has and will maintain throughout the term of this DPA all necessary rights, consents, and authorisations to provide Personal Data to the Processor for processing in accordance with this DPA and applicable Data Protection Laws;
2. 2.it has provided adequate notice to, and obtained all required consents from, Data Subjects as required by applicable Data Protection Laws;
3. 3.its instructions to the Processor regarding the processing of Personal Data shall comply at all times with applicable Data Protection Laws;
4. 4.it is responsible for the accuracy, quality, and lawfulness of the Personal Data and the means by which it acquired such Personal Data.

The Controller provides general authorisation for the Processor to engage Sub-Processors to assist in providing the services. The Processor shall:

1. 1.ensure that Sub-Processors are bound by data processing obligations that are no less protective than those set out in this DPA;
2. 2.remain fully liable to the Controller for the performance of the Sub-Processor's obligations to the extent that the Sub-Processor fails to fulfil its obligations;
3. 3.maintain a current list of Sub-Processors engaged in the processing of Personal Data and make such list available to the Controller upon request;
4. 4.provide reasonable notice to the Controller prior to adding or replacing any Sub-Processor where such changes may materially affect the processing of the Controller's Personal Data. The Controller may object to any such change on reasonable grounds by notifying the Processor in writing within fourteen (14) days.

The Processor operates a global business and may transfer Personal Data to, or process Personal Data in, countries outside the Controller's country of residence. Any such transfer shall be made only:

1. 1.to countries that provide an adequate level of data protection as recognised by the applicable data protection authority;
2. 2.subject to appropriate safeguards such as Standard Contractual Clauses, binding corporate rules, or any other transfer mechanism recognised as adequate under applicable Data Protection Laws;
3. 3.with the Controller's explicit consent where required by law;
4. 4.where the transfer is necessary for the performance of a contract between the Controller and the Processor, or for the implementation of pre-contractual measures taken at the Controller's request.

The Processor shall ensure that any overseas recipient of Personal Data is bound by obligations providing at least a comparable standard of protection as that provided under applicable Data Protection Laws.

Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

1. 1.pseudonymisation and encryption of Personal Data where appropriate;
2. 2.the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
3. 3.the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident;
4. 4.a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing;
5. 5.access controls, including role-based access restrictions, multi-factor authentication, and audit logging;
6. 6.regular security training for personnel who process Personal Data.

In the event of a Personal Data Breach affecting Personal Data processed on behalf of the Controller, the Processor shall:

1. 1.notify the Controller without undue delay, and in any event within seventy-two (72) hours of becoming aware of the breach, providing all information reasonably available at the time and as required under applicable Data Protection Laws;
2. 2.take all reasonable steps to investigate, contain and mitigate the effects of the breach;
3. 3.cooperate with the Controller and provide all information reasonably requested by the Controller to enable the Controller to fulfil its own notification obligations to supervisory authorities and affected Data Subjects;
4. 4.document the breach, including its effects and the remedial actions taken.

The Processor's notification of a Personal Data Breach shall not be construed as an acknowledgement of fault or liability.

The Processor shall assist the Controller in responding to requests from Data Subjects exercising their rights under applicable Data Protection Laws, which may include the right to:

1. 1.access their Personal Data and obtain information about how it is processed;
2. 2.correct inaccurate or incomplete Personal Data;
3. 3.withdraw consent to processing where processing is based on consent;
4. 4.request the restriction of processing in certain circumstances;
5. 5.data portability, receiving Personal Data in a structured, commonly used and machine-readable format;
6. 6.object to processing carried out on the basis of legitimate interests.

Where the Processor receives a request directly from a Data Subject in relation to Personal Data processed on behalf of the Controller, the Processor shall promptly forward such request to the Controller and shall not respond to such request without the Controller's prior authorisation, unless required to do so by applicable law.

The Processor shall retain Personal Data processed on behalf of the Controller only for as long as necessary to provide the services or as required by applicable law.

Upon termination or expiry of the agreement between the parties, or upon the Controller's written request, the Processor shall, at the Controller's election:

1. 1.delete or destroy all copies of Personal Data processed on behalf of the Controller, except to the extent that retention is required by applicable law; or
2. 2.return all Personal Data to the Controller in a commonly used and machine-readable format.

The Processor shall certify in writing to the Controller that it has complied with this obligation upon request. The Processor may retain Personal Data beyond the above period only to the extent required by applicable law, including but not limited to anti-money laundering, counter-terrorism financing, and other regulatory obligations, and shall inform the Controller of such retention requirements.

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this DPA and applicable Data Protection Laws, and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

1. 1.Audits shall be conducted no more than once per calendar year, unless required by applicable law or a supervisory authority, and on reasonable prior written notice of not less than thirty (30) days.;
2. 2.The Controller shall bear the costs of any audit unless the audit reveals a material breach of this DPA by the Processor, in which case the Processor shall bear all reasonable audit costs.
3. 3.The Processor may require the Controller and its auditors to execute a confidentiality agreement before commencing any audit.
4. 4.The Processor may satisfy its audit obligations by providing the Controller with relevant certifications, third-party audit reports, or security assessments, where agreed by both parties.

Each party shall be liable to the other for damages arising from a breach of this DPA in accordance with applicable Data Protection Laws. The following principles shall apply:

1. 1.the Processor shall be liable to the Controller for damages caused by processing in breach of this DPA or applicable Data Protection Laws;
2. 2.the Controller shall be liable to the Processor for damages caused by processing instructions that do not comply with applicable Data Protection Laws;
3. 3.a party shall be exempt from liability if it proves that it is not in any way responsible for the event giving rise to the damage.

To the extent permitted by applicable law, the total liability of the Processor to the Controller under or in connection with this DPA shall not exceed the total fees paid by the Controller to the Processor in the twelve (12) months preceding the event giving rise to the claim. Nothing in this DPA shall limit either party's liability for fraud, gross negligence or wilful misconduct.

This DPA shall remain in force for the duration of the agreement between the Controller and the Processor for the provision of services and shall automatically terminate upon the termination or expiry of such agreement, subject to any obligations that expressly survive termination.

Upon termination of this DPA for any reason, the obligations relating to the return or deletion of Personal Data set out in Section 10 shall survive and continue to apply.

This DPA and any dispute or claim arising out of or in connection with it shall be governed by and construed in accordance with the laws of Singapore. The parties irrevocably submit to the exclusive jurisdiction of the courts of Singapore to settle any dispute or claim arising out of or in connection with this DPA.

If you have any questions regarding this DPA or wish to exercise any rights under applicable Data Protection Laws, please contact our Data Protection Officer at dpo@mvgx.com.