Data Processing Agreement
This Data Processing Agreement ("DPA") is part of the Terms of Service between you (the "Client") and Communication 21 Media Group, trading as Outreach.asia ("Processor"). It applies to the personal data of your prospects and their contacts that we process to provide the service ("Prospect Data").
1. Roles
For Prospect Data, you are the data user / controller and we are your data processor. We process Prospect Data only on your documented instructions, which are these Terms, your campaign settings and your actions in the service. If we think an instruction breaks the law, we will tell you and may decline it.
2. What we process
| Item | Detail |
|---|---|
| People | Employees, owners and representatives of the businesses you contact, and people who write to you through the service. |
| Data | Name, job title, business email address, business phone and WhatsApp number, company and website, messages exchanged, and notes about replies (for example "asked for a price list"). |
| Sources | Public business sources (company websites, business directories, search results), business-contact data providers where your package includes them, and what people send you. |
| Purpose | Business-to-business outreach for you: research, writing, sending, reading and answering replies, and honouring opt-outs. |
| Duration | While your account is active. Contacted leads are deleted 730 days after the last activity and leads never contacted after 180 days, or sooner at your request, except the do-not-contact list. |
3. Our obligations
- Confidentiality. Only people who need it to run the service can access Prospect Data, and they are bound to confidentiality.
- Security. We keep appropriate technical and organisational measures, including: encryption in transit (TLS) and at rest for the storage volume; mailbox and API secrets encrypted per client; each client's data kept separate and checked on every request; signed links for unsubscribe and outcomes; access limited to authorised staff; daily snapshots of stored data. We review these measures as the service grows.
- Sub-processors. We use the sub-processors listed on the Sub-processors page under written terms that protect the data at least as well as this DPA. We will give you at least 14 days' notice of a new sub-processor; you may object on reasonable data-protection grounds, and if we cannot address it you may end the service for the affected part.
- International transfers. Some sub-processors process data outside Malaysia (for example AI processing in the United States). We transfer data only where the law allows it, such as where the destination has substantially similar protection, under contractual safeguards, or as necessary to provide the service you asked for, as permitted by section 129 of the PDPA 2010 as amended and the equivalent rules in the other markets.
- Helping you. We help you respond to requests from people to access, correct, delete or port their data, or to stop direct marketing, and with security, breach notification and impact assessments, as far as is reasonable given what we process.
- Breaches. If we become aware of a personal data breach affecting Prospect Data, we will tell you without undue delay and in any case within 48 hours, with what we know, so you can meet your duties (for example notifying Malaysia's Personal Data Protection Commissioner as soon as practicable and within 72 hours, Singapore's PDPC within 3 days of assessing a notifiable breach, and the authorities in Thailand, Indonesia and the Philippines within 72 hours, and the people affected where required).
- End of service. When the service ends we delete Prospect Data within 30 days of any export you ask for, except the do-not-contact list (kept to honour opt-outs) and what the law requires us to keep.
- Audits. We will answer reasonable written questions about our compliance with this DPA once a year, or after a breach.
4. Your obligations
- You have a lawful basis for the outreach (such as legitimate interests in business-to-business communication, or consent where needed), and you give any notice the law requires.
- You do not ask us to process sensitive personal data or data about consumers or children.
- You honour opt-outs and the do-not-contact list, and do not re-upload people who asked to stop.
- Where Singapore numbers are contacted by phone or WhatsApp, you check the Do Not Call registry where the law requires it, unless the message is exempt business-to-business communication.
5. Data protection officer
Questions about this DPA go to our data protection officer at wilson@communication21.com.