Data Processing Agreement
1. Roles
For personal data your customers submit through your SmartAI assistant, you act as the data controller and SmartAI acts as the data processor, processing that data solely to provide the service on your instructions.
2. Processing instructions
SmartAI will process personal data only as necessary to deliver the service (generating and routing conversation replies, storing conversation history, providing analytics) and as otherwise instructed by you in writing.
3. Sub-processors
You authorise SmartAI to engage the sub-processors listed on our Sub-processors page to provide the service, including AI infrastructure providers who process conversation content under a no-training, limited-retention agreement. We will notify customers before adding a new sub-processor that materially changes how data is handled.
4. Security measures
SmartAI maintains access controls, encryption in transit, and logging appropriate to the sensitivity of conversation data. Full technical measures are available on request for enterprise security reviews.
5. Data subject requests
Where we receive a request from an individual relating to data processed on your behalf, we will forward it to you promptly and assist you in responding as required by applicable law.
6. Cross-border transfer
Where processing occurs outside Malaysia via a named sub-processor, this DPA and the applicable sub-processor agreement together form the safeguard for that transfer, consistent with the Personal Data Protection Act 2010.
7. Term and deletion
On termination of your SmartAI account, we will delete or return personal data processed on your behalf within a reasonable period, except where retention is required by law.