Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Kontiv Solutions (Registration No. 003813924-K) ("Kontiv") and the organisation using Decidend (the "Customer"), together with the Order Form and the Terms of Service. It applies to personal data that Kontiv processes on the Customer's behalf through the Service ("Customer Personal Data"). Terms not defined here have the meaning in the Terms or in Malaysia's Personal Data Protection Act 2010 as amended ("PDPA").

1. Roles

The Customer is the data controller (data user) of Customer Personal Data and decides the purposes and means of processing. Kontiv is the data processor and processes Customer Personal Data only on the Customer's behalf.

2. Instructions

Kontiv processes Customer Personal Data only on the Customer's documented instructions. These are the Order Form, the Terms, this DPA, and the Customer's use and configuration of the Service. Kontiv will tell the Customer if it believes an instruction breaks the law. Kontiv may process data otherwise only where the law requires, and will tell the Customer first unless the law prohibits it.

3. Details of the processing

• Purpose: providing, securing and supporting the Service.
• Duration: the term of the agreement, plus the export and deletion periods in section 10.
• Data subjects: the Customer's employees, former employees, new joiners and candidates who have accepted an offer, contractors, and the Customer's users of the Service.
• Categories of data: identity and contact details, job and organisation information, pay and salary information, documents uploaded by or for employees (which may include identity documents, bank details and statutory numbers), onboarding records, performance records, employee relations case records, and sign-in and activity records.
• Processing activities: storage, organisation, display, search, calculation, export, AI-assisted analysis at a user's request, and deletion.

4. Confidentiality

Kontiv ensures that anyone authorised to process Customer Personal Data is bound by confidentiality obligations and accesses it only as needed to provide the Service or support requested by the Customer.

5. Security

Kontiv maintains appropriate technical and organisational measures to protect Customer Personal Data, including:

• encryption in transit and at rest through its hosting providers;
• separation of each customer’s data, and server-side checks of company and role on every request;
• role-based access controls, including separate control of pay visibility;
• private storage of employee documents, shared only through short-lived links;
• activity logging of important changes;
• temporary passwords that must be changed at first sign-in;
• access to production systems limited to authorised personnel.

Kontiv may update these measures as long as the overall level of protection is not reduced.

6. Sub-processors

The Customer authorises Kontiv to use the sub-processors listed in the Privacy Policy. Kontiv will bind each sub-processor to data protection obligations no less protective than this DPA, and remains responsible for their performance. Kontiv will give at least 30 days' notice before adding or replacing a sub-processor. If the Customer reasonably objects on data protection grounds and the parties cannot resolve it, the Customer may end the affected service and receive a pro-rated refund of prepaid fees for the unused period.

7. Transfers outside Malaysia

Customer Personal Data may be processed outside Malaysia by the sub-processors listed in the Privacy Policy. Kontiv will transfer it only as permitted by the PDPA, and only to providers bound to protect it as set out in this DPA.

8. Helping the Customer

• Kontiv will promptly pass to the Customer any request it receives from a data subject about Customer Personal Data, and will not respond directly unless the Customer asks it to.
• The Service lets the Customer view, correct, export and delete employee data. Where that is not enough, Kontiv will provide reasonable help to respond to data subject requests.
• Kontiv will provide reasonable information to help the Customer with risk assessments and with enquiries from the Personal Data Protection Commissioner.

9. Personal data breaches

Kontiv will notify the Customer without undue delay, and within 72 hours, after becoming aware of a breach affecting Customer Personal Data. The notice will describe, as far as known, what happened, the data and people affected, the likely consequences, and the steps taken or proposed. Kontiv will cooperate with the Customer so it can meet its own notification obligations, and will take reasonable steps to contain the breach.

10. Return and deletion

The Customer can export its data at any time. When the agreement ends, the Customer has 30 days to export. After that, Kontiv deletes Customer Personal Data within 90 days, including from backups as they cycle, unless the law requires it to keep some data. Kontiv will confirm deletion in writing on request.

11. Information and audits

Kontiv will provide information reasonably needed to show compliance with this DPA. Once a year, with at least 30 days' notice, the Customer may carry out an audit (or have an independent auditor bound by confidentiality do so) during business hours, at the Customer's cost and in a way that does not disrupt the Service or expose other customers' data.

12. AI

Customer Personal Data is sent to AI providers only to answer a user's request or run an analysis the user starts. Kontiv does not use Customer Personal Data to train AI models, and uses AI providers under commercial terms with settings that keep customer data out of model training where available.

13. General

Each party's liability under this DPA is subject to the limitations in the Terms. If this DPA conflicts with the Terms on personal data, this DPA prevails. This DPA is governed by the laws of Malaysia.

14. Contact

Data Protection Officer, Kontiv Solutions (003813924-K), Cyberjaya, Selangor, Malaysia
Email: info@kontiv.com