Data Processing Addendum

Where the customer determines the purposes and means of processing personal data, the customer acts as the controller, data fiduciary, or business, and we act as the processor, data processor, or service provider. Where we determine purposes and means, we act as an independent controller.

• Subject matter: provision of ExpoLead Bot, AI/software, automation, messaging, workflow, and support services.
• Duration: the term of the customer agreement plus any legally or operationally required retention period.
• Nature of processing: collection, storage, extraction, analysis, classification, automation, communication, reporting, support, and deletion.
• Purpose: providing, securing, supporting, and improving the services purchased by the customer.
• Categories of data: names, contact details, business details, uploaded files, business card images, messages, voice notes, lead data, customer data, usage logs, and payment metadata.
• Categories of data subjects: customer's users, employees, leads, prospects, customers, representatives, visitors, and other individuals submitted by customer.

• Process personal data only on documented customer instructions, unless legally required otherwise.
• Maintain confidentiality and reasonable security measures.
• Assist customer with data subject requests where reasonably possible.
• Assist with breach notifications where required by applicable law and the customer agreement.
• Delete or return personal data after termination unless retention is legally or operationally required.
• Use subprocessors only where necessary for service delivery.
• Maintain appropriate records where required.

• Provide lawful documented instructions.
• Obtain required consents, notices, permissions, or lawful bases.
• Ensure submitted data is lawful, accurate, necessary, and proportionate.
• Respond to data subject requests where customer controls the data.
• Ensure use of ExpoLead Bot complies with applicable laws and third-party platform rules.

Customer authorizes Bigdoor Ai Labs Pte. Ltd to use subprocessors for hosting, database, storage, AI processing, OCR, speech processing, messaging, analytics, support, payments, and service delivery. Personal data may be transferred internationally where necessary to provide the services. We will use appropriate safeguards where required by applicable law.

We will maintain reasonable technical and organizational measures, which may include access controls, encryption where appropriate, logging, monitoring, restricted internal access, vendor review, backups, and incident response processes.

If we become aware of a personal data breach affecting customer personal data, we will notify the customer without undue delay where required by applicable law and the customer agreement. Upon termination, we will delete or return customer personal data within a reasonable period unless retention is required by law, backup systems, accounting, security, fraud prevention, dispute resolution, or legitimate business purposes.