This English text is the governing version. Where a translation differs from it, the English text prevails.
Data Processing Addendum (DPA)
This Data Processing Addendum (the “DPA”) governs the personal data that DigiClient AI (the “Processor”) processes on behalf of a business that has accepted the Terms of Service (the “Controller”) in the course of providing the service.
1. Roles
The Controller is the personal information controller under applicable law. The Processor processes personal data solely on the Controller's instructions.
2. Scope and purpose of processing
The Processor processes personal data only to provide the service — sending and receiving LINE/WhatsApp messages, generating AI replies, managing bookings, issuing payment links and running campaigns — and for no other purpose without the Controller's prior instruction.
3. Security measures (technical and organisational)
- Encryption: TLS 1.3 in transit, AES-256 at rest.
- Tenant isolation: strict logical separation between tenants in a multi-tenant environment.
- Access control: role-based access control (RBAC) on the principle of least privilege.
4. Subprocessors
The Processor may engage approved subprocessors to the extent necessary to provide the service. The current list is published at Subprocessors.
5. Assisting with data subject rights
Where a data subject asks the Controller to disclose, correct, suspend the use of, or delete personal data, the Processor assists without undue delay — including through the console's data export and deletion functions.
6. Incident notification
On detecting a material incident such as a leak of personal data, the Processor notifies the Controller promptly as required by law, investigates the cause and takes measures to limit the impact.