Between: CHATOWL SOLUTIONS (SSM 202603187823 / KT0617773-V), of C2-37-02, Arte Cheras, Taman Midah, Cheras, 56000 Kuala Lumpur (“Processor”, “ChatOwl”); and the Client identified in the Order Form (“Controller”).
This DPA governs ChatOwl’s processing of personal data on the Controller’s behalf under the Personal Data Protection Act 2010 (PDPA). Where it conflicts with the Terms of Service, this DPA prevails for data-protection matters.
1. Roles
The Controller determines the purposes and means of processing its customers’ personal data. The Processor processes that data only on the Controller’s documented instructions (which include using the ChatOwl service as configured), except where required by law.
2. Subject-matter, duration, nature and purpose
- Nature/purpose: running an AI chat-assistant for the Controller: answering enquiries, giving ballpark quotes from the Controller’s price list, capturing leads, and (on eligible plans) reading customer-supplied photos and taking bookings.
- Duration: for the term of the Controller’s subscription, plus the retention/deletion steps in Section 9.
3. Types of personal data and data subjects
- Data subjects: the Controller’s customers and prospects who interact with the assistant.
- Personal data: name, phone/WhatsApp, email, message content, and any details a customer voluntarily provides (e.g. address, photos for a quote). The Controller must not use the service to collect sensitive personal data unless it has a lawful basis and has instructed us accordingly.
4. Processor obligations
ChatOwl will: (a) process only on the Controller’s instructions; (b) ensure ChatOwl and any person it authorises to process the data are bound by confidentiality; (c) apply the technical and organisational security measures in Section 6; (d) assist the Controller, as far as reasonable, with data-subject requests and with security, breach, and compliance obligations; (e) make available information reasonably needed to show compliance.
5. Sub-processors
The Controller authorises these sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| DigitalOcean | Application + data hosting | Singapore |
| Anthropic | AI model inference | US / regional |
| AI model inference | US / regional | |
| Curlec (by Razorpay) | Billing the Controller (not customer data) | Malaysia |
| Meta Platforms (WhatsApp / Instagram / Facebook Cloud API), only on plans with those channels | Message delivery on the Controller’s connected channels | US / regional |
| Telegram, only if the Controller connects a Telegram bot or lead alerts | Message delivery / lead notifications | UAE / regional |
ChatOwl imposes data-protection terms on each sub-processor no less protective than this DPA, and remains responsible for their performance. We will give the Controller notice of any intended change of sub-processor and a chance to object on reasonable data-protection grounds.
6. Security
Encryption in transit, per-tenant isolation so one client’s data is not accessible to another, access controls on the administrative layer, regular backups, and abuse/spend controls. Measures are reviewed periodically and kept appropriate to the risk.
7. Personal data breach
ChatOwl will notify the Controller without undue delay (and in any case within 72 hours) after becoming aware of a personal data breach affecting the Controller’s data, with the information the Controller reasonably needs to meet its own obligations.
8. Cross-border transfer
Processing may occur outside Malaysia (see Section 5). ChatOwl applies appropriate safeguards (contractual data-protection terms with each provider). The Controller consents to these transfers for the purpose of providing the service.
9. Return or deletion
On termination, or on the Controller’s written request, ChatOwl will, at the Controller’s choice, export the Controller’s data (leads/records) and then delete it from active systems, with backups expiring on their normal cycle, unless retention is required by law.
10. Audit
On reasonable prior notice and no more than once a year (or after a breach), ChatOwl will provide the Controller with information reasonably necessary to demonstrate compliance with this DPA.
11. Contact
Data-protection contact: Lee Hao Ying · hello@chatowl.my · 011-1205 2265.