Effective Date: January 1, 2025
Last Updated: January 1, 2025

1. Introduction
1.1 This Data Processing Agreement (DPA) is an addendum to the Terms of Service (TOS) and applies when Net Onboard Sdn Bhd processes personal data on behalf of its customers.
1.2 This DPA ensures compliance with:
– Malaysia’s Personal Data Protection Act (PDPA) 2010
– General Data Protection Regulation (GDPR) (for EU users, if applicable)
– Other relevant data protection laws
1.3 By using our services, you agree to this DPA, which defines the rights, responsibilities, and obligations related to data processing.

2. Definitions
2.1 “Data Controller” – The customer who determines how and why personal data is processed.
2.2 “Data Processor” – Net Onboard Sdn Bhd, which processes data on behalf of the Data Controller.
2.3 “Personal Data” – Any information related to an identifiable individual.
2.4 “Processing” – Any operation performed on personal data, such as collection, storage, transfer, or deletion.

3. Processing of Personal Data
3.1 Purpose of Processing: Net Onboard processes personal data solely to provide cloud computing and IT services.
3.2 Types of Data Processed:
– User Information: Name, email, contact details, and business information.
– Service Data: Logs, configurations, and usage analytics.
– Billing Information: Payment records, transaction history.
3.3 Legal Basis for Processing:
– Contractual necessity – Required to deliver services.
– Legal compliance – To meet regulatory obligations.
– Legitimate interests – To enhance security and user experience.

4. Data Security Measures
4.1 Net Onboard implements strict security controls to protect data, including:
– AES-256 encryption for data storage & transmission.
– Multi-Factor Authentication (MFA) for account security.
– ISO 27001-certified security framework for cloud infrastructure.
– Regular security audits, penetration testing & compliance checks.
4.2 Data Access Control:
– Only authorized personnel have access to personal data.
– Access is restricted based on role-based permissions.

5. Data Retention & Deletion
5.1 Personal data is retained only as long as necessary for legal, regulatory, and operational requirements.
5.2 Standard retention periods:
– Account Information – Retained for the duration of the contract + five (5) years after termination.
– Billing & Transaction Data – Retained for seven (7) years for financial compliance.
5.3 Users may request data deletion upon account termination by contacting [email protected].

6. Data Transfers & Data Sovereignty
6.1 Data is stored within Malaysia, unless an international transfer is necessary for service fulfillment.
6.2 For cross-border transfers, we:
– Ensure GDPR-standard protection measures for EU-based users.
– Use legally binding contracts and industry-approved security mechanisms.

7. Subprocessors
7.1 Net Onboard engages third-party vendors (e.g., cloud storage providers, analytics platforms, payment processors) under strict Data Processing Agreements (DPA).
7.2 A list of approved subprocessors is available upon request.

8. Data Breach Notification
8.1 In case of a personal data breach, Net Onboard will:
– Assess the impact and take immediate action.
– Notify affected customers and authorities within 72 hours, as required by PDPA & GDPR.
– Provide remediation steps and security enhancements.

9. Customer Rights & Obligations
9.1 Customers have the right to:
– Access, correct, or delete their personal data.
– Withdraw consent for non-essential data processing.
– Request data portability in a structured, digital format.
9.2 Customers must:
– Ensure compliance with applicable data protection laws.
– Not use Net Onboard’s services for unauthorized or illegal data processing.

10. Governing Law & Dispute Resolution
10.1 This DPA is governed by Malaysian law.
10.2 Disputes will be handled through negotiation and mediation before proceeding to arbitration or litigation.

11. Amendments & Updates
11.1 Net Onboard reserves the right to update this DPA at any time.
11.2 Users will be notified of material changes via email or system notifications.

For data protection inquiries, contact [email protected].