Data Processing Agreement

This Data Processing Agreement ("DPA") is between NT360 Sdn Bhd ("Processor") and the contracting Client ("Controller").

2.1 Scope and Status

NT360 Sdn Bhd acts as a data processor for the Client. The Processor shall process personal data only on documented instructions from the Controller and shall not process personal data for any purpose other than performing the contracted services.

2.2 Technical and Organisational Measures

Edge Anonymisation

The Processor provides a Sidecar agent to be installed on the Controller's premises. This agent performs mandatory scrubbing of personally identifiable information prior to any data leaving the Controller's environment and transiting to the Processor's infrastructure.

Encryption

All data is encrypted in transit using TLS and encrypted at rest within the Processor's infrastructure.

Retention

Logs are retained for a fixed period of 90 days, after which they are automatically and permanently purged from the Processor's systems.

2.3 Sub-processing

The Processor utilises cloud infrastructure located in the Kuala Lumpur region as the primary hosting environment. Any material change to sub-processors will be notified to the Controller in writing with reasonable notice prior to the change taking effect.