Data Processing Addendum
Our commitments as a data processor for customer data.
Last updated: 15 November 2026.
Application and contractual priority
This Data Processing Addendum sets out general terms for UIB’s processing of personal data on a customer’s behalf. It applies when expressly incorporated into a service agreement or otherwise agreed in writing. The UIB contracting entity and customer are those named in that agreement. A separately signed DPA, agreed processing schedule and mandatory law prevail over inconsistent provisions here. Publication or browsing alone does not create a processor appointment or amend an existing agreement. UIB’s own website and business-contact processing is described in the Privacy Policy.
Roles, definitions and duration
The customer acts as controller or, where acting for another controller, as an authorised processor; UIB acts as processor or sub-processor for customer personal data. Personal data, processing and breach have the meanings assigned by applicable data-protection law. Relevant laws may include Singapore’s PDPA, Malaysia’s PDPA as amended, the EU GDPR, UK GDPR and other laws applicable to the agreed processing. These terms operate throughout the period UIB processes customer personal data, including authorised retention after service termination.
Documented instructions and purpose limitation
UIB shall process customer personal data only on documented lawful instructions, including agreed service configuration and transfer instructions, and only for providing, securing, supporting and maintaining the contracted services. UIB shall not use customer personal data for unrelated advertising or independently train general-purpose AI models on it without a separate lawful, express agreement. Where law requires other processing, UIB shall inform the customer before processing unless legally prohibited. UIB shall inform the customer if an instruction appears to infringe applicable data-protection law and seek clarification.
Customer obligations
The customer shall establish a lawful basis, provide required notices, obtain applicable consent, maintain accurate data and give lawful instructions. It shall ensure that data and intended uses are necessary, proportionate and appropriate to the selected services. Special-category or sensitive data, children’s data, payment information, regulated records and consequential automated decisions require any necessary legal conditions and specific safeguards agreed before processing. Where the customer is a processor, it must obtain the controller’s authorisation to appoint UIB.
Confidentiality and security
UIB shall limit access to authorised personnel and providers who need it for the agreed purposes and are bound by confidentiality obligations. UIB shall implement technical and organisational measures appropriate to the risk, considering the nature, scope, context and purposes of processing and potential harm. The deployment’s security schedule shall document applicable access management, encryption, logging, resilience, recovery, testing and incident-management measures. UIB shall make relevant security documentation reasonably available to the customer and shall not materially reduce agreed protection during the processing term.
Sub-processors
UIB shall engage sub-processors only under the customer’s prior written specific or general authorisation. Under general authorisation, UIB shall provide advance notice of intended additions or replacements and an opportunity to object on reasonable data-protection grounds before the new processing begins. Notice and objection periods and resolution mechanisms shall be specified in the agreement. UIB shall impose materially equivalent applicable data-protection duties by written contract and remain responsible for its sub-processors’ performance of those duties. Request the current deployment-specific list, functions and locations from privacy@uib.ai. No client-specific provider list is incorporated into this general page.
International transfers and approved locations
Processing locations, remote-access locations and permitted onward transfers shall be documented and authorised in the processing schedule. UIB shall not transfer customer personal data contrary to agreed instructions or applicable transfer restrictions. Where required, the parties shall execute applicable EU Standard Contractual Clauses, UK transfer instruments or other lawful safeguards and complete the required assessments before restricted transfers. Singapore and Malaysian transfer requirements apply where relevant. This page does not itself execute a transfer instrument or guarantee Malaysia-only hosting, zero data retention or a particular AI provider’s terms.
Assistance and individual rights
Taking account of the nature of processing and information available, UIB shall reasonably assist the customer with data-subject requests, security obligations, breach assessments and notices, impact assessments and prior regulatory consultation. UIB shall forward requests concerning customer-controlled data without undue delay and shall not respond substantively except on instructions or as legally required. The parties shall agree practical procedures and any permitted charges; assistance shall not prevent compliance with mandatory duties.
Personal-data breaches
UIB shall notify the customer without undue delay after becoming aware of a personal-data breach affecting customer personal data and comply with any shorter period expressly agreed. A 24-hour deadline applies only where included in the relevant signed agreement, not as a universal website promise. Notice shall include, as available, the nature and timing of the incident, affected data and individuals, likely consequences, contact details and containment or remedial measures. Information may be supplied in phases as the investigation progresses. UIB shall cooperate with the customer’s lawful response; notification is not an admission of liability. The customer remains responsible for controller notifications unless otherwise required by law.
Return and deletion
At the end of the services or the approved purpose, UIB shall, at the customer’s choice, return customer personal data in an agreed usable format or delete it, and delete existing copies unless applicable law requires retention. Timing, secure transfer, protected backup expiry and any lawful retention shall be documented in the agreement. Retained data shall remain protected, access-restricted and processed only for the lawful retention purpose. UIB shall provide confirmation of deletion or equivalent evidence on reasonable request.
Compliance information and audits
UIB shall make available information reasonably necessary to demonstrate compliance and permit and contribute to audits, including inspections, by the customer or its independent auditor under applicable law. The parties shall coordinate reasonable notice, scope, confidentiality and security safeguards without obstructing mandatory audit rights or regulator access. Audits must protect other customers’ data. UIB shall address substantiated non-conformities with appropriate corrective measures. Audit costs and operational procedures are governed by the agreement.
Processing schedule
Before processing begins, the agreement and service configuration shall identify the parties and contacts; subject matter, nature, purposes and duration; controller rights and obligations; categories of individuals and personal data; sensitive-data restrictions; approved countries and remote access; authorised sub-processors; transfer safeguards; security measures; incident contacts and notice periods; and return or deletion arrangements. Typical purposes include messaging and channel onboarding, inbox and ticket management, campaigns and consent records, AI-assisted responses, knowledge-base processing, support, monitoring and recovery, only where purchased. Typical individuals are the customer’s prospects, customers, staff and authorised users; typical data comprises contact and channel identifiers, messages and attachments, conversation and ticket history, consent records, delivery logs and user access records. These examples do not authorise every data category or service.
Liability, law and contact
Liability, remedies, notices, governing law and dispute resolution follow the service agreement, subject to mandatory law and any controlling transfer instrument. This general DPA does not introduce a client-specific indemnity, exclusive Malaysian jurisdiction or new limitation of liability. For the deployment-specific DPA, security schedule, sub-processor list or privacy assistance, contact privacy@uib.ai; contractual notices must also follow the agreed notice procedure.