Data Processing Agreement
Effective date: 26 October 2026
1. Scope and Roles
This Data Processing Agreement ("DPA") applies where a business customer ("Customer", acting as controller) uses PAI Workstation with a PeopleAI account, and PeopleAI Limited ("PeopleAI", acting as processor) processes personal data on the Customer’s behalf. It covers only data processed on PeopleAI-controlled servers: account profiles, license information, support records and cloud-synced channel-provisioning data. Data stored locally on Customer devices (messages, calendar entries, AI model API keys) is not processed by PeopleAI and falls outside this DPA — a direct consequence of PAI Workstation’s local-first architecture.
2. Subject Matter, Duration and Categories (Annex I)
Subject matter: provision and support of PAI Workstation accounts and channel delivery. Duration: the term of the Customer’s account. Nature and purpose: account management, license administration, IM channel provisioning (WhatsApp Business API / LINE via the EASTAR group channel cloud), and support. Categories of data subjects: the Customer’s authorized users and contacts. Categories of data: names, email addresses, license metadata, channel identifiers, and support communications.
3. Processing Only on Instructions
PeopleAI processes personal data only on the Customer’s documented instructions and shall not process it for its own purposes, unless required by applicable law, in which case PeopleAI will inform the Customer unless prohibited by law.
4. Confidentiality and Security
PeopleAI ensures that personnel authorized to process personal data are bound by confidentiality obligations. PeopleAI applies technical and organizational measures under GDPR Article 32, including: TLS 1.2+ encryption in transit, encryption of data at rest, role-based access controls, least-privilege administration, audit logging, and the local-first architecture of PAI Workstation, which minimizes the volume of personal data reaching PeopleAI-controlled systems by design.
5. Sub-processors
The Customer grants PeopleAI general written authorization to engage sub-processors. The current list is published at people-ai.hk/subprocessors and includes: Alibaba Cloud (Singapore) — cloud hosting; Cloudflare, Inc. — CDN and security; Airwallex — payment execution; the EASTAR group affiliated company — IM channel delivery. PeopleAI will notify the Customer of intended changes at least 30 days in advance, during which the Customer may raise reasonable objections.
6. Data Subject Rights and Assistance
Taking into account the nature of the processing, PeopleAI assists the Customer, where appropriate, in fulfilling its obligations to respond to data subject requests under GDPR Articles 12–22.
7. Personal Data Breach Notification
PeopleAI will notify the Customer without undue delay, and in any event no later than 48 hours after becoming aware of a personal data breach affecting the Customer’s personal data, with the information required under GDPR Article 33(3) as available.
8. Deletion and Return
Upon termination of the Customer’s account, PeopleAI will delete or return all personal data processed on the Customer’s behalf within 90 days, unless retention is required by applicable law.
9. Audits
PeopleAI makes available all information reasonably necessary to demonstrate compliance with this DPA and allows for and contributes to audits, including inspections, by the Customer — provided on reasonable notice. Where available, PeopleAI may satisfy this obligation by providing third-party audit reports (such as SOC 2) or completed security questionnaires in place of on-site inspections.
10. International Transfers
Where personal data is transferred from the EEA or UK to Singapore, the United States or other jurisdictions, transfers rely on the European Commission’s Standard Contractual Clauses (Modules 2 and 3) and the UK International Data Transfer Addendum, together with transfer impact assessments where required. Cloudflare’s EU-US Data Privacy Framework certification provides a supplementary safeguard where applicable.
11. Liability
Each party’s liability under this DPA is governed by GDPR Article 82 and the liability provisions of the applicable Terms of Use or enterprise agreement.
12. Singapore PDPA
Where the Customer is subject to the Singapore Personal Data Protection Act 2012 (PDPA), PeopleAI, as a data intermediary, undertakes to protect the Customer’s personal data with reasonable security arrangements and to process it only on the Customer’s instructions, consistent with sections 3 and 4 of the PDPA.
13. Contact
Data protection inquiries and DPA execution requests: [email protected].