Data Processing Addendum

1. Introduction

This Data Processing Addendum (the "DPA") is an addendum to the Terms of Service and is incorporated by reference. In the event of any conflict between the Terms of Service and this DPA, this DPA shall prevail with respect to the processing of end customer personal data; for all other matters, the Terms of Service shall prevail.

This DPA is entered into between the merchant (the "Data Controller") and Novix Star Limited (the "Processor", "we", "us") and governs the terms on which we process end customer personal data on behalf of the Data Controller.

2. Definitions

• Personal Data: means personal data as defined under the Personal Data (Privacy) Ordinance (Cap. 486) and, for the purposes of this DPA, refers to personal data of the merchant's end customers (i.e. persons who contact the merchant via WhatsApp)
• Data Controller: means the merchant, who determines the purposes and means of processing
• Processor: means the Company, which processes Personal Data on behalf of and on instructions from the Data Controller
• Sub-processor: means a third party we engage to assist in processing Personal Data
• Processing: means any operation performed on Personal Data

3. Subject Matter of Processing

Nature and purpose of processing: To provide the NovixOne platform service, including AI auto-reply, order processing, booking management, customer relationship management, AI analysis, and merchant business management.

Duration of processing: From the merchant's commencement of use of the Platform until termination of this DPA or termination of the merchant's account, including any retention period required by law or this Agreement.

Categories of data: WhatsApp phone numbers, display names, conversation content (text, images, voice), order records, booking records, AI-extracted customer memories and signals, tags and notes entered by merchants about customers.

Categories of data subjects: The merchant's end customers.

4. Processor Obligations

We agree to:

• Process Personal Data only on the Data Controller's documented instructions (the Terms of Service and Platform configuration constitute documented instructions), unless required otherwise by law
• Adopt appropriate technical and organisational measures to provide a level of security commensurate with the risk
• Ensure that personnel with access to Personal Data are bound by confidentiality obligations
• Provide reasonable assistance to the Data Controller in fulfilling its legal obligations to the extent reasonably practicable (see Section 7)
• Upon termination of this DPA, delete or return Personal Data on the Data Controller's request (see Section 9)
• Provide reasonable information needed to demonstrate compliance with this DPA

5. Security Measures

We adopt appropriate technical and organisational measures with respect to the processing of Personal Data, including but not limited to: encryption in transit, encryption at rest, access controls, logging and monitoring, regular backups, vulnerability management, and employee training.

We make no commitment to any specific security certification, standard, or framework (such as ISO 27001 or SOC 2). We may update or modify security measures at our sole discretion at any time.

6. Sub-processors

The merchant hereby provides general written authorisation for us to engage sub-processors to assist in processing Personal Data. The current category-level list of sub-processors is set out on the Sub-processors page, listed by category (rather than by name) for commercial confidentiality reasons.

We may add, change, or remove sub-processors at any time, with updates posted on the Sub-processors page. Continued use of the Platform constitutes the merchant's consent to the updated list.

A merchant's sole remedy for objecting to any sub-processor is to terminate this Agreement and discontinue use of the Platform. We are not liable for any losses arising from such termination.

We are responsible for the performance of engaged sub-processors with respect to this DPA, subject to the limitation of liability provisions in the Terms of Service.

7. Assistance to Data Controller

We will, to the extent reasonably practicable, provide reasonable assistance to the Data Controller in respect of: (a) responding to end customer data rights requests; (b) complying with data breach notification obligations; (c) conducting data protection impact assessments (where applicable); (d) communicating with regulators.

For any assistance beyond our general support scope, we are entitled to charge a reasonable fee at our then-current standard rates. End customer data rights requests should be handled directly by the Data Controller. If we receive such requests directly, we may redirect them to the Data Controller and have no obligation to respond directly.

8. Data Breach Notification

Upon becoming aware of a security incident affecting the Data Controller's Personal Data, we will, where reasonably practicable, notify the Data Controller within 72 hours. The notification will include reasonable information available at the time, including the nature of the incident, categories of data affected, and estimated number of data subjects affected.

We retain sole discretion as to the content, timing, and level of detail of breach notifications. Our liability for breach incidents is subject to the limitation of liability provisions in the Terms of Service.

The Data Controller is solely responsible for assessing the impact of breach incidents on its end customers and issuing notifications to end customers and regulators as required by law.

9. Return or Deletion

Upon termination of this Agreement, the Data Controller has 30 days to make a written request for return or deletion of Personal Data. If no request is made within that period, we may delete or anonymise Personal Data in accordance with our internal retention policy and shall not be liable for any data subsequently unable to be returned.

Notwithstanding termination of this Agreement, we may continue to retain Personal Data to fulfil legal, compliance, dispute resolution, or fraud prevention needs. We may also retain anonymised or aggregated data indefinitely for commercial and product improvement purposes.

10. Cross-Border Transfers

The Data Controller expressly consents that we and our sub-processors may transfer Personal Data to any jurisdiction outside Hong Kong for storage or processing. We do not adopt any specific transfer safeguard mechanism (such as the EU Standard Contractual Clauses or Binding Corporate Rules) for cross-border transfers, except where expressly required by applicable law.

11. Audit Rights

To demonstrate compliance with this DPA, we may provide audit by means of:

• Providing security summaries or compliance documents we publish from time to time
• Responding to no more than one written security questionnaire from the Data Controller per year
• Audit scope subject to prior written agreement
• Audit conducted under a non-disclosure agreement and not interfering with our normal business operations
• Audit costs (including time and resources we expend) borne by the Data Controller

We do not accept any form of on-site audit, penetration testing, or vulnerability scanning without our prior written consent.

12. Liability

Our liability under this DPA is subject in full to the Limitation of Liability and Indemnification provisions of the Terms of Service. This DPA does not establish independent additional liability caps or indemnification obligations.

13. Governing Law

This DPA is governed by and construed in accordance with the laws of the Hong Kong Special Administrative Region. Any disputes shall be submitted to the exclusive jurisdiction of the courts of Hong Kong.

14. Entire Agreement

This DPA, together with the Terms of Service, Privacy Policy, Acceptable Use Policy, and Sub-processors list, constitutes the entire agreement. We may amend this DPA at our sole discretion at any time, with amendments effective immediately upon posting on this page.