Data Processing Agreement

AQUORIA O.N.E · AQUORIA Pte. Ltd. · Last updated 3 November 2026

This Data Processing Agreement ("DPA") is between the business using AQUORIA O.N.E ("the shop", "you") and AQUORIA Pte. Ltd., of 705 Sims Drive, #01-04B, Shun Li Industrial Complex, Singapore 387384 ("AQUORIA", "we", "us"). It applies when we process personal data of your customers and other people on your behalf in providing AQUORIA O.N.E (the "Service"). It forms part of our Terms of Service and takes effect when you accept them.

1. Definitions

In this DPA, "Data Protection Laws" means all laws on personal data that apply to the processing, including the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the Singapore Personal Data Protection Act 2012, the Malaysia Personal Data Protection Act 2010, the Australian Privacy Act 1988, and similar laws in other countries, in each case only where they apply. "Customer Personal Data" means personal data that we process for you as part of the Service, as described in Annex 1. "Controller", "processor", "data subject", "personal data breach" and "processing" have the meanings given in the GDPR, or the closest equivalent terms in other Data Protection Laws. "Sub-processor" means a third party we engage to process Customer Personal Data.

2. Roles

2.1 You are the controller

For Customer Personal Data, you are the controller (or the equivalent under local law, such as the "organisation" under the Singapore PDPA) and we are your processor (or "data intermediary"). You decide why and how this data is processed.

2.2 Your responsibilities

You are responsible for:

• having a lawful basis, and any consents needed, to collect Customer Personal Data and to have us process it, including for messages and marketing to your customers;
• giving your customers a clear privacy notice;
• the accuracy of the data you put into the Service; and
• making sure your instructions to us comply with Data Protection Laws.

2.3 Third-Party Services

When you connect your own accounts with other companies, such as WhatsApp Business (Meta), SMS providers, Telegram, payment providers or couriers, we send data to them on your instruction. Those providers are not our sub-processors; your own agreement with them governs how they handle the data.

3. Our obligations

3.1 Instructions

We will process Customer Personal Data only on your documented instructions, unless the law requires otherwise, in which case we will tell you before processing unless the law forbids it. Your instructions are set out in the Terms, this DPA, and the way you configure and use the Service. We will tell you if we believe an instruction breaks Data Protection Laws.

3.2 Confidentiality

We make sure that everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality, and only has access to the extent needed for their role.

3.3 Security

We implement appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the nature of the data and the risks involved. These measures are described in Annex 2. We may update them over time, provided the overall level of protection is not reduced.

3.4 Privacy tools

The Service gives you tools to help meet your obligations: export and erasure of a customer's data (erasure also deletes the photos, voice notes and files they sent), automatic anonymisation after your chosen retention period (36 months by default), deletion of delivery-proof photos after your chosen period (12 months by default), an audit log of views, exports and erasures, and masking of phone numbers on screens. You are responsible for choosing settings that suit your obligations.

4. Sub-processors

4.1 General authorisation

You authorise us to use sub-processors to provide the Service. Our current sub-processors, what they do and where they are located are listed at https://aquoriaone.com/legal/subprocessors.

4.2 Our duties for sub-processors

We will put a written agreement in place with each sub-processor that imposes data protection obligations no less protective than those in this DPA. We remain responsible to you for the performance of our sub-processors.

4.3 New sub-processors

We will give you at least 30 days' notice before we add or replace a sub-processor, by email or in the app and by updating the list. If you have a reasonable objection based on data protection, you can tell us within that period. We will try to address it; if we cannot, you may end your subscription before the change takes effect.

5. Assistance

5.1 Data subject requests

Taking into account the nature of the processing, we will help you respond to requests from people exercising their rights, mainly through the tools in the Service. If we receive a request directly, we will pass it to you without undue delay and will not respond ourselves unless you ask us to or the law requires it.

5.2 Impact assessments and authorities

We will give you reasonable information and help, taking into account the information available to us, for data protection impact assessments and prior consultations with authorities that relate to the Service.

6. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we will notify you without undue delay and in any case within 48 hours of becoming aware of it. Our notice will describe, as far as we then know, the nature of the breach, the categories and approximate number of people and records affected, the likely consequences, and the steps taken or proposed to deal with it. We will provide further information as it becomes available, take reasonable steps to contain and remedy the breach, and help you meet your own obligations to notify authorities and affected people. Notifying you is not an admission of fault.

7. Deletion and return

When your subscription ends, you can export Customer Personal Data during the 90-day period in which we keep your account for reactivation. After that period, we delete Customer Personal Data. Copies in backups are overwritten within a further 35 days. We may keep data only where the law requires us to, and in that case we will keep protecting it and process it only for that purpose.

8. Audits

We will make available to you the information reasonably needed to show that we comply with this DPA. We will do this through documentation, such as security summaries and policies, and by answering a reasonable written security questionnaire, no more than once a year unless there has been a personal data breach or an authority requires it. On-site audits will take place only where Data Protection Laws require them, with reasonable notice, during business hours, by an auditor bound by confidentiality, and at your cost.

9. International transfers

We and our sub-processors may process Customer Personal Data in countries other than your own. Where Data Protection Laws restrict such transfers, we will make sure they are protected, for example by relying on an adequacy decision, or by using the EU standard contractual clauses (with the UK international data transfer addendum where UK data is involved), or another transfer mechanism recognised by the applicable law. Where standard contractual clauses are needed between you and us, they are incorporated into this DPA by reference, with you as data exporter and us as data importer, using the module that fits our roles.

10. Liability and term

Each party's liability under this DPA is subject to the limits and exclusions in the Terms, except where Data Protection Laws do not allow them. This DPA lasts for as long as we process Customer Personal Data for you. If this DPA conflicts with the Terms on matters of personal data, this DPA wins. It is governed by the same law as the Terms, except where Data Protection Laws or standard contractual clauses require otherwise.

Annex 1: Details of processing

Subject matter

Providing AQUORIA O.N.E, a service that helps the shop run its business, including orders, bookings, customers, payments records, deliveries, loyalty, a customer ordering page or app, messaging and marketing, and, on the Business plan, staff, HR and payroll, stock, accounts, vehicles and rentals.

Duration

For the term of the shop's subscription or trial, plus the 90-day reactivation period after it ends and up to a further 35 days for backups, unless the law requires longer.

Nature and purpose

Collecting, storing, organising, displaying, updating, sending, exporting, anonymising and deleting data, so that the shop can serve its customers, on the shop's instructions. This includes sending messages through channels the shop connects; if the shop turns it on, using AI to reply to customer messages on WhatsApp; and, when the owner asks AQUORIA's help desk a question, using AI to answer it from the shop's status.

Categories of data

• customer names, phone numbers and optional email addresses;
• addresses for deliveries, collections or visits;
• orders, bookings and appointments;
• payment records, such as amounts, methods and status (not full card numbers);
• messages between the shop and its customers, including photos, voice notes and files customers send;
• notes the shop adds about customers;
• delivery-proof photos and signatures;
• loyalty points, rewards and visit history;
• staff records for HR and payroll, such as date of birth, identity number, pay, bank or payment details, leave, clock-in times and documents, and, if the shop turns on the clock-in location check, the distance from the nearest branch at clock in and out (never the location itself);
• for vehicle rentals, the driver's licence and vocational licence numbers and expiry dates, and pick-up and return photos and readings; and
• details of leads, subcontractors and other businesses the shop works with.

The shop should not put special categories of personal data (such as health data) into the Service unless it is needed for its business and the shop has a lawful basis to do so.

Data subjects

The shop's customers and prospective customers, people who receive deliveries or bookings, the shop's staff and drivers (including their HR and payroll records), and the shop's leads, subcontractors and other businesses it works with.

Annex 2: Security measures

• Encryption in transit: all connections to the Service use TLS.
• Tenant isolation: each shop's data is kept separate, and every request is checked so a shop can only reach its own data.
• Access control: staff roles and permissions set by the shop; AQUORIA personnel access only on a least-privilege, need-to-know basis. To help the owner, AQUORIA support can open a shop in a support view: each one lasts up to 4 hours, shows a banner, is recorded in the shop's access log, and cannot change where customers' payments go, the plan, sign-in details or the team, or download the shop's customer list.
• Passwords: stored only as strong one-way hashes, with temporary lockout after repeated failed sign-in attempts.
• Connected accounts: keys and access tokens for third-party services are stored encrypted.
• Audit log: recording views, exports and erasures of customer data.
• Data minimisation on screen: phone numbers masked by default.
• Retention controls: automatic anonymisation of customer records and deletion of delivery-proof photos after the shop's chosen periods.
• Backups: regular backups, rolled over within 35 days, to allow recovery from incidents.
• Monitoring and response: logging of security events and a process for handling and notifying personal data breaches.
• Personnel: confidentiality obligations for everyone with access, and security awareness.
• Sub-processors: chosen for their security standards and bound by written data protection terms.