Data Processing Addendum

Version 1 (draft) · Effective date: to be confirmed

This Data Processing Addendum ("DPA") forms part of the Terms and Conditions between HelixByte Sdn Bhd ("HelixByte", "we") and the customer ("you") for Cerev CMMS and related services (the "Service"). It applies whenever we process personal data on your behalf. If this DPA and the Terms conflict, this DPA prevails for personal data. A signed copy is available on request.

1. Roles

For personal data you or your users enter into the Service (staff, tenants, vendors, members of the public: names, contact details, photos, location and activity records, work requests), you are the data controller and we are the data processor under the Personal Data Protection Act 2010 (Malaysia), as amended. For our own records about you as a customer, we are the controller and our Privacy Policy applies.

2. Our obligations as processor

Instructions. We process your data only to provide, support and secure the Service, and on your documented instructions. We do not sell it or use it for any other purpose.
Confidentiality. Our staff and contractors who can access your data are bound by confidentiality and given access only where their role needs it.
Security. We maintain technical and organisational measures under our information security management system, including encryption in transit and at rest, access control, logging, backups and secure development.
Assistance. If an individual asks you for access to or correction of their data, we help you respond. Requests that reach us directly are passed to you within 5 working days.
Audit. On reasonable written request, no more than once a year, we provide information demonstrating compliance with this DPA.

3. Sub-processors

We use the following sub-processors to deliver the Service. We will give you at least 14 days' notice by email before adding or replacing a sub-processor that handles your data. If you object on reasonable data-protection grounds and we cannot resolve it, you may terminate the affected Service.

Sub-processor	Purpose	Location
Google Cloud / Firebase	Hosting, authentication, file storage, logging	Singapore
PlanetScale	Managed database	Singapore
Sentry	Error tracking (may capture request context)	US / EU
Resend	Transactional email	US
Expo (EAS)	Mobile app updates and push notifications	US
Anthropic	AI assistants and scheduled routines	US

4. Where your data is stored

Production data is hosted in Google Cloud, region asia-southeast1 (Singapore). By using the Service you instruct us to transfer your data there and to the sub-processors above, and confirm you have the consents or other lawful basis needed for that transfer.

5. Personal data breaches

If we confirm a breach affecting your data, we notify your designated contact without undue delay and within 48 hours, with the facts known at that time, and provide further details as we establish them so you can meet your own notification duties.

6. Return and deletion

During the contract you can export your data from the Service or ask us for an export. After termination, or on your written request, we delete your data within 90 days, except where the law requires us to keep it. Backups are overwritten in the normal cycle.

7. Changes

We may update this DPA to reflect changes in law or in the Service. Material changes are notified by email at least 30 days before they take effect. The current version is always at cerev.net/data-processing-addendum.

8. Contact

Data protection questions, including access and correction requests: support@cerev.net.

Security matters — reporting a breach, a suspected incident or a vulnerability in the Service: security@helixbyte.net. It reaches our directors directly and we acknowledge every report by email.