Data Processing Agreement

You (the data controller). Codexroom Pte. Ltd., a company registered in Singapore (the data processor).

The processing of personal data by Codexroom in the course of providing the service.

Your workspace users (governors, creators, viewers). Your share recipients.

Account data: name, email, user ID.

Share recipient data: name, email (if supplied), session ID, geography at city level, user agent.

Audit data: timestamps and actor IDs for every mutation.

Listed and kept current on the trust subprocessor page. Notification of changes follows the schedule on that page.

Documented on the trust security page.

For personal data originating in Singapore: PDPA Section 26 cross-border transfer requirements, with contractual safeguards equivalent to the prescribed standard of protection. For personal data originating in the EU: the EU Standard Contractual Clauses (2021/914). For personal data originating in the UK: the EU SCCs together with the UK International Data Transfer Addendum. For personal data of California residents: service-provider obligations under the CCPA.

Codexroom notifies the customer inside 72 hours of confirmed breach, in line with the PDPA Data Breach Notification obligation and Article 33 GDPR.

Customer audit rights as documented in the full DPA.

Runs concurrent with the master service agreement.