Wake up tech data processing agreement

Wake up tech data processing agreement Update date: April 13, 2026 Effective date: April 13, 2026 1. Preface The parties agree that this Data Processing Agreement (“DPA”）Sets out the obligations of the parties with respect to the processing and security of developer data, including personal information contained therein. The parties also agree that the processing and security of data in Wake up tech products and functional services are governed by the DPA, unless a separate specific agreement exists. If the terms of the DPA are combined with other applicable agreements related to Wake up tech services (hereinafter referred to as“Wake up tech If there is any conflict or inconsistency with any other data terms in the "Agreement"), the terms of the DPA shall control. The terms of the DPA will supersede any conflicting terms in the Wake up tech Privacy Policy that would otherwise apply to the processing of Developer Data and Personal Information as defined herein. We may make amendments to the DPA from time to time, and such amendments shall form part of the DPA and have the same effect as the DPA. After the DPA is updated, we will announce the updated version on the platform and remind you of the updated content through an official website announcement or other appropriate means before the updated terms take effect, so that you can keep abreast of the latest version of the DPA. If you continue to use the platform and related services, you will be deemed to agree to accept the entire contents of the revised DPA. 2. Definition of terms Unless the context otherwise requires, the following words in the DPA have the following meanings: “"Developer Data" means:(1) Developers take advantage of Wake up tech feature/All data uploaded when the service obtains or creates an Agent (such as database information, plug-ins uploaded by developers/APIinformation, etc.), and (2) After the developer releases the Agent, all data processed by Wake up tech during the running of the Agent, including all text, sound, video or image files and software, also includes data that the developer can independently control and manage (such as configuration data, operation and maintenance data, etc.) derived from the use of Wake up tech products or services. “"Personal information" refers to various information related to identified or identifiable natural persons recorded electronically or by other means, excluding anonymized information. Personal information involved in the provision of specific services includes but is not limited to personal identity information (name), address, contact number, network identification information (including account name, email address), personal commonly used equipment information, location information, etc. “"Processing of personal information" includes the collection, storage, use, processing, transmission, provision, disclosure, deletion, etc. of personal information. “"Personal information subject" refers to the natural person identified by personal information. “Applicable law” includes but is not limited to Singapore’s Personal Data Protection Act 2012 (referred to as“PDPA”）and its related subsidiary legislation, guidance, and any other applicable data protection or privacy laws. “"Personal Information Security Impact Assessment" is the process of inspecting the legal compliance of personal information processing activities, determining the various risks of damage to the legitimate rights and interests of personal information subjects, and evaluating the effectiveness of various measures used to protect personal information subjects. “"Personal information security incidents" refer to incidents such as unauthorized login to the system, unauthorized access, reading, copying, modification, and deletion of personal information, the occurrence of system vulnerabilities, computer viruses, network attacks, network intrusions, etc., resulting in the leakage, loss, theft, or tampering of personal information. “"Principal Party" refers to an organization or individual (i.e. developer) that (alone, jointly or in collaboration with others) independently determines the purpose and method of processing in data processing activities. ““Principal” means any organization or person (other than an employee of the principal) that processes data on behalf of the principal, which under the DPA is Wake up tech (i.e. Singapore wakeup technology pte ltd). ““Data Protection Requirements” means the Singapore Personal Data Protection Act (PDPA) and all other applicable laws and regulations relating to the processing and privacy of personal information, including guidance, advice, notices and industry codes issued by any applicable national or local regulatory authority. “"Approved sub-contractor" refers to other sub-processors (sub-processors) used by the consignee Wake up tech to process developer data and personal information. Unless otherwise stated, other relevant terms in the DPA have the same definitions as in the Wake up tech Agreement. If not defined, they shall be interpreted in accordance with applicable law. 3. Data and Personal Information Protection Terms 1. Scope of application The DPA terms apply to all Wake up tech platforms and services. For clarity, the terms of the DPA only apply to data processed in an environment controlled by Wake up tech and Wake up tech’s permitted sub-contractors, and do not include data retained in the Developer’s environment or any third party operating environment chosen by the Developer. 2. Nature and purpose of data processing Developer rights and interests Wake up tech will only use and otherwise process Developer Data and Personal Information as described below and at:(a) provide the Platform and Services to the Developer in accordance with the Developer's documented instructions, and (b) When conducting business activities for the purpose of providing platforms and services to developers, the following terms and restrictions shall be observed. As between the parties, Developer owns all rights and interests in and to Developer Data. In addition to DPA and/Wake up tech does not acquire any other rights to Developer's Data other than the rights granted to Wake up tech by Developer in the Wake up tech Agreement. This paragraph does not affect Wake up tech's rights contained in the services provided by Wake up tech to Developers. Wake up tech will not disclose or allow anyone to access the processed data unless:(a) Authorization or instruction from the developer;(b) as provided in this DPA; or (c) Legal requirements. As far as DPAs are concerned,“Processed data” means:(a) Developer data (including personal information); and (b) Wake up tech Any other data processed under the Wake up tech Agreement in connection with the Platform and Services that is the Confidential Information of the Developer. All processing of processed data shall be subject to Wake up tech's confidentiality obligations in the Wake up tech Agreement. Wake up tech will not provide the following content to any third party:(a) Direct, indirect, full or free access to the processed data;(b) Platform encryption keys used to secure processed data or the ability to break such encryption. In order to meet the above commitments, Wake up tech may provide the developer's basic contact information to third parties. Wake up tech may use developer data to improve Wake up tech functionality, provided it is processed with secure encryption technology, strictly de-identified, and cannot be re-identified to specific individuals. 3. Personal information protection Scope of personal information All personal information processed by Wake up tech related to providing the platform and services will be obtained in the following form: data provided by the developer or data generated, derived or collected by Wake up tech based on the developer data and the scenarios in which services and functions are provided, including data sent to Wake up tech due to the developer's use of service-based functions or data obtained from the products and services provided by Wake up tech. Personal information includes any personal information that is pseudonymized or de-identified but is not anonymous. Anonymized information does not belong to personal information, where anonymization refers to the process in which personal information is processed so that it cannot identify a specific natural person and cannot be recovered. Roles and responsibilities of principal and trustee The developer and Wake up tech agree that the developer is the processor and entruster (data controller) of personal information, and Wake up tech acts as the entrusted party (data intermediary) entrusted by the developer according to the developer's instructions and purposes, except for the following circumstances:(a) The developer acts as the entrusted processor of personal information, and Wake up tech is the developer's permitted subcontractor; or (b) Where otherwise provided in the terms of a particular product or service or in this DPA. When Wake up tech acts as an entrusted processor or authorized sub-contractor of personal information, it can only process data in accordance with the developer's instructions and purposes. At the same time, the developer promises that the sources of personal information it handles are legal and compliant, and the collection, use, processing and other processing activities have been legally authorized by the relevant personal information subjects (including obtaining the consent required by the PDPA or based on other legal basis), complying with the relevant laws and regulations of Singapore's data protection, and not infringing the legitimate rights and interests of any third party. At the same time, the developer promises that it has the right to sub-entrust the processing of personal information. Developer agrees that the Wake up tech Agreement (including the DPA terms and any applicable updates), together with the Developer's documentation for using and configuring Wake up tech related features and the Developer's use of Professional Services, is the Developer's complete instructions to Wake up tech regarding the processing of personal information. Developers may find information regarding the use and configuration of the Product in the Wake up tech platform or other agreement that contains this DPA. Rights and obligations of the entrusting party The principal has the right to: (a) If you learn or discover that the entrusted party fails to comply with the provisions of the DPA, Wake up tech agreement and applicable laws in handling personal information, or the entrusted party fails to effectively perform the personal information security protection responsibilities, you have the right to require the entrusted party to stop relevant actions, and take or require the entrusted party to take effective remedial measures to control or eliminate the security risks faced by personal information. The resulting costs shall be borne by the entrusted party; (b) Unless applicable laws provide otherwise for specific information retention periods, when the developer cancels the Wake up tech account or permanently stops using Wake up tech services, Wake up tech shall process the account-related content and information in accordance with applicable legal provisions, including but not limited to deletion, anonymization, etc. The client promises: (a) Obtain authorization from the personal information subject: The entrusting party guarantees that the personal information it obtains has a legal basis that complies with applicable legal requirements (including consent or other legal basis required by the PDPA), so that the personal information agreed in the DPA can be legally provided to the entrusted party within the term and purpose of the DPA to carry out the agreed personal information processing activities; (b) The entrusting party shall abide by the relevant provisions of the DPA, Wake up tech agreement and applicable laws on the processing of personal information; as the entrusting party, it shall perform the relevant obligations of the personal information processor (data controller) in accordance with the PDPA and other relevant legal requirements; (c) The entrusting party shall conduct a personal information protection impact assessment (if required by applicable laws) before the entrusting party processes the personal information provided by the entrusting party to ensure that the entrusted processing matters and the purpose of the DPA are legal and compliant and do not infringe on the legitimate rights and interests of any third party. Rights and obligations of the trustee If the entrusted party has legitimate reasons to believe that the entrusting party's written instructions on personal information processing activities do not meet the personal information security needs or violate the provisions of any applicable law, the entrusted party shall promptly notify the entrusting party and have the right to require the entrusting party to stop relevant actions and take or require the entrusting party to take effective remedial measures to control or eliminate the security risks faced by the personal information. The resulting costs shall be borne by the entrusting party. If the entrusting party fails to resolve the risks and problems described in this article within a reasonable period, it will be regarded as a substantial breach of the DPA, and the entrusted party has the right to unilaterally terminate the DPA and Wake up tech protocol. The trustee promises: (a) The entrusted party shall abide by the relevant provisions of the DPA, Wake up tech agreement and applicable laws on the processing of personal information; as an entrusted processor, it shall perform the relevant obligations of data intermediary in accordance with the PDPA and other relevant legal requirements; (b) The entrusted party shall take necessary measures to ensure the security of the personal information provided by the entrusting party and assist the entrusting party in fulfilling its legal obligations; (c) The entrusted party shall use and process personal information within the scope agreed in the DPA; (d) The entrusting party can conduct a personal information security impact assessment (if required by applicable laws) on the entrusted processing of data before implementing this entrusted processing activity. On the premise of not harming the legitimate interests of all third parties, including the entrusted party and its affiliates, the entrusting party shall provide necessary assistance according to the entrusting party's reasonable requirements; (e) The entrusted party acknowledges and warrants that it will carry out personal information processing activities on behalf of the entrusting party and will take appropriate measures to ensure that employees who access personal information under its authorization only process personal information within the scope of the entrusting party's instructions; (f) The entrusted party shall require all its staff and any third-party service providers involved in personal information processing activities to strictly keep confidential the personal information entrusted to be processed, receive appropriate training, and strictly abide by the provisions of the DPA; (g) The entrusted party shall not process the personal information provided by the entrusting party beyond the purpose of the DPA. If the DPA is not effective, invalid, revoked or terminated, the entrusted party shall delete or anonymize the personal information provided by the entrusting party. Personal information subject rights request Both parties to the DPA will promptly respond to and handle the legal rights requests of personal information subjects (including rights of access, correction, deletion, etc. under the PDPA) in accordance with the provisions of applicable laws and the personal information protection policies of both parties. Both parties shall provide the other party with the necessary assistance:(a) If the entrusted party receives a request for rights from a personal information subject, it shall transfer the request to the entrusting party within a reasonable period unless prohibited by applicable law;(b) If relevant provisions of applicable laws require the entrusting party as the subject to respond to the rights request of the personal information subject, the entrusting party will fully cooperate with the entrusting party to protect the rights of the personal information subject, and the entrusting party shall provide the entrusted party with necessary assistance. Personal information security incident If a personal information security incident occurs during the processing of personal information, both parties shall: (a) Notify the other party promptly and inform the other party:(i) The nature of the personal information security incident, including the type and scale of the personal information involved;(ii) The possible consequences of the personal information security incident;(iii) remedial measures taken; (b) Assist the other party to investigate the personal information security incident and provide all relevant records, documents, logs, reports and other reasonable materials; (c) Take necessary measures in a timely manner in accordance with the emergency plan; (d) If a personal information security incident involves the leakage of personal information, you should comply with applicable laws (including the PDPA's data breach notification obligations) and promptly report to the relevant competent authorities and fulfill the notification obligations to personal information subjects required by applicable laws. Data transfer and location (a) In general, the Developer shall entrust Wake up tech to transfer the Developer Data or Personal Information to Singapore or the region where Wake up tech's selected cloud service provider is located, and to store and process the Developer Data and Personal Data at that location to provide the Products. Unless otherwise specified in writing by the Developer, Wake up tech will not transfer Developer Data and Personal Information processed on the Developer's behalf to, or store and process in, a geographical location outside Singapore. (b) If the developer needs to store or process data outside of Singapore, the developer should ensure that such transfer complies with applicable laws (including the requirements of the PDPA on cross-border data transfer) and assume corresponding compliance responsibilities. As a trustee, Wake up tech will cooperate with developers to fulfill possible legal requirements for cross-border data transfer. Security technology and permissions Wake up tech will implement and maintain appropriate technical and organizational measures to protect Developer Data, including the personal information involved therein, against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to data transmitted, stored or otherwise processed. For access to developer data required for service activities, permission-based access control is adopted to ensure that it can only be accessed if the purpose is reasonably consistent with the needs of the developer's products and services. Developer Responsibilities The Developer is solely responsible for independently determining whether the technical and organizational measures of the Products and Professional Services comply with the Developer's requirements, including any of its security obligations under applicable data protection requirements. The Developer acknowledges and agrees that (taking into account the state of the art, costs of implementation and the nature, scope, context and purpose of the data processing activities and risks to individuals) Wake up tech implements and maintains security practices and policies that provide a level of security appropriate to the risks associated with the data. Developers are responsible for implementing and maintaining privacy and security measures for components provided or controlled by Developers. Security incident notification If Wake up tech becomes aware of a security breach that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to Developer Data or Personal Information processed by Wake up tech (each referred to as“security incident"), Wake up tech should immediately:(a) Notify developers of security incidents;(b) Investigate security incidents and provide developers with detailed information about the security incidents; and (c) Take reasonable steps to mitigate the impact and minimize damage resulting from a security incident without undue delay. Security incident notifications will be sent to developers via any method chosen by Wake up tech, including email. Developer is solely responsible for ensuring that Developer provides accurate contact information to Wake up tech for each applicable product and professional service. Developers are solely responsible for complying with and fulfilling any third-party notification obligations (including notification obligations required by the PDPA) in connection with any security incident. Developer must immediately notify Wake up tech of any possible account or authentication misuse or any security incident related to the Platform and Services. Data retention and deletion The entrusted party shall not retain and process data for longer than necessary to achieve the agreed purpose of data processing, unless there are special provisions on the retention period of personal information in accordance with applicable laws. When the developer cancels the Wake up tech account or permanently stops using the Wake up tech service, Wake up tech will process the account-related content and information in accordance with applicable legal requirements, including but not limited to deletion, anonymization, etc. If Wake up tech has relevant legal obligations and should retain personal information beyond the period specified in the DPA, Wake up tech will delete or anonymize the relevant personal information as soon as possible after the end of the retention period required by relevant laws and in accordance with the provisions of the DPA. After the expiration of the data processing period or the expiration of the legal obligations related to data retention, Wake up tech will no longer respond to the developer's data and personal information processing and requests, except to fulfill the following purposes: developer billing and account management, remuneration (such as calculation of employee commissions and partner rewards). Confidentiality clause (a) Except as necessary to achieve the purpose of the DPA or to comply with applicable laws and regulations or obtain the developer's authorization or the consent of the personal information subject, Wake up tech will not disclose or disclose it in any form to any specific or unspecific third party, nor will it expressly or implicitly license or authorize any specific or unspecific third party to use it. (b) The personal information stipulated in the agreement can only be used within the scope required for the purpose of the DPA, and may not be disclosed in any form such as publicity or sub-entrustment, except for the following circumstances:(i) Disclosed to agents, representatives, officers, and employees of the entrusted party and permitted third parties who need to know the above information or personal information provided by the entrusting party to carry out the purposes of the DPA;(ii) DPA Any party is required by a court or based on relevant legal obligations to disclose such information or personal information provided by the entrusting party, but only to the minimum extent necessary to comply with such court order or legal obligations. 4. Efficacy and others Termination and consequences (a) If the Principal breaches any of its obligations under the DPA or any other agreement with the Principal, the Principal shall have the right to terminate the DPA immediately by written notice at any time. (b) The DPA terminates automatically without the need to serve any notice on the expiry or termination date of the last agreement between the principal and the principal relating to the principal's request for the principal to process the data provided by the principal. After the termination of the Wake up tech Agreement and DPA, both parties shall continue to perform their respective legal obligations. Governing Law and Dispute Resolution (a) This DPA shall be governed by and construed in accordance with the laws of the Republic of Singapore, without giving effect to its conflict of law principles. (b) Any dispute arising out of or in connection with this DPA, including any question regarding the existence, validity or termination of this DPA, shall first be resolved through friendly negotiation between the parties. If negotiation fails, either party may submit the dispute to the Singapore International Arbitration Center (SIAC) for arbitration in accordance with the arbitration rules in effect at that time. The place of arbitration shall be Singapore and the language of arbitration shall be English. Alternatively, the parties may agree to submit the dispute to the exclusive jurisdiction of the competent courts in Singapore. Except for the disputed terms, the continued performance of other terms of the DPA will not be affected during the dispute resolution period. Other matters (a) Regardless of the validity of the Wake up tech agreement and some of its terms, when Wake up tech carries out data processing activities stipulated in the DPA, both parties shall perform the corresponding rights and obligations in accordance with the DPA. (b) DPA Matters not specified may be interpreted with reference to the Wake up tech agreement. If there is any inconsistency between the DPA and the Wake up tech agreement in terms of data processing and protection, the DPA shall prevail.