Lakuchat Data Processing Terms

Parties: the Merchant ("Controller", also "data user" under Malaysia's PDPA, "organisation" under Singapore's PDPA) and TF Globe Pte Ltd, trading as Lakuchat ("Processor", also "data intermediary" in Singapore).

1.1 This applies to personal data that Lakuchat processes for the Merchant through the Service ("Customer Data"): phone numbers and channel IDs, names, chat messages, delivery details, order and payment status, payment screenshots, and anything else Customers send.

1.2 Data subjects are the Merchant's Customers, prospects and the Merchant's staff who use the dashboard (where we process it on the Merchant's behalf).

1.3 Purpose: to provide the Service as described in the Terms, namely replying to Customers, building carts, taking orders, sending receipts and status messages, giving the Merchant a dashboard and analytics, support, security, and detecting prohibited content (automatic checks for pornography, child abuse material, illegal goods and scams, with human review of flagged items only).

1.4 Duration: while the account is active and then as set out in section 11.

1.5 The Merchant must not use the Service to process sensitive personal data (for example health, biometric, religious, political or sexual-life data, or national ID numbers or card numbers) and must not ask Customers to send it in chat. We may block or redact it.

We will:

(a) process Customer Data only on the Merchant's documented instructions, which are the Terms, this document and the Merchant's settings and use of the Service, unless law requires otherwise (we will tell the Merchant first if allowed);

(b) tell the Merchant if we think an instruction breaks the law;

(c) make sure staff with access are bound by confidentiality and are authorised, and give them only the access they need;

(d) keep Customer Data of different Merchants separate (Annex 1);

(e) apply the security measures in Annex 1, which we review as the Service changes;

(f) not sell Customer Data, use it for our own marketing, or use it to train AI models, and use an AI provider only under paid-service terms that say the provider does not use the content to improve its products or train its models (the provider may log prompts for a limited time solely to detect abuse);

(g) not combine it with other data except as needed to provide the Service.

We protect Customer Data against loss, misuse, unauthorised access, disclosure, alteration and destruction with the measures in Annex 1. (Malaysia's PDPA applies the security principle directly to data processors.)

4.1 The Merchant gives general permission for the sub-processors in Annex 2.

4.2 We will update Annex 2 and give at least 30 days' notice (email or dashboard) before adding or replacing one that handles Customer Data. The Merchant may object in writing on reasonable data protection grounds within that time; if we cannot reasonably accommodate the objection the Merchant may end the affected service.

4.3 We bind each sub-processor to data protection terms no less protective than these in substance, and we remain responsible for their performance of those duties, subject to the liability limits in the Terms.

5.1 Our main systems run in Singapore. Some sub-processors (for example Meta, AI model providers, email and error-monitoring providers) may process data in other countries (Annex 2 shows where known).

5.2 We will transfer data only with a lawful basis under the applicable law, such as: an adequacy or equivalent-protection assessment, contractual safeguards (for example ASEAN Model Contractual Clauses or equivalent), recognised certifications, or the individual's consent where needed.

5.3 The Merchant, as Controller, gives Customers the notice and any consent the Merchant's local law requires for transfers, and makes its own transfer assessment where its law requires one (for example Malaysia's cross-border transfer rules, under which a Malaysian merchant sending customer data to us in Singapore must be able to show that the destination has substantially similar protection or another permitted basis). To help, we confirm that we are a Singapore company subject to Singapore's PDPA, that our systems are in Singapore, that this document gives contractual safeguards, and we give the information in Annex 1 and Annex 2. We provide a standard shopper privacy notice template (docs/legal/shopper-privacy-notice-TEMPLATE.md) and a list of countries on request.

5.4 Meta. Messages sent through WhatsApp or Instagram also pass through Meta's own systems. Meta handles that data under its own terms and privacy policy and is not our sub-processor for that purpose. The Merchant accepts Meta's terms for the channel (Terms of Service section 5).

5.5 If Indonesian law requires specific standard contractual clauses or an adequacy decision for a transfer, we will adopt them when they are available, and the parties will sign them if asked.

6.1 We will tell the Merchant without undue delay and in any case within 48 hours of becoming aware of a personal data breach affecting Customer Data, by email to the account owner and in the dashboard.

6.2 We will include what we know: what happened and when, data and people affected, likely consequences, what we have done, and a contact person. We will update as we learn more.

6.3 We will help the Merchant meet its own duties to notify regulators and individuals. The Merchant alone decides whether and how to notify, within the deadlines of the law that applies to it. These include, as we understand them at the date of this draft: Malaysia, notify the Commissioner as soon as practicable and no later than 72 hours after becoming aware, and affected individuals without unnecessary delay and within 7 days after that if significant harm is likely; Singapore, notify PDPC within 3 calendar days after assessing the breach as notifiable; Indonesia, notify the affected individuals and the authority within 72 hours once the failure is established.

6.4 Neither party may name the other in a public statement about a breach without prior notice, unless law requires.

7.1 If a Customer contacts us about their data, we tell them to contact the Merchant and tell the Merchant, unless law requires us to answer.

7.2 The Service includes tools for the Merchant to find, export (for access and for portability to another controller, which Malaysia's amended PDPA allows), correct and erase a Customer's data. We help with requests that the tools cannot meet, within 5 working days, so the Merchant can meet its deadlines (these can be short, for example Indonesia's implementing regulation sets 72 hours for many requests).

7.3 We give reasonable help with data protection impact assessments and regulator enquiries, at the Merchant's cost if the help is more than minor.

We will give the Merchant information reasonably needed to show compliance (a written summary of our security measures and answers to a security questionnaire) once a year. An on-site or technical audit is only available after a confirmed breach affecting the Merchant, or when a regulator requires it, on 30 days' notice, during business hours, with confidentiality, and at the Merchant's cost.

The Merchant promises that:

(a) it has a lawful basis and has given notices (and obtained consents where needed) to collect Customer Data and to have it processed through the Service and sub-processors, including cross-border transfers;

(b) it will only message people who have contacted it or opted in, and honour opt-outs immediately;

(c) it will not give us data it has no right to give, or sensitive data (section 1.5);

(d) it will respond to its Customers' requests and complaints and to regulators;

(e) it will keep its own accounts, passwords and devices secure and tell us of any suspected compromise;

(f) it will use the support-access permission and tools lawfully;

(g) it will, where its local law requires it, appoint a data protection officer and register or notify as needed.

Section 7 of the Terms applies. Staff access to Customer Data for support is processing on the Merchant's instructions and is limited as described there.

11.1 The Merchant can export Customer Data in the dashboard at any time and for 30 days after the account ends.

11.2 After that we delete or irreversibly anonymise Customer Data within 60 days, except what the law requires us to keep, and backups, which expire in their normal cycle (up to 35 days).

11.3 During use we apply the retention in Annex 1 unless the Merchant sets a shorter period.

The limits and exclusions in section 14 of the Terms apply to this document. The Merchant is responsible for claims by its Customers and for fines or penalties that arise because of the Merchant's own breach of data protection law. Each party remains responsible for its own legal duties under the law that applies to it, which this document does not remove.

If another law applies, the parties apply it to the extent required.

The Merchant's own payment provider (for example Billplz, Stripe or Xendit) and any e-commerce platform it connects (for example Shopify) are the Merchant's own service providers under their own terms, not our sub-processors.