A starting point for your legal team. It covers the Singapore PDPA and the Australian Privacy Act. It's a template, not legal advice.
Download PDFThis Data Processing Agreement ("DPA") forms part of the agreement between the customer ("Customer") and Klypps ("Processor") for the Klypps social and video intelligence service.
It applies where Klypps processes personal data on the Customer's behalf, and is drafted to support obligations under the Singapore Personal Data Protection Act 2012 (PDPA) and the Australian Privacy Act 1988 including the Australian Privacy Principles (APPs).
The Customer is the organisation (PDPA) or APP entity that determines why personal data is processed. Klypps acts as a data intermediary (PDPA) and processes personal data only on documented instructions from the Customer.
Workspace users: name, work email, role, sign-in activity, IP address and browser user agent for security logging.
Connected own accounts (optional): aggregate insights the Customer authorises from its own Instagram, Facebook, TikTok or YouTube accounts, including aggregate audience demographics. No individual follower identities are requested.
Public content: publicly visible posts and engagement counts. Public commenter identifiers are replaced with salted one-way hashes; names, avatars and profile links are not kept as identities.
Process personal data only to provide the service and as instructed in writing.
Ensure personnel with access are bound by confidentiality.
Apply the security measures in Annex A (protection obligation, PDPA s24; APP 11).
Not sell personal data or use it to train general-purpose AI models.
The Customer authorises the subprocessors listed at /subprocessors. Klypps will give at least 30 days' notice of new subprocessors, during which the Customer may object.
Primary data storage is in Canada (AWS ca-central-1). Klypps will ensure recipients outside Singapore and Australia provide a standard of protection comparable to the PDPA (Transfer Limitation Obligation, s26) and take reasonable steps under APP 8.
Klypps will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a data breach affecting Customer personal data, to support the Customer's assessment under PDPA Part 6A (notify the PDPC within 3 calendar days of assessing a notifiable breach) and the Australian Notifiable Data Breaches scheme.
Klypps will help the Customer respond to access and correction requests. Disconnecting a connected account deletes its stored insights and token immediately. On termination, Customer data is deleted within 30 days unless law requires retention.
Comments and raw collection payloads default to 12 months (configurable per workspace). Connected-account insights are kept while the connection is active and deleted on disconnect, on platform deauthorisation, or after 25 months, whichever is first.
On reasonable written request, Klypps will provide information needed to demonstrate compliance with this DPA, including its security questionnaire answers.
Encryption in transit (TLS) for all traffic; encryption at rest for the database and storage provided by the hosting platform; connected-account tokens additionally encrypted with AES-256-GCM in application code.
Row-level security on every customer table, scoped to workspace membership and role; invitation-only sign-up; owner-only management of share links, pause/resume and session settings.
Security activity log of sign-ins, role changes, invites, share links, exports, connections, memory edits, budgets and pause/resume, with IP address and user agent, visible to organisation owners.
Configurable idle sign-out per organisation; sign out of other sessions; attempt limits on password-protected share links.
Customer: ____________________ Name/Title: ____________________ Date: __________
Klypps: ____________________ Name/Title: ____________________ Date: __________