Edmond — Data Processing Agreement

Parties and scope

This agreement forms part of the Terms of use between the customer (the business using Edmond, “Customer”) and Monte Cristo APAC Pte. Ltd., UEN 202620688D, 261 Waterloo Street, Waterloo Centre #03-036, Singapore 180261 (“Provider”). It applies whenever the Provider processes personal data on the Customer's behalf under Singapore's Personal Data Protection Act 2012 (PDPA) or, for customers in the European Union or the United Kingdom, the GDPR / UK GDPR.

1. Roles

The Customer is the controller (or, under the PDPA, the organisation) of the personal data it connects to Edmond. The Provider is the processor (data intermediary) and processes that data only to provide the service.

2. Subject matter and duration

Processing covers the data described in the privacy policy: the Customer's e-mails, calendar, files, CRM records, meeting notes, messages, photos and voice notes sent to Edmond, and the resulting drafts, filings and summaries. Processing lasts for the term of the subscription and the deletion period that follows (30 days).

3. Nature and purpose

Reading the connected tools, preparing drafts (e-mails, appointments, CRM notes, expense filings, summaries, briefs), and presenting them to the Customer for approval. Edmond never sends, deletes or pays on the Customer's behalf; this limit is enforced in code and verified by an automated test at every release.

4. Data subjects and categories

The Customer's staff, customers, prospects and contacts. Categories: identity and contact details, professional role and company, correspondence, meeting content, expense receipts, travel details, and loyalty programme names with at most the last four characters of membership numbers (never the full number). The Customer must not use Edmond to process special categories of data (health, biometrics, criminal records, etc.).

5. Instructions

The Provider processes personal data only on the Customer's documented instructions, which are given through the service's settings and the tools the Customer chooses to connect. The Provider informs the Customer if an instruction appears to infringe applicable law.

6. Confidentiality

Persons authorised to process the data are bound by confidentiality. No human reads the Customer's data except with the Customer's explicit consent, for security reasons, or where the law requires it.

7. Security

Encryption in transit (HTTPS/TLS, including to the database) and at rest for receipt photos; tenant isolation verified by automated tests; secrets held by dedicated providers (Nango for connection tokens) and never by Edmond; least-privilege access scopes shown at connection time; audit log of every automated action (metadata, including the recipient and subject of the drafts Edmond prepared, never their body); regular security reviews. Details on request.

8. Sub-processors

The Customer authorises the sub-processors listed on the sub-processors page. The Provider notifies customers at least 30 days before adding or replacing a sub-processor, by e-mail to the account address and on that page. The Customer may object on reasonable grounds; if no solution is found, the Customer may terminate the subscription and receive a pro-rata refund of any period paid in advance.

9. International transfers

Data is stored in Singapore (Supabase, Render). Some processing takes place outside Singapore: AI model inference by Anthropic (United States), voice transcription by AssemblyAI (European Union), and the encrypted storage of the authorisations that connect your tools by Nango (United States), and the sending of service emails to the member by Resend (data stored in the United States). For data of EU/UK data subjects, transfers are covered by the European Commission's Standard Contractual Clauses (or UK Addendum) included in the sub-processors' terms, and by the Provider's own commitments under this agreement.

10. Assistance

The Provider assists the Customer in responding to data-subject requests (access, correction, deletion, export) within 10 working days, and in meeting its security, breach-notification and impact-assessment obligations, taking into account the nature of the processing.

11. Personal data breach

The Provider notifies the Customer without undue delay, and at the latest within 72 hours of becoming aware of a breach affecting the Customer's data, with the information available at that time, and keeps the Customer informed.

12. Deletion and return

The Customer can export its contact book from the portal at any time; a full export of its data is provided on request within 10 working days. The Customer can also request erasure of what Edmond has read from “Your data”. At the end of the subscription, the Provider deletes the Customer's data within 30 days, except where the law requires longer retention (for example invoices).

13. Audit

On written request, no more than once a year, the Provider provides the information needed to demonstrate compliance (security description, sub-processor list, test results) and allows a reasonable audit by the Customer or an independent auditor bound by confidentiality, at the Customer's cost, with 30 days' notice.

14. Liability and law

Liability is governed by the Terms of use. This agreement is governed by the law of Singapore.

Contact

Data protection officer — hi@youredmond.com