Data Processing Addendum

1. Parties, scope, and order of precedence

This DPA supplements the agreement between the Xspace customer (Customer) and the approved Cankonix contracting entity (Processor). It applies when Processor handles personal data on Customer's documented instructions to provide Xspace.

The signed order form and negotiated DPA control over this online draft where they conflict. Customer is controller and Cankonix is processor unless applicable law assigns different roles.

2. Processing instructions and compliance

• Process personal data only to provide, secure, support, maintain, and delete or return Xspace data under the agreement and documented Customer instructions.
• Inform Customer if an instruction appears unlawful, unless prohibited from doing so.
• Ensure personnel with access are bound by confidentiality and receive appropriate security and privacy obligations.
• Customer is responsible for lawful instructions, notices, legal bases, participant permissions, and data accuracy.

3. Security measures

• Tenant-scoped authorization, least-privilege roles, administrative audit trails, MFA and enterprise identity controls.
• TLS in transit, protected credentials and secrets, private object storage, backup and recovery controls.
• Monitoring, vulnerability review, incident response, retention, legal hold, export, and controlled deletion workflows.
• Regular review of technical and organizational measures appropriate to risk and service evolution.

4. Subprocessors

Customer authorizes subprocessors needed for infrastructure, email, realtime communication, storage, observability, support, and configured payments, subject to written data-protection obligations. Before commercial sign-off, Cankonix must publish the current subprocessor list, processing location, and change-notification mechanism.

Cankonix remains responsible for subprocessor obligations to the extent required by the final agreement and applicable law.

5. Data subject requests and government demands

Taking into account the nature of processing, Cankonix will reasonably assist Customer with verified rights requests, regulatory inquiries, and required impact assessments. Cankonix will not independently respond on Customer's behalf unless required by law or authorized.

Cankonix will notify Customer of legally binding demands for Customer data when permitted and will disclose only what is legally required.

6. Personal data breach

Cankonix will notify Customer without undue delay after confirming a personal data breach affecting Customer data and will provide available information reasonably needed for Customer's duties. Notification is not an admission of fault.

The final DPA must specify the agreed notification channel, contacts, and any contractual timing aligned with Indonesian law and target markets.

7. Return, deletion, audit, and transfer

At termination or on valid instruction, Cankonix will return or delete Customer data according to service capabilities, retention schedules, legal holds, backups, and law. Cankonix will provide reasonable compliance information and support proportionate audits under confidentiality and security controls.

Cross-border processing will use required safeguards. Details of hosting region, subprocessors, deletion periods, and transfer mechanisms must be completed in the signed annexes.

Annex — processing description

• Subject matter: secure business collaboration and administration.
• Duration: subscription term plus configured retention, backup expiry, dispute, and legal-hold periods.
• People: workspace users, invited participants, guests, administrators, support contacts, and individuals appearing in customer content.
• Data: identity, contact, profile, participation, communications, files, recordings, calendar, security, device, usage, audit, support, and limited billing references.
• Sensitive data: not required for ordinary use; Customer must avoid unnecessary sensitive content and apply heightened controls where processing is lawful and necessary.