Data Processing Agreement

This Data Processing Agreement ("DPA") supplements and forms part of the Terms & Conditions between Develab ("Rideum," "we," "us") and the customer ("Client," "you") who subscribes to the Rideum platform, including Bleustay, Bleudine, and Bleudash (the "Services").

This DPA applies whenever we Process Personal Data on your behalf in the course of providing the Services. Under Indonesia's Personal Data Protection Law (Law No. 27 of 2022, "PDP Law"), you act as the Personal Data Controller and Rideum acts as the Personal Data Processor. Where the EU/UK GDPR applies to your data subjects, the equivalent controller/processor roles apply.

• Personal Data — any information relating to an identified or identifiable natural person that we Process on your behalf under the Services.
• Processing — any operation performed on Personal Data (collection, storage, use, transmission, deletion, etc.).
• Controller / Processor — as defined under the Applicable Data Protection Law; here, you and Rideum respectively.
• Data Subject — the individual to whom Personal Data relates (e.g., a hotel guest, restaurant diner, or your staff member).
• Sub-processor — a third party engaged by Rideum to Process Personal Data (see our Sub-processors page).
• Personal Data Breach — a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data.
• Applicable Data Protection Law — the PDP Law and any other data-protection or privacy laws applicable to the Processing.

• Subject matter & duration: Processing takes place for the duration of your subscription plus any retention period described in the Terms and this DPA.
• Nature & purpose: to provide hospitality management functionality — reservations and property management, point-of-sale, task dispatch, payment facilitation, guest communications, and AI-assisted features — as configured by you.
• Categories of Data Subjects: your hotel guests and restaurant diners; your staff, workers, and contractors; and your business contacts.
• Categories of Personal Data: identity and contact details; reservation, stay, and order records; transaction and payment metadata; identity-document data where you enable scan/check-in features; location data where you enable dispatch/tracking; and the content of communications routed through the Services.

• You must have a valid lawful basis to collect and Process the Personal Data you upload, and to have us Process it on your behalf.
• You are responsible for providing all required notices and, where relevant, obtaining consents from Data Subjects.
• Your instructions to us (including via configuration of the Services) must comply with Applicable Data Protection Law.

We will:

• Process Personal Data only on your documented instructions, including as set out in the Terms and this DPA, unless required otherwise by law (in which case we will inform you where legally permitted);
• ensure that personnel authorised to Process Personal Data are bound by confidentiality;
• implement the security measures described in Section 6; and
• assist you, taking into account the nature of Processing, in meeting your obligations under Applicable Data Protection Law.

We maintain appropriate technical and organisational measures designed to protect Personal Data against a Personal Data Breach, aligned with our ISO/IEC 27001-certified information security management system. These include encryption of data in transit and at rest, role-based access controls, network protection, logging and monitoring, and regular review. Details are described in our Trust Center.

You provide general authorisation for Rideum to engage Sub-processors to support delivery of the Services. A current list is available on our Sub-processors page. We impose data-protection obligations on each Sub-processor that are no less protective than those in this DPA, and we remain responsible for their performance. We will give notice of intended changes to Sub-processors and provide a mechanism to object as described on that page.

Taking into account the nature of the Processing, we will assist you by appropriate technical and organisational measures, insofar as possible, to respond to requests from Data Subjects to exercise their rights (such as access, correction, erasure, objection, and withdrawal of consent) under Applicable Data Protection Law. If a Data Subject contacts us directly regarding data you control, we will refer them to you.

We will notify you without undue delay after becoming aware of a Personal Data Breach affecting Personal Data we Process on your behalf, and will provide information reasonably available to us to help you meet any breach-notification obligations you may have to regulators or Data Subjects.

Personal Data may be Processed in Indonesia and in other locations where Rideum or its Sub-processors operate, including Singapore and Malaysia. Where Personal Data is transferred across borders, we implement safeguards required by Applicable Data Protection Law, including the cross-border transfer requirements of the PDP Law.

On reasonable written request, we will make available information necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, subject to reasonable notice, frequency limits, confidentiality obligations, and our security policies.

Upon termination or expiry of the Services, we will, at your choice, delete or return Personal Data Processed on your behalf, and delete existing copies, unless retention is required by law. Standard retention timelines are described in the Terms.

In the event of a conflict between this DPA and the Terms on the subject of data protection, this DPA prevails. Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms.

For questions about this document, or to exercise any right described here, contact us:

• Provider: Develab Pte. Ltd. (UEN 202402923E)
• Email: [email protected]
• Address: 10 Anson Road #10-11 International Plaza, Singapore 079903
• Website: https://www.rideum.io