Data Processing Agreement

7.1 Purpose

This policy describes how Prime TMS processes, stores, and secures personal and business data within TradeAlly and the TM Search Engine, in compliance with the PDPA and generally accepted information security practices aligned with ISO/IEC 27001 principles.

7.2 Data Processing Principles

Data is processed lawfully, fairly, and only for purposes disclosed in our Privacy Policy. Access to production data is restricted to authorised personnel on a need-to-know basis.

7.3 Encryption Standards

Data in transit is encrypted using TLS 1.2 or higher. Data at rest, including screening databases and user account data, is encrypted using industry-standard encryption (e.g., AES-256) where supported by our hosting infrastructure.

7.4 Access Controls

Access to systems and databases is role-based, protected by unique credentials, and, where available, multi-factor authentication. Administrative access is logged and periodically reviewed.

7.5 Server Locations and Hosting

The Services, including the TM Search Engine, are hosted on cloud infrastructure (Railway and associated providers). Where data is processed outside Singapore, appropriate safeguards are applied consistent with PDPA cross-border transfer requirements.

7.6 Backups

Regular automated backups of critical data are maintained to support business continuity and disaster recovery, with backups encrypted and access-restricted equivalent to production data.

7.7 Incident Response

Prime TMS maintains an incident response process to detect, contain, assess, and remediate security incidents, including: immediate containment; root-cause investigation; system restoration; and post-incident review.

7.8 Data Breach Notification

In the event of a data breach that results in, or is likely to result in, significant harm to affected individuals, or is of a significant scale, Prime TMS will notify the Personal Data Protection Commission (PDPC) as soon as practicable, and in any case no later than 72 hours after becoming aware of the breach, consistent with PDPA mandatory breach notification requirements, and will notify affected individuals where required.

7.9 Vendor and Third-Party Security

Third-party processors (including Stripe and hosting providers) are selected based on their security posture and are contractually bound to maintain appropriate data protection standards.

7.10 Review

This policy is reviewed at least annually or following any material security incident, infrastructure change, or regulatory update.