Collective Data Processing Agreement

This Data Processing Agreement (“DPA”) applies where River Valley Irregulars Pte. Ltd. (“RVI”) and an organisation operating or participating in an RVI Collective (“Collective Partner”) process Personal Data in connection with the Collective, and supplements the RVI Collective Partner Terms and any other agreement between RVI and the Collective Partner.

The purpose of this DPA is to establish the parties’ respective responsibilities for the protection, use and handling of Personal Data in connection with the RVI Platform.

For the purposes of this DPA, “Personal Data” has the meaning given to it under the Singapore Personal Data Protection Act 2012 (“PDPA”) and includes information about an identifiable individual accessed, collected, disclosed or otherwise processed through the RVI Platform.

Depending on the particular programme, event, opportunity or feature being used, Personal Data may include information such as a participant’s name, email address, contact information, profile information, programme or event registrations, applications, submissions and other information provided through the RVI Platform.

The exact categories of Personal Data available to a Collective Partner will depend on the features and permissions provided to that Collective.

Each party will comply with its obligations under applicable data protection laws in relation to Personal Data for which it is responsible.

Where RVI processes Personal Data solely on the instructions and behalf of a Collective Partner, RVI will process such Personal Data only for the purposes reasonably necessary to provide the relevant Platform or Collective services and in accordance with the Collective Partner's documented instructions, except where otherwise required or permitted by law.

Where the Collective Partner receives Personal Data from RVI and independently determines the purposes for which that Personal Data will subsequently be used, the Collective Partner is responsible for ensuring that its collection, use, disclosure and retention of that Personal Data complies with applicable law.

Nothing in this DPA is intended to assign a legal role to either party that is inconsistent with the actual circumstances in which Personal Data is processed.

A Collective Partner may access and use Personal Data obtained through the RVI Platform only for legitimate purposes connected with the relevant Collective, programme, event, opportunity or service for which the information was provided.

Personal Data obtained through RVI must not be used for unrelated purposes, including unrelated marketing, commercial solicitation, profiling or distribution to third parties, unless the relevant individual has been appropriately informed and the necessary consent or other lawful basis has been obtained.

Access to Personal Data must be limited to authorised personnel who reasonably require access for the relevant purpose.

Where authorised by a Collective Partner, RVI personnel may assist with administering the Collective, publishing content, managing events or opportunities and carrying out other agreed administrative activities on the Collective Partner's behalf.

Where such activities involve Personal Data, RVI personnel will access and process only the Personal Data reasonably necessary to perform the authorised activity.

The Collective Partner remains responsible for ensuring that instructions provided to RVI regarding the use of Personal Data are lawful and appropriate.

Each party must ensure that persons authorised to process Personal Data are subject to appropriate confidentiality obligations.

Personal Data accessed through the RVI Platform must not be disclosed to unauthorised persons.

Each party will implement reasonable administrative, technical and organisational measures appropriate to the nature of the Personal Data it processes.

These measures should be designed to protect Personal Data against unauthorised access, collection, use, disclosure, copying, modification, loss, disposal or similar risks.

Collective Partners are responsible for maintaining the security of their administrator accounts and must not share login credentials or provide Platform access to unauthorised persons.

Where either party becomes aware of a suspected or confirmed unauthorised access, disclosure, loss or other security incident involving Personal Data processed under this DPA, that party should notify the other party without undue delay where the incident may affect the other party or RVI users.

The parties will reasonably cooperate in investigating, mitigating and responding to the incident and in fulfilling any applicable legal or regulatory obligations.

Where a user makes a request concerning their Personal Data, including a request for access, correction, withdrawal of consent or deletion, each party will reasonably cooperate where necessary to enable the responsible party to respond in accordance with applicable law.

Where the request relates to Personal Data controlled independently by the Collective Partner after receiving it from RVI, the Collective Partner will be responsible for handling that request in relation to its own records and processing activities.

Personal Data must not be retained for longer than reasonably necessary for the purposes for which it was collected or received, except where continued retention is required or permitted by applicable law.

Where access to a Collective ends, the Collective Partner must cease accessing Personal Data through the RVI Platform unless continued access is separately authorised.

Where appropriate and subject to applicable legal or operational requirements, Personal Data processed solely on behalf of a Collective Partner may be returned, deleted or otherwise handled in accordance with the parties’ agreed arrangements.

RVI may use third-party infrastructure, hosting, authentication, communications, analytics or other service providers in operating the RVI Platform.

Where such service providers process Personal Data on RVI's behalf, RVI will take reasonable steps to ensure appropriate data protection arrangements are in place.

A Collective Partner must not transfer Personal Data obtained through RVI to another service provider or third party unless such transfer is permitted under applicable law and consistent with the purposes for which the Personal Data was provided.

Where Personal Data is transferred outside Singapore, the party responsible for the transfer will take reasonable steps to ensure that the transferred Personal Data receives a standard of protection comparable to that provided under the PDPA, where required by applicable law.

The parties will reasonably cooperate with each other regarding data protection matters relating to their Collective.

Where reasonably necessary to investigate a security, privacy or compliance concern, the Collective Partner will provide RVI with relevant information regarding its handling of Personal Data obtained through the Platform.

RVI may suspend or restrict a Collective Partner's access to Personal Data where reasonably necessary to protect users, respond to a security incident, comply with applicable law or address a material breach of this DPA.

This DPA applies for as long as the Collective Partner processes Personal Data obtained through the RVI Platform or RVI processes relevant Personal Data on behalf of the Collective Partner.

Termination of the Collective or other agreement between RVI and the Collective Partner does not remove obligations relating to Personal Data already received or processed where those obligations are intended or required to continue.

This DPA should be read together with the RVI Terms of Service, RVI Privacy Policy, RVI Collective Partner Terms, and any separate written agreement between RVI and the Collective Partner.

Where a separate written agreement contains specific data protection requirements applicable to a particular programme or partnership, those requirements will also apply.

This DPA is governed by the laws of the Republic of Singapore.

Questions concerning Personal Data or this DPA may be directed to:

Data Protection Officer River Valley Irregulars Pte. Ltd. dpo@rivervalleyirregulars.com