Terms of Service.

1.1 These Terms of Service ("Terms") are between World Ready Pte Ltd, incorporated in Singapore (UEN 202406764D), registered office 200 Jalan Sultan, #11-01, Textile Centre, Singapore 199018 ("World Ready", "we", "us"), and the organisation that subscribes to our services ("Customer", "you").

1.2 You accept these Terms by whichever happens first: accepting them on screen when you first sign in; signing an Order Form that references them; or accessing or using the Services.

1.3 If you accept on behalf of an organisation, you warrant that you have authority to bind it. If you don't, you must not use the Services.

1.4 Order of precedence. Highest first: (a) a signed agreement or Order Form between us; (b) Schedule 1 (Data Processing Terms), on data-protection matters only, where it prevails over everything except a signed data processing agreement — but Schedule 1 does not displace clause 16, which governs liability under Schedule 1 as well; (c) these Terms; (d) any documentation or policy referenced in them. Existing customers with a signed agreement keep their agreed terms — these Terms fill gaps, they don't override the negotiated bargain.

3.1 Licence. For the Subscription Term, we grant you a non-exclusive, non-transferable, non-sublicensable right to access and use the Services for your internal business purposes, for the Tenants, modules and user counts specified in your Order Form.

3.2 Configuration. The platform is white-labelled and configurable. You control your branding, your workflows and processes, your role permissions and your data scope. What you configure is your decision and your responsibility — including who inside and outside your organisation can see what.

3.3 Changes to the Services. We improve the Services continuously and may change features. We will not materially reduce the core functionality you are paying for during a Subscription Term without at least 60 days' notice; if we do and it materially harms your use, you may terminate the affected part of your subscription and we will refund Fees pre-paid for the unused period.

3.4 What is not included. Roadmap items, betas and previews are not commitments. Where we give you access to a beta or preview feature, it is provided as is, may be withdrawn at any time, and clause 15 applies to it with no exceptions.

3.5 Professional Services. Where you engage us to perform Professional Services, we do so under a statement of work signed by both parties or — for services included in your plan, such as an included data migration — under your written request. Your statement of work or written request forms part of your documented instructions for the purposes of Schedule 1. You remain responsible for the accuracy and lawfulness of the data you give us to work with.

3.6 Support. We provide support as described in your Order Form or, where none applies, on the terms published on our website. Support is provided during Singapore business hours unless otherwise agreed.

4.1 You are responsible for your Tenant's configuration, for administering Authorised Users, for keeping credentials secure, and for all activity under your accounts.

4.2 You must ensure every Authorised User complies with these Terms. Their acts and omissions in the Services are treated as yours.

4.3 You must notify us without undue delay if you become aware of unauthorised access to your Tenant, credential compromise, or misuse of the Services.

4.4 Accounts are for named individuals. Sharing credentials between people defeats the audit history you rely on, so it is not permitted.

4.5 We may suspend an account or Tenant where there is a genuine and immediate security risk, a legal requirement, or a material breach of clause 5. We will tell you why as soon as we reasonably can, limit the suspension to what is necessary, and restore access as soon as the cause is resolved. A suspension does not consume the export window in clause 8.5.

4.6 You must keep your notice and billing contacts current. Notices under clauses 6.2, 18.2 and Schedule 1 §§6 and 9 go to those contacts.

6.1 Course Data is our intellectual property, licensed to you for the Subscription Term for use inside your Tenant. The restrictions in clauses 5(f) and 5(g) survive termination.

6.2 Coverage and accuracy. Course Data currently covers providers registered on CRICOS (Australia). Providers outside that scope may exist as records in your Tenant without a maintenance commitment from us; the Documentation states current coverage. Within scope, we maintain Course Data with reasonable care from provider sources. Institutions change courses, fees, intakes and entry requirements without notice and sometimes without publishing the change. Course Data is a maintained reference, not a warranty of current accuracy. Before you rely on it for a decision that matters — an offer, a fee quote, an eligibility judgement — verify it with the institution.

6.3 Your own provider data. Where you or a provider tenant maintain your own campus, course or fee data through the platform's data-collection workflow, that data is yours, you control it, and it is Customer Data — not Course Data.

6.4 Availability of a provider and its courses inside your Tenant's course search depends on your own configuration and on your institution-partner records reaching the required status. That gating is a feature you control, not a service level we owe.

7.1 You pay the Fees in your Order Form, or our published pricing where no signed Order Form applies, in the currency and on the cycle stated.

7.2 Invoices are due within 14 days unless the Order Form says otherwise. Overdue amounts may attract interest at 1.5% per month, and we may suspend the Services after giving you 10 Business Days' written notice and a chance to pay.

7.3 Payment methods. Fees are invoiced and payable under clause 7.2. We do not currently accept card or direct-debit payment, and we do not collect or store card or bank account numbers. If we introduce a card or direct-debit option, the payment processor handling it will be added to our Sub-processor list before it processes any payment, card and bank details will be handled by that processor rather than by us, and you will authorise the charge at the point you choose that method.

7.4 Taxes. Fees exclude taxes. World Ready is a Singapore company and is not currently registered for Singapore GST. You are responsible for any withholding, sales, use, VAT, GST or similar tax that applies in your jurisdiction, and for any reverse-charge obligation. Where we become required to register for and collect an indirect tax in your jurisdiction, we will add it to your invoices and tell you before we do.

7.5 Fees are non-refundable except where these Terms expressly provide otherwise.

7.6 We may change pricing for a renewal term with at least 60 days' notice before the renewal date.

7.7 Metered entitlements. Some Services include metered entitlements — for example a monthly allowance of AI actions — and some are sold as prepaid packs. For those: (a) your allowance, and what counts as one unit, are as described on our pricing page or in your Order Form; (b) monthly allowances do not carry over unless stated; (c) prepaid packs are valid for 12 months from purchase; (d) when an allowance is exhausted the metered feature stops until you top up or the next period begins — we will not silently bill you for overage, and any charge beyond your allowance requires a purchase you make; (e) we may change unit definitions or allowances for a renewal term under clause 7.6.

8.1 These Terms run for the Subscription Term and renew as stated in your Order Form.

8.2 Either party may terminate for material breach if the other has not cured it within 30 days of written notice. Either party may terminate immediately if the other becomes insolvent, enters liquidation or judicial management, or ceases business.

8.3 We may terminate or suspend immediately for a breach of clause 5(a), 5(c) or 5(i), or where continuing would put us in breach of the law.

8.4 Effect of termination. Your right to access the Services ends. You must pay all Fees accrued to the termination date.

8.5 Data export window. For 30 days after termination, we will keep your Customer Data available for export and give you reasonable assistance to export it in a structured, commonly-used, machine-readable format. This matters for your own compliance — Australian providers and agents have record-keeping obligations under the ESOS framework that outlive their subscription to us. Plan your export before you terminate, not after.

8.6 After the export window, we delete or de-identify Customer Data in accordance with Schedule 1 §11, except where law requires us to retain it.

8.7 Survival. Clauses 1.4, 2, 5(e), 5(f), 5(g), 6.1, 7 (as to amounts accrued), 8.4 to 8.6, 9, 10, 11, 12, 13, 15, 16, 17, 19 and 20, and Schedule 1 as provided in §13 of it, survive termination.

9.1 Ownership. You own all right, title and interest in Customer Data. Nothing in these Terms transfers any of it to us. We acquire no rights in it beyond the licence in clause 9.2.

9.2 Our licence. You grant us a non-exclusive licence to host, copy, transmit, display and process Customer Data to provide, secure, support, maintain, improve and develop the Services for you, to perform Professional Services you request, and to comply with the law. We may additionally derive aggregated, de-identified statistics as permitted by clause 9.4.

9.3 Data protection. Where Customer Data includes Personal Data, Schedule 1 (Data Processing Terms) applies and forms part of these Terms. In it: you are the controller (or Singapore's "organisation"); we are the processor (or "data intermediary"); and we process only on your documented instructions.

9.4 Artificial intelligence. Where you use AI features, Customer Data may be processed by the AI sub-processors named on our Sub-processor list, solely to produce output for you inside your Tenant.

• We do not use Customer Data to train, fine-tune, evaluate, benchmark or otherwise develop any machine-learning model, whether general-purpose or task-specific, other than to produce output for you inside your own Tenant in response to your own instruction. Our contracts with AI sub-processors prohibit them from doing so.
• We may use aggregated, de-identified statistics — which cannot reasonably be linked back to you, your Authorised Users or any individual — to operate, improve and develop the Services.
• AI output is generated text, not verified fact. It may be wrong. It is not advice. Clauses 13 and 15 apply to it in full. Where the Services display a numerical match, score or percentage, clause 13.2 governs how you may use it.

9.5 Feedback. If you suggest improvements, we may use those suggestions freely. We will not identify you as the source without your permission.

10.1 We and our licensors own the Services, the software, Course Data, the Documentation and all associated intellectual property. You get the licence in clause 3.1 and nothing more.

10.2 Our trade marks, including "World Ready", remain ours. White-label configuration lets you present your own brand to your users; it does not give you rights in ours, and it does not give us rights in yours beyond displaying your marks inside your Tenant as you have configured.

11.1 Each party will protect the other's Confidential Information with at least the care it applies to its own, use it only to perform these Terms, and disclose it only to personnel and advisers who need it and are under equivalent duties.

11.2 Confidential Information excludes information that is public through no breach, independently developed, or lawfully received from a third party without restriction.

11.3 Compelled disclosure is permitted, with prior notice where lawful and practicable, limited to what is required.

11.4 These obligations continue for 3 years after termination, and indefinitely for Personal Data and trade secrets.

12.1 World Ready provides software. We are not an education agent, a recruitment agency, an education provider, a migration agent, a registered immigration adviser, a legal practice, a financial adviser, a payment institution or an insurance intermediary, and we do not hold ourselves out as any of them.

12.2 The Services are a system of record and a workflow engine. Where the platform performs a check, applies a rule, flags an exception, calculates a figure, produces a score or surfaces a document requirement, it is executing the configuration you designed, against the data you supplied. It is not exercising judgement, and we are not exercising judgement on your behalf.

12.3 Accordingly, you — not we — are responsible for:

• (a) assessing whether an applicant meets an institution's entry criteria;
• (b) assessing financial capacity, funding sources, household income or evidence of funds;
• (c) deciding whether to submit an application, and lodging it;
• (d) any advice, representation or assistance given to a student, applicant or family member;
• (e) the accuracy, completeness, authenticity and lawfulness of the Customer Data you submit, and of every document you accept and pass on;
• (f) your own compliance with the ESOS Act 2000, the National Code 2018 (including Standard 4 written agreements, PRISMS records and agent monitoring), the Migration Act 1958, applicable data-protection law, and any equivalent regime in any other country you operate in;
• (g) the commercial and legal validity of the commission arrangements you configure and the payments you make;
• (h) the permissions, data scopes and visibility rules you configure, and their consequences;
• (i) any decision you make about an individual using output of the Services — including any automated or partly automated decision — and any transparency, review or notice obligation attaching to it under applicable law.

12.4 We do not review your data. Except where you engage us to perform Professional Services, we do not examine Customer Data for quality, accuracy or authenticity, and no output of the Services results from any human review or judgement by us. Where you do engage us, we act on your written instructions and Schedule 1 applies. A checklist showing "complete" means the configured fields are populated — not that anything in them is true.

13.1 No guarantee of admission or enrolment. We do not guarantee that any applicant will be admitted, receive an offer, be issued a Confirmation of Enrolment, or enrol. The education provider is the sole decision-maker on admission and enrolment.

13.2 No guarantee of visa or immigration outcome. The platform lets you record and track visa application stages. That is a tracking and record-keeping function. We have no role in, and no influence over, any government immigration decision. Where the platform records the status or outcome of such a decision, it is recording information you or your Authorised Users entered. We do not guarantee that any visa or permit will be granted, or granted within any timeframe.

Where the platform surfaces information relevant to a visa criterion — for example document-completeness checklists relating to the Genuine Student requirement, assessed by the Australian Department of Home Affairs under the applicable Ministerial Direction — that information indicates whether your configured fields and documents are present. It is not an assessment of the criterion and not a prediction of outcome. The Department assesses the criterion. We do not.

Scores and match percentages. Where the Services display a numerical match, score or percentage, it is a similarity or completeness measure computed from the data and criteria you configured. It is not an assessment of any admission or visa criterion, and it must not be presented to a student or applicant as a likelihood of any outcome.

13.3 No professional advice. Nothing in the Services, the Documentation, our support communications, or any AI-generated output is legal, immigration, migration, financial, tax, accounting or educational advice, and none of it is a substitute for a qualified professional. We may share information we think is useful to people running a recruitment business; that is not advice and we are not liable for your using it as though it were.

13.4 No immigration assistance. We do not provide immigration assistance, migration advice or legal advice to any visa applicant. You warrant that any immigration assistance or migration advice given to any applicant in connection with your use of the Services is given only by a person lawfully permitted to give it — in Australia, a registered migration agent or an Australian legal practitioner — and you will indemnify us against any claim, penalty or proceeding arising from a breach of this clause 13.4.

13.5 You must not misrepresent us. You must not tell any student, applicant, family member or third party that World Ready assesses eligibility, reviews applications, influences decisions, or guarantees, predicts or improves the likelihood of any admission, enrolment or visa outcome. Our own marketing statements are not representations you may pass on as assessments; if any of our published marketing material conflicts with clause 12 or this clause 13, clauses 12 and 13 govern.

13.6 Commission — timing and lawfulness. The platform calculates and tracks commission according to the rules you configure.

(a) Timing. A commission is not earned when an offer issues, when a Confirmation of Enrolment is generated, or when a student arrives. Whether and when commission becomes payable, and whether a downstream payout is triggered, depends on your own agreements with institutions and agents — typically on the student passing a census or equivalent date and holding an active, non-refunded enrolment. We are not liable for delayed or reduced payouts caused by institutional invoicing delays, enrolment withdrawals, refunds, census-date outcomes or disputes between you and your partners.

(b) Lawfulness. We do not warrant that any commission the platform calculates or records is lawfully payable. Commission entitlements are regulated and the rules change — for example, Australia's National Code 2018 prohibits the payment of education agent commissions in relation to onshore transfers, subject to grandfathering and to carve-outs for study after a principal course and for progression through a packaged course. You are responsible for determining whether a commission may lawfully be paid before you pay it. A calculation in the platform is arithmetic, not legal clearance.

13.7 No handling of student or institutional funds. We do not hold, receive, transmit or direct student funds, tuition deposits, insurance premiums or commission payments. Where the platform records a payment or an invoice, or integrates with an accounting system, it is recording a transaction that you, the institution or the payer effects through your own banking and payment arrangements. We are not a party to those arrangements and are not liable for them. The only money we collect is your own subscription Fees under clause 7.

14.1 We aim to make the Services available continuously, apart from planned maintenance, for which we give advance notice where practicable.

14.2 We publish no uptime percentage or service-level figure in these Terms. Committed service levels, where you need them, are agreed in a signed Order Form. We would rather commit to nothing than to a number we cannot yet evidence — see /no-claims/.

14.3 We do not warrant that the Services will be uninterrupted, timely, secure or error-free, or that defects will be corrected.

14.4 Data loss. Our backup position is described in our Security Overview. You remain responsible for exporting and retaining your own copies of Customer Data you need for your records or your compliance. If Customer Data is lost or corrupted while we hold it, our liability is limited to taking reasonable steps to restore it from our available backups.

15.1 We warrant that: we have the right to grant the licences in these Terms; we will provide the Services with reasonable skill and care and in accordance with the Documentation as at the start of the then-current Subscription Term, in all material respects; and we will not knowingly introduce malicious code into the Services.

15.2 If we breach clause 15.1, your remedy is for us to re-perform or correct the affected Services within a reasonable time. If we cannot, you may terminate the affected part of your subscription and receive a pro-rata refund of pre-paid Fees for the unused period. That is your exclusive remedy for breach of clause 15.1.

15.3 Everything else is excluded. TO THE MAXIMUM EXTENT PERMITTED BY LAW, AND EXCEPT AS EXPRESSLY SET OUT IN CLAUSE 15.1, THE SERVICES AND THE COURSE DATA ARE PROVIDED "AS IS" AND "AS AVAILABLE". WE DISCLAIM ALL OTHER WARRANTIES, REPRESENTATIONS AND CONDITIONS, EXPRESS OR IMPLIED, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, OR THAT THE SERVICES WILL MEET YOUR REQUIREMENTS.

15.4 In particular, and without limiting clauses 12 and 13, we make no warranty that: use of the Services will result in any admission, enrolment, visa grant or commission payment; use of the Services will make you compliant with any law or code, including the ESOS Act 2000, the National Code 2018, the Migration Act 1958 or any data-protection law; Course Data is current, complete or accurate at any given moment; or that any output of the Services, including AI-generated output, is accurate, complete or fit for a particular decision.

15.5 Third-party products and integrations are provided by their own providers on their own terms. We are not responsible for them and give no warranty about them.

15.6 Non-excludable rights. Nothing in these Terms excludes, restricts or modifies any guarantee, condition, warranty, right or remedy that applicable law says cannot be excluded, restricted or modified. Where a law implies such a term, our liability for breach of it is limited, to the extent the law permits, to re-supplying the Services or paying the cost of having them re-supplied.

16.1 Excluded losses. To the maximum extent permitted by law, neither party is liable for loss of revenue, loss of profit, loss of anticipated savings, loss of goodwill or reputation, loss of business or business opportunity, loss of or corruption of data (except as provided in clause 14.4), loss of commission or expected commission, regulatory fines or penalties imposed on the other party, or any indirect or consequential loss — however caused, and even if the party was advised of the possibility. This clause 16.1 does not limit or exclude either party's obligations under clauses 13.4, 16.5 or 16.6.

16.2 Cap. Subject to clauses 16.3 and 16.4, each party's total aggregate liability arising out of or in connection with these Terms and Schedule 1, whether in contract, tort (including negligence), statute or otherwise, is limited to the total Fees paid by you to us in the 12 months immediately preceding the first event giving rise to the liability. Where the liability arises in the first 12 months, the cap is the total Fees paid to the date of that event.

16.3 Uncapped matters. The cap in clause 16.2 does not apply to: your obligation to pay Fees; either party's liability for death or personal injury caused by its negligence; fraud or fraudulent misrepresentation; wilful misconduct; a party's breach of clause 11 (Confidentiality) other than a breach arising from a Personal Data Breach or from unauthorised access to or disclosure of Customer Data, which is subject to the cap in clause 16.2 as provided in clause 16.4; your indemnities under clauses 13.4 and 16.5; or any liability that applicable law does not permit to be limited.

16.4 Personal Data Breach and unauthorised disclosure of Customer Data. Our total aggregate liability for all Personal Data Breaches and all unauthorised access to or disclosure of Customer Data — across all incidents, all claims and all customers — is subject to the cap in clause 16.2, and clause 16.1 continues to apply. Where your Order Form states a higher or separate limit for such liability, that limit applies instead.

16.5 Your indemnity. You will indemnify us against all claims, losses, liabilities, penalties and reasonable costs arising from: (a) Customer Data you had no right to submit, or that you collected without the required notices, consents or lawful basis; (b) your breach of clause 5, 12.3, 13.4 or 13.5; (c) any claim by a student, applicant, agent, institution or regulator arising from your recruitment, advisory, application, enrolment, commission or configuration activities; and (d) any claim that we performed a role described in clause 12.1 as a result of a representation you made.

16.6 Our indemnity. We will defend you against any third-party claim that your permitted use of the Services infringes that third party's intellectual property rights, and will pay damages finally awarded or agreed in settlement. This does not apply to claims arising from Customer Data, from your configuration, from use in breach of these Terms, or from combination with anything we did not supply. Our options are to modify the Services, obtain a licence, or terminate the affected subscription with a pro-rata refund.

16.7 Each party must take reasonable steps to mitigate its loss.

16.8 Third parties. These Terms create rights and obligations only between you and us. No student, applicant, institution, agent or other third party acquires any right under them.

17.1 Personal data we handle about you — as a visitor, an enquirer or a named user, including Service Data — is covered by our Privacy Policy.

17.2 Personal data you enter about other people — students, applicants, agents, institution contacts — is covered by Schedule 1 (Data Processing Terms), which forms part of these Terms and applies automatically. No separate signature is required, though we will sign a copy on request.

17.3 Where you require GDPR, UK GDPR or other regional terms, the relevant provisions of Schedule 1 apply automatically from the moment the corresponding law applies to the processing.

18.1 We may update these Terms. Every version carries a date, and previous versions are available on request from legal@worldready.ai.

18.2 For changes that materially and adversely affect you, we will give at least 60 days' notice by email to your notice contacts and by notice on the website. The change takes effect at the end of the notice period. If you don't accept it, you may terminate before it takes effect and we will refund Fees pre-paid for the unused period.

18.3 Changes required by law, and changes that do not materially and adversely affect your rights, take effect on posting.

19.1 Governing law and jurisdiction. These Terms are governed by the laws of Singapore. Each party submits to the non-exclusive jurisdiction of the courts of Singapore, and nothing prevents you from bringing proceedings in the courts of your own jurisdiction where the law gives you that right. Clauses 15.6 and 20 apply to any non-excludable rights you have under the law of your own country.

19.2 Disputes. Before starting proceedings, the parties will escalate the dispute to a senior representative of each and attempt to resolve it in good faith within 30 days. Nothing prevents either party from seeking urgent injunctive relief.

19.3 Force majeure. Neither party is liable for failure to perform (other than to pay) due to events beyond its reasonable control, provided it notifies the other and mitigates.

19.4 Assignment. Neither party may assign these Terms without the other's consent, except to an affiliate or in connection with a merger or sale of substantially all of its business, with notice.

19.5 Notices. To us: legal@worldready.ai, with a copy to our registered address. To you: the email addresses of your notice contacts.

19.6 Subcontracting. We may use subcontractors and sub-processors and remain responsible for their performance. Sub-processors handling Personal Data are governed by Schedule 1 §6.

19.7 Publicity. Neither party will use the other's name, logo or the fact of this relationship in marketing without prior written consent. Consent may be given for a specific use and withdrawn for future uses.

19.8 Anti-bribery and sanctions. Each party will comply with applicable anti-bribery, anti-corruption, anti-money-laundering and sanctions laws. You warrant that neither you nor, to your knowledge, any agent you engage through the platform is a sanctioned person, and that you will not use the Services to make or receive an improper payment.

19.9 Severability. If a provision is unenforceable, it is modified to the minimum extent necessary or severed, and the rest stands.

19.10 Waiver. A failure to enforce is not a waiver.

19.11 Entire agreement. These Terms, Schedule 1, the Privacy Policy and any Order Form are the entire agreement, and supersede prior discussions. Neither party relies on any statement not set out in them, except that nothing excludes liability for fraudulent misrepresentation.

19.12 No partnership. Nothing creates a partnership, joint venture, agency or employment relationship.

20.1 If the Australian Consumer Law applies to your acquisition of the Services, nothing in these Terms excludes, restricts or modifies any consumer guarantee, right or remedy it confers. Where the Australian Consumer Law permits us to limit our liability for breach of a consumer guarantee, our liability is limited to re-supplying the Services or paying the cost of having them re-supplied.

20.2 For Australian customers, clause 19.1 does not prevent you from bringing proceedings in an Australian court where Australian law gives you that right.

20.3 Where these Terms are a small business contract within the meaning of the Australian Consumer Law, any term that would otherwise be unfair within the meaning of that law is to be read down or severed to the minimum extent necessary, and we will not rely on it.

2.1 You appoint us to process Personal Data on your behalf and in accordance with your documented instructions.

2.2 Accordingly, you are the Controller of the Personal Data that is the subject of the Terms and this DPT, and we are the Processor — except where you are yourself a Processor on behalf of a third-party Controller (for example where you process on behalf of an institution partner), in which case you are the Processor and we are your Sub-processor. Under Singapore law, you are the organisation and we are your data intermediary.

2.3 Your processing instructions are set out in the Terms, this DPT, your configuration of the Services, and any statement of work or written request for Professional Services under clause 3.5 of the Terms. If you want to change your instructions, agree the change with us in writing. We may charge for changes requiring material additional work, and we will tell you before we do.

2.4 Where required by Applicable Data Protection Law, and otherwise promptly, we will inform you if in our opinion an instruction infringes Applicable Data Protection Law. We may suspend the affected processing until it is resolved. This does not create a general duty to review your instructions or your data for legality — see clause 12.4 of the Terms.

2.5 We will not process Customer Data for any purpose other than the Permitted Purpose. We will not sell it, share it for anyone's marketing, or use it to train, fine-tune, evaluate or benchmark any machine-learning model. We may derive aggregated, de-identified statistics as permitted by clause 9.4 of the Terms.

3.1 You are solely responsible for the accuracy, quality, integrity and lawfulness of Customer Data and for the means by which you obtained it.

3.2 You must ensure that you (or, where you are a Processor, the relevant third-party Controller) have: a lawful basis for the processing; provided all notices Applicable Data Protection Law requires — including notice that Personal Data will be disclosed to a service provider outside the Data Subject's country, and, because the platform is white-labelled and a Data Subject will otherwise never learn of us, notice identifying World Ready Pte Ltd or a description sufficient to identify us — and obtained any consent required, including explicit consent or another applicable condition where the data includes special categories or sensitive information.

3.3 You acknowledge that under APP 8 and s 16C of the Privacy Act 1988 (Cth) you remain accountable for acts and practices of overseas recipients, and that this DPT is intended to constitute reasonable steps for the purposes of APP 8.1. Under s 26 of the PDPA you remain responsible for ensuring comparable protection on transfer out of Singapore, and this DPT is intended to constitute legally enforceable obligations for that purpose.

3.4 You are responsible for your Tenant's configuration, including its role permissions, data scope, visibility rules and retention settings, and for the consequences of the permissions you grant.

4.1 We limit access to Customer Data to personnel who need it to deliver the Services.

4.2 All such personnel are bound by written confidentiality obligations that survive the end of their engagement, and we carry out identity and reference verification before granting access. Our current position on security training and third-party background screening is stated in the Security Overview.

4.3 Access to Customer Data is role-based. Access is reviewed at least annually and revoked promptly on role change or departure.

5.1 We implement and maintain the Security Measures, appropriate to the risk — and we recognise that the risk here is elevated, because Customer Data routinely includes identity documents, financial evidence, nationality and health-insurance information.

5.2 We will not materially reduce the overall security of the Services during a Subscription Term.

5.3 We hold no SOC 2 or ISO 27001 certification at the date of these Terms, and we do not represent otherwise. The Security Overview states what we do have, and what we do not.

6.1 You give us general written authorisation to engage Sub-processors for the Permitted Purpose. Those engaged at the effective date are on the Sub-processor list, with each one's purpose and country.

6.2 Before a new Sub-processor starts processing Customer Data, we will give you at least 30 days' notice by updating the Sub-processor list and notifying the addresses subscribed to sub-processor notifications. Subscribe at privacy@worldready.ai.

6.3 You may object on reasonable data-protection grounds within 30 days of that notice. Until an objection is resolved, we will not engage that Sub-processor to process your Customer Data. If we cannot resolve it, you may terminate the affected Services with immediate effect and receive a pro-rata refund of pre-paid Fees for the unused period. If you don't object within 30 days, the change is deemed accepted.

6.4 We impose on each Sub-processor obligations no less protective than those in this DPT, by written contract, and we remain liable to you for each Sub-processor's performance as if it were our own — subject to clause 16 of the Terms.

7.1 The Services give you the tools to access, correct, export and delete Customer Data yourself. In the first instance you should use them — it is faster than asking us.

7.2 Where you cannot, we will provide reasonable assistance, at your cost where the request requires material effort, to help you respond within your legal deadline.

7.3 If a Data Subject contacts us directly about Customer Data, we will not respond substantively. We will tell them to contact the relevant Controller and, where we can identify you as that Controller, notify you without undue delay.

9.1 On confirming that a Personal Data Breach affecting Customer Data has occurred, we will notify you without undue delay and in any event within 48 hours. "Confirming" means the point at which the owner of our incident response process determines that a Personal Data Breach has occurred. Where we suspect but have not confirmed a breach affecting your Customer Data, we will tell you without undue delay in any event.

9.2 Our notice will include, so far as known: the nature of the breach, the categories and approximate number of Data Subjects and records affected, likely consequences, the measures taken or proposed, and a contact point. Where we cannot provide everything at once, we will provide it in phases without undue delay.

9.3 We will take reasonable steps to contain and remediate, preserve evidence, and co-operate with your investigation.

9.4 You decide whether and how to notify regulators and Data Subjects in respect of Customer Data. We will not do so on your behalf without your written instruction, except where we are legally required to notify a regulator in our own right — in which case we will tell you first, unless prohibited.

9.5 Where the same records are held by more than one entity and Applicable Data Protection Law permits a single notification to discharge all of them, the parties will co-operate to agree who notifies.

9.6 Our notification is not an admission of fault or liability.

10.1 We are established in Singapore. Our personnel access Customer Data from Australia and Singapore. Hosting regions and every Sub-processor's country are on the Sub-processor list. Where your subscription is a dedicated or customer-hosted deployment, the processing locations are those stated in your Order Form and this paragraph does not describe your deployment.

10.2 For transfers from the EEA, the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 are incorporated into this DPT and apply — Module Two where you are a Controller and Module Three where you are a Processor — with Annex A to this DPT completing Annexes I and II of those Clauses and the Sub-processor list completing Annex III, and with the docking clause and the Clause 11(a) optional redress language excluded.

10.3 For transfers from the United Kingdom, the International Data Transfer Addendum issued by the Information Commissioner is incorporated and applies to the Clauses in 10.2, with Annex A and the Sub-processor list completing its Tables.

10.4 We maintain a transfer risk assessment and will make its conclusions available on request.

10.5 For transfers out of Singapore, this DPT is intended to constitute legally enforceable obligations providing a standard of protection comparable to the PDPA.

10.6 For Australia, this DPT is intended to support your APP 8.1 reasonable steps. It does not, and cannot, transfer your s 16C accountability to us.

10.7 Government and law-enforcement requests. If we receive a legally binding request from a public authority for Customer Data, we will: notify you unless legally prohibited, and where prohibited use reasonable efforts to obtain a waiver; review the request for lawfulness and challenge it where we consider it overbroad or unlawful; disclose only the minimum the request requires; and keep a record of requests received and our response.

11.1 During the Subscription Term you may access, export and delete Customer Data through the Services.

11.2 On termination, clause 8.5 of the Terms gives you a 30-day export window, which a suspension does not consume.

11.3 After that window we will delete Customer Data within 90 days, except: (a) where you have instructed us in writing to retain it; (b) where law requires us to retain it, in which case we retain it only as long as required and continue to protect it under this DPT; and (c) backup copies, which are deleted on our normal backup expiry cycle and are not restored into production.

11.4 On written request we will certify deletion.

11.5 Your compliance retention is your responsibility. Australian providers and agents have record-keeping obligations under the ESOS framework and the National Code that can outlast a subscription. Export what you need to keep before you terminate.

12.1 On reasonable written request, no more than once every 12 months, we will provide the information reasonably necessary to demonstrate compliance with this DPT — including our Security Overview, our then-current completed security questionnaire, and any third-party audit report or certification we hold.

12.2 Where that is not sufficient to satisfy a supervisory authority or an obligation binding on you, you may conduct an audit — on 30 days' notice, no more than once every 12 months (and additionally after a Personal Data Breach affecting your Customer Data), scoped to the processing of your Customer Data, during business hours, without unreasonable disruption, subject to confidentiality, at your cost and ours reasonably incurred, and not by an auditor who is our competitor.

14.1 Clause 16 of the Terms governs each party's liability under this DPT. Clause 1.4(b) of the Terms does not displace clause 16.

14.2 On data-protection matters, this DPT prevails over the rest of the Terms, subject to §14.1.