1. Scope and parties
This Data Processing Addendum (“DPA”) forms part of the agreement between Twelve Tech Pte Ltd (UEN 201508336Z) (“csv.design”) and the customer using csv.design for business purposes (“Customer”). It applies where csv.design processes personal information contained in Customer Data on the Customer’s behalf and applicable data-protection law requires processor or data-intermediary terms.
For that processing, the Customer is the controller or organisation and csv.design is the processor or data intermediary. Terms such as “process”, “personal data”, “controller”, and “processor” have the meanings given to them by applicable data-protection law.
2. Processing instructions
csv.design will process Customer Data only to provide, secure, support, and improve the contracted service, in accordance with the Customer’s documented instructions expressed through its use of the service and the parties’ agreement, or as required by law.
The Customer instructs csv.design to process Customer Data submitted for online previews, report design, saved templates, optional saved sample data, and related support. Saving sample data is an explicit Customer instruction; it is off by default and the Customer may replace or remove the saved rows. CSV files opened in a downloaded HTML report are processed locally by that report and are not Customer Data received by csv.design.
3. Customer responsibilities
The Customer is responsible for the lawfulness, accuracy, and quality of Customer Data and for providing required notices, obtaining required permissions, responding to individuals, and giving csv.design lawful instructions. The Customer must minimise the Customer Data submitted and must not submit information prohibited by the agreement.
4. Confidentiality and security
csv.design will ensure that people authorised to process Customer Data are subject to appropriate confidentiality obligations. csv.design will maintain reasonable technical and organisational safeguards appropriate to the nature of the Customer Data and the risks of processing.
5. Service providers
The Customer authorises csv.design to engage service providers to deliver the service. These may include providers of cloud hosting, account services, databases, AI processing, service communications, and support. Anthropic and OpenAI may process relevant instructions and report context for AI-assisted features.
csv.design will require a provider that processes Customer Data on its behalf to protect that data under written terms appropriate to the provider’s role. csv.design remains responsible for its obligations under this DPA, subject to the limitations in the parties’ agreement.
6. International transfers
The Customer authorises csv.design and its service providers to process Customer Data in Singapore and other countries where they operate. Where required by applicable law, csv.design will use a recognised transfer mechanism or other appropriate safeguards for an international transfer.
7. Individual requests and compliance assistance
Taking into account the nature of the processing, csv.design will provide reasonable assistance to help the Customer respond to valid requests from individuals and meet applicable obligations concerning security, breach notification, impact assessments, and regulator consultations. If csv.design receives a request relating to Customer Data, it may direct the requester to the Customer unless law requires a different response.
8. Security incidents
csv.design will notify the Customer without undue delay after becoming aware of a confirmed breach of Customer Data where notification is required by applicable law. The notice will include information reasonably available to csv.design that the Customer needs to understand and respond to the incident.
9. Return and deletion
At the end of the relevant service, csv.design will delete or return Customer Data on request where reasonably practicable, unless applicable law requires the information to be retained. Data retained by law will remain protected and will not be used for another purpose.
10. Information and review
On reasonable written request, csv.design will provide information needed to demonstrate compliance with this DPA. Any review must protect the confidentiality and security of csv.design and other customers, avoid access to unrelated systems or information, and not unreasonably disrupt operations.
Questions about this DPA may be sent to support@csv.design.
Processing details
Subject matter and purpose: providing online CSV profiling, preview, AI-assisted design, report generation, saved-template functionality, optional storage of user-selected preview rows, security, and support. Duration: for the period csv.design provides the relevant service and as otherwise required by law.
Types of personal information: identifiers, contact information, employment or business information, and any other personal information the Customer chooses to include in CSV rows, column names, sample values, instructions, or template content. People concerned may include the Customer’s users, employees, applicants, customers, suppliers, and other individuals represented in Customer Data.
Effective date: 10 August 2026
