Terms of Service

These Terms of Service (the "Terms") govern use of the iService365 platform (the "Platform") supplied by Seven 365 Pte Ltd (UEN 201539272D), a company incorporated in Singapore with its registered office at 164 Bukit Merah Central, #03-3627, Singapore 150164 ("Seven 365", "we", "us").

These Terms form a binding agreement between Seven 365 and the organisation that subscribes to the Platform (the "Customer", "you"). By subscribing to, accessing or using the Platform, the Customer accepts these Terms.

The Platform is supplied to organisations and not to consumers. Residents, visitors, security officers and other individuals access the Platform through a Customer's subscription, and their access is governed by these Terms as accepted by that Customer, together with our Privacy Policy.

• —"Authorised User" means an individual the Customer permits to access the Platform, including its employees, its managing agents, security officers deployed at a Site, service-provider personnel, and residents or occupiers of a Site.
• —"Customer Data" means all data the Customer or its Authorised Users submit to, or generate through, the Platform, including Personal Data relating to residents, visitors and personnel.
• —"Personal Data" has the meaning given in the Personal Data Protection Act 2012 of Singapore (the "PDPA").
• —"Site" means a building, development, estate or other property the Customer manages through the Platform.
• —"Subscription Term" means the period for which the Customer has subscribed, as set out in the applicable order or quotation.

The Platform is a property and facility management system provided as a hosted service. Depending on the modules subscribed for, it may include visitor management and visitor passes, resident and unit records, work orders and service requests, facility bookings, incident reporting, patrol and guard tour management, billing and statement of account records, document management, notice and bulletin distribution, vehicle management including automatic number plate recognition ("ANPR"), and access to video from cameras installed at a Site.

We may add, modify or withdraw features from time to time. Where a change would materially reduce functionality the Customer relies on, we will give the Customer at least thirty days' prior notice.

Access to the Platform is controlled through named accounts and assigned roles. The Customer determines which of its Authorised Users receive which roles and permissions, and is responsible for keeping those assignments current and for removing access promptly when an individual ceases to be entitled to it.

The Customer must ensure account credentials are kept confidential and are not shared between individuals, and must notify us without undue delay on becoming aware of any unauthorised access to or use of its account.

Seven 365 personnel may access a Customer's environment where necessary to provide, support, secure or maintain the Platform, or where required by law. Such access is limited to personnel who require it for those purposes and is subject to clause 11.

As between the parties, and for the purposes of the PDPA:

• —The Customer is the organisation that determines the purposes for which Personal Data about residents, visitors, occupiers and personnel at its Sites is collected, used and disclosed through the Platform. The Customer is responsible for having a proper basis for that collection, use and disclosure, for giving the notifications the PDPA requires, and for responding to access and correction requests from those individuals.
• —Seven 365 processes that Personal Data on the Customer's behalf in order to provide the Platform, and acts as a data intermediary in respect of it. Seven 365 is separately responsible, as an organisation in its own right, for Personal Data it holds about the Customer's contract, billing and administrative contacts.

Seven 365 will process Customer Data only to provide, support, secure and maintain the Platform, to comply with law, and as otherwise instructed by the Customer. Seven 365 does not sell Customer Data and does not use Personal Data held on behalf of one Customer for the benefit of another.

The Customer must ensure that:

• —it is entitled to collect, and to provide to the Platform, all Customer Data it submits, including Personal Data about residents, visitors and personnel;
• —appropriate notice is given, and any necessary consent obtained, from individuals whose Personal Data is collected through the Platform, including visitors registering at a guardhouse, residents whose vehicles are recorded by ANPR, and individuals recorded by cameras at a Site;
• —notices and signage required in respect of video surveillance and ANPR are displayed at the Site;
• —identity-document information, including NRIC or FIN numbers, is collected only where the Customer has assessed that collection to be necessary for its purposes and is able to justify it, having considered whether a partial identity number verified against the physical document would suffice;
• —the Platform is not used to monitor individuals for purposes unrelated to the security and management of the Site; and
• —its Authorised Users comply with these Terms.

The Customer and its Authorised Users must not use the Platform in breach of any law; upload material that is unlawful or infringing; attempt to gain unauthorised access to the Platform, to another customer's environment, or to any connected system or network; probe, scan or test the vulnerability of the Platform without our prior written consent; interfere with or disrupt the Platform; or resell or make the Platform available to a third party except as expressly permitted in these Terms.

Where the Customer connects cameras or access-control hardware to the Platform, the Customer is responsible for the lawful installation and operation of that equipment at the Site, for the notices and signage required in respect of it, and for the accuracy and security of the connection details it provides.

Video from cameras at a Site is streamed through the Platform to authorised users and is not stored by Seven 365. Where ANPR is enabled and vehicle snapshots are switched on, a still image captured at the point of plate recognition is stored in the Platform together with the recognised plate number and the time of entry or exit. Retention of that material is dealt with in our Privacy Policy.

The fees for the Platform, the billing cycle and the payment terms are those set out in the order, quotation or service agreement applicable to the Customer. Where those documents conflict with this clause, they prevail.

Fees are stated in Singapore dollars and are exclusive of goods and services tax, which will be added where applicable.

Payments made through the Platform are processed by a third-party payment gateway provider. Seven 365 does not itself process or hold payment card details. The Customer's use of that payment gateway is subject to the gateway provider's own terms, and the Customer is responsible for the accuracy of the payment information it provides.

We may suspend access to the Platform where an undisputed invoice remains unpaid after its due date, having first given the Customer written notice and a reasonable opportunity to pay.

The Platform, and all intellectual property rights in it, remain the property of Seven 365 and its licensors. Subject to these Terms and to payment of the applicable fees, Seven 365 grants the Customer a non-exclusive, non-transferable right to access and use the Platform during the Subscription Term for the internal management of its Sites.

Customer Data remains the property of the Customer. The Customer grants Seven 365 the rights in Customer Data necessary to provide the Platform under these Terms.

Each party will keep the other's confidential information confidential, use it only for the purposes of this agreement, and protect it with at least the degree of care it applies to its own confidential information of like importance. This clause does not apply to information that is or becomes public other than through breach of this clause, that is independently developed without reference to the other party's information, or that is required to be disclosed by law or by a regulator, provided that the disclosing party gives notice where it is lawful to do so.

Seven 365 maintains the following measures in respect of the Platform: access is controlled through named user accounts and assigned roles; a Site's data is accessible only to individuals associated with that Site; data in transit between users and the Platform is encrypted; and access by Seven 365 personnel is limited to those who require it to provide, support, secure or maintain the Platform.

Seven 365 will keep its security measures under review and may update them from time to time, provided that it will not materially reduce the overall level of protection during a Subscription Term.

The Customer is responsible for the security of its own accounts, devices and networks, for the roles and permissions it assigns, and for the security of equipment it connects to the Platform.

Seven 365 will notify the Customer without undue delay after becoming aware of a breach affecting Personal Data processed on the Customer's behalf, and will provide the information reasonably necessary for the Customer to assess the breach and to meet its own obligations under the PDPA, including any obligation to notify the Personal Data Protection Commission and affected individuals.

The parties acknowledge that where a breach is assessed to be notifiable, the Commission must be notified within three calendar days of that determination, and will cooperate so that this period can be met.

Seven 365 warrants that it will provide the Platform with reasonable skill and care. Except as expressly stated in these Terms, and to the extent permitted by law, all other warranties, conditions and terms, whether express or implied, are excluded. Seven 365 does not warrant that the Platform will be uninterrupted or free from error.

The Customer acknowledges that the Platform is a management tool and is not a life-safety system, an emergency-response service, or an alarm-monitoring service. Features that assist in contacting emergency contacts, in recording incidents, or in displaying video depend on the Customer's own procedures, on the accuracy of the data the Customer maintains, and on networks, devices and third-party equipment outside our control. The Customer must not rely on the Platform as its sole means of raising, detecting or responding to an emergency, and must maintain its own independent emergency procedures.

Nothing in these Terms limits or excludes either party's liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be limited or excluded.

Subject to the paragraph above, neither party is liable for loss of profit, loss of revenue, loss of anticipated savings, loss of business or goodwill, or for any indirect or consequential loss, in each case however arising.

Subject to the two paragraphs above, the total aggregate liability of each party under or in connection with these Terms, whether in contract, tort (including negligence) or otherwise, is limited to the total fees paid by the Customer under these Terms in the twelve months immediately preceding the event giving rise to the claim.

The limit in the preceding paragraph does not apply to the Customer's obligation to pay fees properly due, or to either party's breach of clause 11.

These Terms apply from the start of the Subscription Term and continue for its duration, renewing for successive periods of the same length unless either party gives written notice of non-renewal at least thirty days before the end of the then-current term.

Either party may terminate these Terms with immediate effect by written notice if the other commits a material breach that is not remedied within thirty days of written notice requiring it to be remedied, or becomes insolvent or subject to winding-up proceedings.

On termination or expiry, the Customer's access to the Platform ends. The Customer may request an export of its Customer Data at any time before termination and for thirty days afterwards. After that period, and subject to any retention required by law, Seven 365 will cease to retain Customer Data in accordance with its Privacy Policy.

Neither party may assign or transfer these Terms without the other's prior written consent, except to an affiliate or in connection with a merger, reorganisation or sale of substantially all of its assets.

If any provision of these Terms is held to be invalid or unenforceable, the remaining provisions continue in full force and effect. A failure or delay in exercising a right under these Terms is not a waiver of it.

These Terms, together with our Privacy Policy and the applicable order or quotation, constitute the entire agreement between the parties in respect of the Platform and supersede all prior discussions and representations.

We may update these Terms from time to time. Where an update is material, we will give the Customer reasonable notice before it takes effect. Continued use of the Platform after the effective date constitutes acceptance.

These Terms are governed by the laws of Singapore. The parties submit to the exclusive jurisdiction of the courts of Singapore.

Questions about these Terms may be sent to contact@seven365.com.sg, or by post to Seven 365 Pte Ltd, 164 Bukit Merah Central, #03-3627, Singapore 150164.

Seven 365 Pte Ltd (UEN 201539272D) ("Seven 365", "we", "us") provides iService365, a property and facility management platform used by managing agents, management corporations, security agencies and service providers in Singapore. This policy explains how we handle personal data, and applies to the iService365 platform and its associated mobile applications.

We handle personal data in two distinct capacities, and the difference determines who you should approach.

• —As a data intermediary, when we process personal data about residents, occupiers, visitors and site personnel on behalf of the organisation that manages a site. That organisation decides what is collected and why. If you are a resident or a visitor, that organisation is the one to approach about your personal data in the first instance, and we support them in responding to you.
• —As an organisation in our own right, when we handle personal data about our customers' contract, billing and administrative contacts.

We handle personal data in accordance with the Personal Data Protection Act 2012 of Singapore (the "PDPA").

Our Data Protection Officer may be contacted about this policy, about your personal data, or to make an access, correction or withdrawal-of-consent request:

• —The Data Protection Officer, Seven 365 Pte Ltd
• —Email: contact@seven365.com.sg
• —Post: 164 Bukit Merah Central, #03-3627, Singapore 150164

What is collected at any site depends on the modules the managing organisation has enabled. Not every category below applies to every site.

Where a managing organisation collects an NRIC, FIN or other identity-document number through the platform, that organisation is responsible for that collection and for being able to justify it. The Personal Data Protection Commission's guidance for management corporations is that a full identity-document number should be collected only where the organisation can justify that level of detail, and that recording a partial number verified against the physical document is generally preferable.

Managing organisations should review what their site collects against that guidance. Where a field is not required for a site's purposes, it should not be completed.

• —To provide the platform to the managing organisation and its authorised users.
• —To manage entry to and exit from a site, including visitor passes, vehicle access and access cards.
• —To record and follow up work orders, service requests, feedback and incidents.
• —To manage facility bookings, billing records and statements of account.
• —To send notifications about matters at the site and about activity in a user's own account.
• —To secure the platform, investigate misuse, and meet our legal obligations.

We do not sell personal data, and we do not use personal data held on behalf of one customer for the benefit of another.

Where the platform is used to collect personal data at a site, the managing organisation is responsible for notifying individuals of the purposes for which their personal data is collected, used and disclosed, and for obtaining consent where the PDPA requires it. This includes notices at guardhouses and entrances, signage for camera and ANPR coverage, and the information given to residents when their records are created.

An individual may withdraw consent by contacting the managing organisation. Withdrawal may mean that certain services, such as vehicle access or the issue of a visitor pass, can no longer be provided.

We use a small number of service providers to operate the platform. Each receives only the data it needs for its function.

We also disclose personal data where required by law, where necessary to protect the safety of individuals at a site, or in connection with a corporate transaction, in which case the recipient is bound to protect it on terms no less protective than this policy.

A managing organisation may ask us for the identity of the providers relevant to its site by contacting our Data Protection Officer.

Some of the service providers described above store or process personal data outside Singapore. Where personal data is transferred out of Singapore, we take steps to satisfy ourselves that the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to that under the PDPA, whether by contract, by binding corporate rules, or because the recipient is subject to comparable law.

A managing organisation may ask us for details of the transfers relevant to its site by contacting our Data Protection Officer.

We keep personal data for as long as it is needed for the purposes set out in this policy, or for as long as we are required to keep it by law, and then cease to retain it.

How long that is depends on the category of data and on the arrangements agreed with the managing organisation for its site. Records that support an ongoing relationship, such as a resident's record, are kept for as long as that relationship continues. Records of a single event, such as a visitor's entry or a vehicle image captured by ANPR, are kept only for as long as they are needed for the security and management of the site.

Where personal data must be kept for longer to meet a legal or regulatory obligation, or in connection with an actual or anticipated dispute, we keep it for that purpose only and cease to retain it once that purpose ends.

A managing organisation may ask us about the retention arrangements applying to its site, or agree a specific retention period with us, by contacting our Data Protection Officer.

We restrict access to personal data to those who need it. Access to the platform is controlled through named user accounts and assigned roles; a site's data is accessible only to individuals associated with that site; data in transit between users and the platform is encrypted; and access by our own personnel is limited to those who require it to provide, support, secure or maintain the platform.

We review our security measures and improve them over time. No system can be guaranteed to be completely secure. Managing organisations are responsible for the security of their own accounts, devices, networks and connected equipment, and for the roles and permissions they assign.

Under the PDPA you may ask for access to the personal data we hold about you, and for information about the ways in which it has been used or disclosed in the year before the request. You may also ask us to correct personal data that is inaccurate or incomplete.

We respond to access requests as soon as reasonably possible and in any event within thirty days; where we cannot respond within thirty days, we will tell you when we will respond. Correction requests are free of charge. A reasonable fee may apply to an access request, and we will tell you the amount before proceeding.

If your personal data was provided to us by a managing organisation, please make your request to that organisation, which will respond with our support.

Where a request concerns material that also contains other people's personal data, such as camera footage or a visitor log, we may need to redact or withhold parts of it so that we do not disclose their personal data to you.

Where a data breach occurs that is likely to result in significant harm to affected individuals, or that is of a significant scale, we will notify the Personal Data Protection Commission within three calendar days of determining that the breach is notifiable, and will notify affected individuals as soon as practicable where the breach is likely to result in significant harm to them. Where the breach concerns personal data we process on behalf of a managing organisation, we will notify that organisation without undue delay so that it can meet its own obligations.

Residents' households may include children, and children may appear in visitor records, incident reports and camera footage. Where personal data relating to a child is collected through the platform, the managing organisation is responsible for obtaining consent from a parent or guardian where the child is not old enough to give it. A parent or guardian may exercise access and correction rights on a child's behalf by contacting the managing organisation or our Data Protection Officer.

We may update this policy from time to time. Where a change is material, we will give notice through the platform or by email before it takes effect. The effective date shown on this policy indicates when it was last revised.

Please contact our Data Protection Officer at contact@seven365.com.sg, or by post to Seven 365 Pte Ltd, 164 Bukit Merah Central, #03-3627, Singapore 150164.

We aim to acknowledge a complaint within five business days and to respond substantively within thirty days. If you are not satisfied with our response, you may make a complaint to the Personal Data Protection Commission of Singapore.