Data Processing Terms

1. Scope and roles

These terms supplement the Exentra Terms of Service. The operator is the controller of customer data it collects through its hotspot business. Excellent Digisun Limited processes that data on the operator’s documented instructions to provide Exentra, except where Exentra must process information independently for security, billing or legal compliance.

2. Processing instructions

Processing may include collecting, storing, organising, retrieving, transmitting, restricting and deleting customer identity/contact details, package purchases, voucher/session/device information, payment references and support records. The purpose is hotspot access, billing, customer support, security, reconciliation and service operation.

3. Operator commitments

• Have a lawful basis and provide required notices to customers.
• Configure Exentra to collect only necessary information.
• Respond to customer rights requests and give Exentra clear instructions where assistance is needed.
• Keep staff, gateway and router access secure and promptly remove people who no longer need access.
• Do not instruct Exentra to process information unlawfully.

4. Exentra commitments

• Process customer data only to provide, secure and support the service or comply with law.
• Use reasonable technical and organisational safeguards, including tenant boundaries, access controls, audit records and encryption of sensitive credentials.
• Limit personnel and service-provider access to legitimate need.
• Assist with reasonable security, rights and incident requests, considering the nature of processing and available information.
• Delete or return data after service ends, subject to lawful retention, backup cycles, disputes and security requirements.

5. Service providers and incidents

Exentra may use cloud infrastructure, email, security, support and payment-related providers as subprocessors. Exentra remains responsible for selecting providers appropriate to their function and will make material changes transparent.

Exentra will notify an affected operator without undue delay after confirming a personal-data breach that requires operator action, and will provide available information needed for assessment and notification.

6. Requests and audits

Exentra will provide reasonable information demonstrating compliance. Audits must protect other tenants, security controls and confidential information, and should ordinarily begin with documentation rather than intrusive access.