Layarva Data Processing Addendum (DPA)

Effective Date: 21 August 2026
Last Updated: 23 August 2026
Version: 2026-08-23

This Data Processing Addendum ("DPA") supplements the agreement between a Customer and Layarva where Layarva processes Personal Data on behalf of that Customer in connection with the Services.

This DPA forms part of the Layarva Terms of Service, Order Form, Enterprise Agreement, or another agreement incorporating or referring to this DPA (the "Main Agreement").

Layarva is operated by CV DNA Konsultan, having its registered address at Jl. Arabika 8 Blok AA 1 No. 9, RT.001/RW.005, Pondok Kopi, Duren Sawit, Jakarta Timur, DKI Jakarta 13460, Indonesia ("Layarva" or the "Processor").

The Customer accepting the Main Agreement or this DPA is referred to as the "Customer" or the "Controller" to the extent it determines the purposes of and exercises control over the processing of Personal Data submitted to Layarva.

This DPA is intended to assist the parties in complying with applicable Personal Data protection requirements, including Law of the Republic of Indonesia No. 27 of 2022 on Personal Data Protection (the "PDP Law").

1. Scope and Priority

This DPA applies only to the extent Layarva processes Personal Data as a Processor pursuant to Customer instructions.

It does not alter Layarva's role as a Controller for Personal Data where Layarva independently determines processing purposes, such as certain data used for account administration, billing, invoicing, platform security, fraud prevention, compliance, certain support operations, or Layarva's own operations.

Processing performed by Layarva as Controller is described in the Layarva Privacy Policy.

If this DPA conflicts with the Main Agreement concerning Personal Data processed by Layarva as Processor, this DPA controls for that processing to the extent permitted by law.

2. Definitions

The terms "Personal Data", "Data Subject", "Personal Data Controller", and "Personal Data Processor" have the meanings assigned under applicable data protection law.

"Customer Data" means data submitted, uploaded, transmitted, or otherwise made available by or on behalf of the Customer through the Services.

"Customer Personal Data" means Customer Data that constitutes Personal Data and is processed by Layarva as Processor on behalf of the Customer.

"Documented Instructions" means Customer instructions contained in the Main Agreement, Service configuration, use of Service functionality, technical documentation, valid API requests, valid support requests, or another written or recorded communication agreed by the parties.

"Subprocessor" means another Personal Data Processor engaged by Layarva to process Customer Personal Data in connection with the Services.

"Data Incident" means a Personal Data protection failure resulting or potentially resulting in unauthorized destruction, loss, alteration, disclosure of, or access to Customer Personal Data.

3. Roles of the Parties

Customer as Controller

To the extent the Customer determines processing purposes and control, the Customer acts as Controller.

The Customer is responsible for:

• determining processing purposes;
• ensuring an appropriate lawful basis;
• providing required privacy notices;
• obtaining consent where required;
• determining who may access Personal Data;
• ensuring instructions to Layarva are lawful; and
• complying with Controller obligations.

Layarva as Processor

To the extent Layarva processes Customer Personal Data solely to provide the Services according to Customer instructions, Layarva acts as Processor.

Layarva will process Customer Personal Data under the Customer's Documented Instructions and applicable law.

Processing Outside Instructions

If Layarva is legally required to process Personal Data outside Customer instructions, Layarva will, where legally permitted, notify the Customer.

Layarva will not use Customer Personal Data for unrelated purposes unless an appropriate lawful basis and processing role apply.

4. Processing Instructions

By using the Services, the Customer instructs Layarva to perform processing reasonably necessary to:

• receive and store Customer Data;
• provide Studio and content management;
• render, transcode, cache, and distribute Content;
• operate playlists and scheduling;
• manage Screens and Devices;
• pair and synchronize Devices;
• provide Queue Management;
• provide the Public API;
• operate integrations enabled by the Customer;
• provide troubleshooting and support;
• perform backups and disaster recovery;
• maintain security and prevent abuse; and
• provide other functionality expressly used by the Customer.

If Layarva reasonably believes an instruction violates applicable data protection law, it may suspend that instruction and notify the Customer where legally permitted.

5. Customer Obligations

The Customer represents that:

1. it has the right to provide Customer Personal Data to Layarva;
2. instructed processing has an appropriate lawful basis;
3. required notices have been given;
4. consent has been obtained where required;
5. submitted Personal Data is relevant to the purpose;
6. it will not instruct unlawful processing; and
7. credentials, roles, permissions, and configurations under its control are managed securely.

The Customer determines whether Layarva functionality and configuration are suitable for its legal, industry, and internal requirements.

6. Data and Data Subjects

General processing details are in Schedule 1 — Processing Details.

Depending on Customer use, data may include:

• organization User data;
• Customer-provided operational data;
• Queue Management data;
• Content metadata;
• API payloads;
• user-provided Screen location, including latitude and longitude entered by Users;
• device-related data associated with individuals where relevant; and
• other Personal Data lawfully submitted by the Customer.

Layarva does not request sensitive or specially protected Personal Data by default unless specific functionality, documentation, or a separate agreement expressly supports it.

Customers should avoid submitting unnecessary Personal Data.

7. Confidentiality

Layarva will ensure personnel with access to Customer Personal Data:

• have a legitimate need for access;
• are subject to appropriate confidentiality obligations; and
• process data only within assigned responsibilities.

Administrative access will be restricted according to least-privilege principles where appropriate.

8. Security

Layarva will implement technical and organizational measures appropriate to the nature, context, scope, and risk of processing.

Measures may include:

• authentication;
• authorization;
• role-based access control;
• credential protection;
• encryption in appropriate transmission or storage contexts;
• network security;
• logging;
• monitoring;
• backups;
• vulnerability management;
• access restrictions;
• incident response; and
• business continuity.

A summary appears in Schedule 2 — Technical and Organizational Measures.

9. Subprocessors

Use of Subprocessors

Layarva may engage Subprocessors for services such as cloud hosting, databases, object storage, CDNs, authentication, email, payment-related infrastructure, monitoring, logging, customer support, backups, or other technical services.

Customer Approval

Layarva will obtain written approval or another legally recognized recorded form of approval from the Customer before engaging a Subprocessor to the extent required by applicable law.

Acceptance of this DPA may constitute approval of Subprocessors clearly identified on the Subprocessor list when this DPA is accepted, to the extent such mechanism satisfies applicable law.

For additions or replacements, Layarva will use an appropriate notice and approval mechanism under applicable law and the Main Agreement.

Subprocessor Obligations

Layarva will require Subprocessors to provide safeguards appropriate to the processing they perform.

Subprocessor List

The current list may be provided at:

https://layarva.com/legal/subprocessors/en

or in Schedule 3.

10. Infrastructure Location and Cross-Border Transfers

Layarva uses cloud infrastructure that may be located in Indonesia or other countries or regions.

Server, storage, backup, CDN, regional, and Subprocessor locations may change based on availability, security, reliability, performance, scalability, disaster recovery, or other technical requirements.

Unless expressly agreed in writing, Layarva does not guarantee processing in a specific geographic location.

For cross-border transfers, the parties will comply with transfer mechanisms required by applicable law, including requirements relating to protection level, adequate and binding safeguards, or another lawful transfer basis.

Layarva will provide information reasonably necessary for transfer assessments that are the Customer's responsibility as Controller.

11. Data Subject Requests

If Layarva receives a request directly from a Data Subject clearly relating to Personal Data controlled by the Customer, Layarva may direct the requester to the Customer or notify the Customer unless law requires otherwise.

Taking into account the nature of processing and available functionality, Layarva will provide reasonable assistance for requests concerning:

• access;
• correction;
• updating;
• deletion;
• restriction;
• termination of processing;
• portability where applicable; or
• other legal rights.

The Customer remains responsible for validating and responding to requests as Controller.

12. Impact Assessments and Regulatory Consultation

Where Customer processing requires a Data Protection Impact Assessment or similar assessment, Layarva will provide reasonably available information about Layarva's processing.

Where regulatory consultation is required, Layarva will provide reasonable assistance concerning the processing performed by Layarva.

Material work beyond standard support may be subject to a separate commercial arrangement where permitted by law.

13. Data Incidents and Notification

Layarva will:

1. take reasonable measures to detect, respond to, and mitigate Data Incidents;
2. notify the Customer without undue delay after becoming aware of a Data Incident affecting Customer Personal Data;
3. to the extent available, provide information on the nature of the Incident, affected data, potential impact, and mitigation; and
4. provide reasonable assistance with applicable notification obligations.

The Customer acknowledges that, as Controller, it may have notification obligations to Data Subjects and/or competent authorities within legally prescribed periods.

Notification by Layarva does not itself constitute an admission of fault or liability.

14. Audits and Compliance Information

Layarva will make reasonably necessary information available to demonstrate compliance with Processor obligations under this DPA.

If the Customer reasonably requires an audit:

• it must relate to Customer Personal Data;
• scope must be proportionate;
• it must not compromise other customers' security or confidentiality;
• the auditor must be bound by confidentiality;
• any onsite audit will occur at a mutually agreed time; and
• Layarva may first provide reports, questionnaires, certifications, or other evidence where sufficient.

Excessive, repetitive, or materially burdensome audits may be subject to reasonable fees where permitted and agreed.

This DPA does not require disclosure of irrelevant trade secrets, other customers' data, source code, credentials, information that would weaken system security, or information prohibited from disclosure by law.

15. Retention After Subscription Expiration

If a paid Subscription expires and is not renewed, Customer Operational Data and Customer Content may be retained for a maximum of 180 days from the Subscription expiration date, under the Terms of Service and Privacy Policy, for purposes such as:

• reactivation;
• recovery;
• limited storage;
• security; or
• completion of the Account lifecycle.

Logging in during the period does not reset the 180-day period.

During post-Subscription retention, processing may be limited primarily to storage, security, recovery, compliance, and functions required to manage the Account lifecycle.

The Customer may request earlier deletion where valid, technically feasible, and not inconsistent with legal obligations.

16. Return and Deletion of Data

At the end of the processing relationship, Layarva will, according to Customer instructions and applicable law:

• delete;
• anonymize; and/or
• enable return or export of data where functionality is available and agreed.

After the applicable retention period, Customer Personal Data in production systems may be deleted or anonymized.

Data may temporarily remain in backups until the normal backup lifecycle expires.

Backups:

• are used for disaster recovery and continuity;
• are not intended as active operational storage after Account deletion;
• are not intended to function as an archive of historical logs that have aged out of the normal retention lifecycle; and
• follow the applicable backup lifecycle.

Technical Logs and Evidence Export

Technical and operational logs used by Layarva follow the standard retention periods described in the Layarva Privacy Policy and may be deleted as part of the normal system lifecycle.

If Layarva receives or becomes aware of a Data Incident, investigation, audit, dispute, claim, or valid legal request while relevant logs are still available, authorized personnel may export records reasonably necessary for that purpose into a separate file.

The exported file may be retained separately for a maximum of 365 days from the date the export is created, and may be deleted earlier when it is no longer required for the specific related purpose.

If applicable law or a valid and binding order specifically requires a longer retention period, the exported file may be retained to the extent and for the period required by that obligation.

Creating or retaining the export does not suspend, extend, or otherwise change the retention lifecycle of the source logs.

If, before a request is received, relevant logs or data have already been deleted, anonymized, overwritten, or otherwise become unavailable through the normal system lifecycle, Layarva is not required to recover, reconstruct, recreate, or provide records that are no longer under Layarva's control, to the extent permitted by applicable law.

Layarva can only provide records that remain available when the request is processed or records that were previously exported and retained separately.

Layarva is not required to preserve logs specifically for a possible future investigation, dispute, claim, or legal proceeding before receiving a valid and sufficiently specific request, notice, or binding order concerning the relevant data.

Nothing in this section limits obligations that mandatorily apply under applicable law or under a valid and binding order received by Layarva.

Records such as accounting, tax, or other records subject to an independent retention obligation may follow the retention period required for those records.

17. User-Provided Screen Location

If the Customer uses Screen location functionality, information such as latitude, longitude, location name, address, or location label is provided or entered by the User or Customer.

Layarva does not automatically collect GPS or background location from a Screen merely because a Device is connected to the Services.

Where this location information constitutes Personal Data, its processing as Customer Personal Data is subject to this DPA.

The Customer is responsible for ensuring an appropriate lawful basis.

18. Queue Management

If the Customer uses Queue Management and enters Personal Data, the Customer acts as Controller to the extent it determines processing purposes.

Layarva processes such data only as needed for:

• ticket issuing;
• queue workflows;
• call/recall;
• operator/counter workflows;
• completion/no-show;
• display;
• printing;
• logging; or
• other Queue Management functionality used by the Customer.

Customers should avoid entering unnecessary Personal Data.

19. Public API

Personal Data transmitted through the Public API is processed pursuant to Customer requests and configuration.

The Customer is responsible for:

• protecting API keys and tokens;
• ensuring payloads have an appropriate lawful basis;
• limiting data to what is necessary; and
• securing the sending system.

Layarva may use logging, rate limiting, security monitoring, and technical metadata processing to protect API security and reliability.

20. Government and Law-Enforcement Requests

If Layarva receives a legally binding request from a competent authority to disclose Customer Personal Data, Layarva will:

• evaluate the request under applicable law;
• limit disclosure to what is legally required; and
• where legally permitted, notify the Customer.

Layarva is not required to resist a request that is legally binding on Layarva.

21. Liability

Liability under this DPA follows the limitations and allocation of liability in the Main Agreement unless applicable law mandatorily requires otherwise.

Nothing in this DPA limits rights or obligations that cannot lawfully be limited.

22. Term

This DPA remains effective for as long as Layarva processes Customer Personal Data as Processor under the Main Agreement.

Clauses that by their nature must survive termination, including confidentiality, security, deletion, audit relating to the processing period, and certain legal obligations, survive to the extent necessary.

23. Changes to this DPA

Layarva may update this DPA to reflect changes in law, products, security, or operations.

Material changes that significantly reduce protections for Customer Personal Data will not be applied to an active term without a notice or approval mechanism appropriate under the Main Agreement and applicable law.

24. Governing Law

This DPA is governed by the laws of the Republic of Indonesia unless a separate written agreement lawfully provides otherwise.

Dispute-resolution mechanisms follow the Main Agreement to the extent consistent with mandatory Personal Data protection requirements.

25. Language Versions

This DPA may be provided in Indonesian and English.

If there is an inconsistency in interpretation, the Indonesian version will be used as the reference to the extent permitted by law.

26. How this DPA Becomes Binding

This DPA may become binding when:

• signed by the parties;
• incorporated or referenced in an Order Form or Enterprise Agreement;
• accepted electronically by the Customer; or
• accepted through another lawful written or recorded mechanism.

27. Privacy Contact

Layarva
Operated by: CV DNA Konsultan
Address: Jl. Arabika 8 Blok AA 1 No. 9, RT.001/RW.005, Pondok Kopi, Duren Sawit, Jakarta Timur, DKI Jakarta 13460, Indonesia
Email: halo@layarva.com

Schedule 1 — Processing Details

A. Subject Matter

Provision of the Layarva platform and Customer-selected functionality, including digital signage, Studio, content management, device management, Queue Management, Public API, and integrations.

B. Duration

For the duration of the Main Agreement and applicable retention periods, including a maximum 180-day Post-Subscription Retention Period for expired paid Subscriptions, unless data is deleted earlier or must be retained longer by law.

C. Nature of Processing

May include:

• collection/receipt;
• storage;
• organization;
• rendering;
• transcoding;
• caching;
• synchronization;
• transmission;
• display;
• API processing;
• logging;
• backup;
• deletion; and
• other technical processing necessary to provide the Services.

D. Purpose

Provision of functionality used by the Customer under the Main Agreement and Customer instructions.

E. Categories of Data Subjects

Depending on Customer use:

• employees;
• administrators;
• operators;
• contractors;
• Customer customers or visitors;
• users of the Customer organization's services;
• individuals whose data is entered into Queue Management; and
• other individuals whose Personal Data is lawfully submitted.

F. Categories of Personal Data

May include:

• names;
• email addresses;
• roles;
• identifiers;
• operational metadata;
• Customer-provided Content metadata;
• Queue Management data;
• API payloads;
• user-provided Screen location;
• Device/technical data associated with individuals where relevant;
• support-related data; and
• other Personal Data lawfully submitted.

G. Sensitive or Specially Protected Personal Data

Not intended to be processed by default unless specific functionality or a separate agreement expressly supports it.

Before submitting high-risk or specially protected Personal Data, the Customer must ensure an appropriate lawful basis, necessity, safeguards, and suitability.

Schedule 2 — Technical and Organizational Measures

Layarva may apply a combination of measures appropriate to the Services and system maturity:

Access Control

• role-based access;
• least privilege;
• administrative-access restrictions;
• session controls;
• credential management.

Authentication

• secure authentication;
• token/session management;
• optional or applicable multi-factor authentication;
• credential revocation.

Data Transmission

• encrypted transport using appropriate secure protocols.

Storage and Infrastructure

• managed cloud infrastructure;
• access-controlled databases/storage;
• environment separation where appropriate;
• backup and recovery mechanisms.

Logging and Monitoring

• security logging;
• API logging;
• Device/activity logs;
• error monitoring;
• suspicious-activity detection where implemented.

Application Security

• secure development practices;
• dependency and vulnerability management;
• authorization controls;
• input validation;
• rate limiting where appropriate.

Operational Security

• incident response;
• access review;
• controlled support access;
• change management;
• business continuity and disaster recovery planning.

Measures may evolve provided Layarva does not materially reduce the protection required by applicable law and the Agreement.

Schedule 3 — Subprocessor List

Monitoring/Logging: No separate Subprocessor is currently listed where monitoring/logging relies on native Vercel logging and additional logs are stored in Supabase.

Note: Processing locations must be verified against production configuration before the public Subprocessor List is published. A maintained public list may be provided at https://layarva.com/legal/subprocessors/en.