Build your AI team, role by role

This Mutual Non-Disclosure Agreement ("Agreement") is made between Zelix Labs Pte Ltd (UEN 202619950K), 60 Paya Lebar Road, #06-28 Paya Lebar Square, Singapore 409051 ("Zelix Labs"), and the individual or business that accepts it ("Client"). Each party is a "Disclosing Party" when it shares information and a "Receiving Party" when it receives information. This Agreement takes effect on the date the Client accepts it.

1. Purpose

The parties wish to discuss and carry out the building, configuration, integration, testing and ongoing support of the Client's AI team (the "Purpose"). To do this, each party may share confidential information with the other.

2. Confidential Information

"Confidential Information" means any non-public information disclosed by one party to the other, in any form (written, oral, visual, electronic, or by giving access to systems), whether or not marked confidential, that a reasonable person would understand to be confidential. It includes, without limitation:

• business, commercial, financial and strategic information, pricing, plans and roadmaps;
• customer, supplier and employee information, and any personal data;
• system access, login credentials, API keys, tokens, configurations and security details;
• conversation logs, message content, prompts, knowledge bases and training material;
• software, source code, workflows, methods, know-how, and the terms of the engagement.

3. Exclusions

Confidential Information does not include information that the Receiving Party can show: (a) is or becomes public through no breach of this Agreement; (b) was lawfully known to it without a duty of confidence before disclosure; (c) is lawfully received from a third party that is free to disclose it; or (d) is independently developed without use of the other party's Confidential Information.

4. Obligations of the Receiving Party

The Receiving Party will:

• use the Confidential Information only for the Purpose;
• protect it with at least the same care it uses for its own confidential information, and in any case no less than reasonable care;
• disclose it only to its officers, employees, contractors and professional advisers who need it for the Purpose and are bound by confidentiality obligations at least as protective as these (its "Representatives"), and it remains responsible for their compliance;
• not copy or reproduce it except as needed for the Purpose; and
• not reverse engineer, decompile or disassemble anything provided, except to the extent the law does not allow this restriction.

5. Compelled disclosure

The Receiving Party may disclose Confidential Information if required by law, regulation, court or regulator, provided that, where lawful, it gives the Disclosing Party prompt notice and reasonable help to limit or object to the disclosure, and discloses only what is required.

6. Personal data and the PDPA

Where Confidential Information includes personal data, each party will comply with the Singapore Personal Data Protection Act 2012 (the "PDPA") in handling that data. For Zelix Labs, the Data Protection Notice provided to the Client also applies and sets out how Zelix Labs handles personal data in the engagement.

Where one party (the "Processing Party") handles personal data on behalf of the other party (the "Controlling Party") for the Purpose, the Controlling Party remains the organisation responsible for that data and the Processing Party acts as its data intermediary. In that role, the Processing Party will:

• handle the personal data only for the Purpose and on the Controlling Party's reasonable instructions, and not for its own purposes;
• protect it with reasonable technical and organisational security measures, and grant access only to Representatives on a need-to-know basis;
• not retain the personal data for longer than is needed for the Purpose, and return or securely delete it on the Controlling Party's written request, subject to copies it must keep by law or that sit in routine, secured backups until deleted;
• assist the Controlling Party, so far as reasonable, in responding to a request from an individual to access or correct their personal data, or to withdraw consent; and
• ensure that any Representative or service provider it engages to handle the personal data is bound by data protection obligations at least as protective as these.

Where personal data is transferred to or handled in a country outside Singapore, the party arranging the transfer will take reasonable steps to ensure the data receives a standard of protection comparable to the PDPA, for example through the recipient's contractual commitments.

If a party becomes aware of a data breach affecting personal data it handles for the other party, it will notify the other party without undue delay, take reasonable steps to address the breach, and provide reasonable assistance with any notification the other party must make to affected individuals or to the Personal Data Protection Commission under the PDPA.

7. No licence or transfer

All Confidential Information remains the property of the Disclosing Party. Nothing in this Agreement grants the Receiving Party any right, title, licence or interest in the other party's Confidential Information or intellectual property, other than the limited right to use it for the Purpose.

8. No commitment

This Agreement does not oblige either party to proceed with any transaction, engagement or purchase. Any such commitment will be set out in a separate signed agreement.

9. No warranty

Confidential Information is provided "as is". Neither party makes any warranty as to its accuracy or completeness, except as may be agreed in a separate signed agreement.

10. Term and survival

This Agreement applies to Confidential Information disclosed while the parties are engaged or in discussions. The confidentiality obligations continue for three (3) years after the engagement or discussions end, and for as long as the law requires for personal data and for as long as the information remains a trade secret.

11. Return or destruction

On the Disclosing Party's written request, the Receiving Party will promptly return or securely destroy the Confidential Information and any copies, and confirm this in writing, except for copies it must keep by law or that are held in routine, secured backups, which remain subject to this Agreement until deleted.

12. Remedies

The parties agree that a breach may cause harm that money alone cannot fully remedy, and that the Disclosing Party may seek injunctive or other equitable relief in addition to any other remedy available at law.

13. Publicity

Neither party will use the other's name, logo or the existence of the engagement in public marketing without prior written consent, which may be given by email and may be withdrawn for future use.

14. General

• This Agreement is the entire understanding between the parties on confidentiality and replaces any earlier understanding on this subject.
• Any change must be in writing and agreed by both parties.
• If any part is found unenforceable, the rest remains in force.
• A failure to enforce a right is not a waiver of it.
• Neither party may assign this Agreement without the other's written consent, except to a successor of its business.
• Acceptance may be given electronically, including by ticking a box, and has the same effect as a signature.

15. Governing law

This Agreement is governed by the laws of Singapore, and the parties submit to the exclusive jurisdiction of the Singapore courts.

Zelix Labs Pte Ltd (UEN 202619950K), 60 Paya Lebar Road, #06-28 Paya Lebar Square, Singapore 409051 ("Zelix Labs", "we", "us") is committed to protecting personal data in line with Singapore's Personal Data Protection Act 2012 (PDPA). This notice explains how we handle personal data when we build, integrate, run and support your AI team.

1. Scope

This notice covers the personal data we handle as part of your engagement with us. Our general website Privacy Policy also applies; where this notice and the Privacy Policy differ for the build engagement, this notice applies.

2. Personal data we handle

• Your details: the name, business name, email, phone number and any information you give us when you enquire, scope or order a build.
• Your customers' data: during the build and ongoing support we are given access to your systems (such as your messaging inbox, CRM, calendar, order and payment tools), which may contain personal data about your customers, for example names, contact details, booking and order history, and message content.
• Technical data: configuration, logs and usage data needed to build, test and maintain the system.

3. Our role

For your own contact details, we are the organisation responsible for that data and handle it as set out in our Privacy Policy. For your customers' personal data that we access through your systems, you remain the organisation responsible (the controller) and we act as your data intermediary (processor), handling it only to provide the services and on your instructions.

4. Why we handle it

• to scope, build, configure, test, launch, operate, support and improve your AI team;
• to connect and maintain your integrations and to resolve issues;
• to contact you about your build, your account and your services; and
• to meet our legal, accounting and regulatory obligations.

We rely on your consent, our agreement with you, and our legitimate interests in delivering and supporting the services, as permitted by the PDPA.

5. Who else may handle it

We use trusted service providers to deliver the build. These may include the messaging platform (for example respond.io), AI and large language model providers that process messages to generate replies, hosting and infrastructure providers, our payment provider (Airwallex), and email and analytics tools. Each is bound by its own data protection terms and handles data only as needed to provide its service.

6. Transfers outside Singapore

Some providers may process data outside Singapore. Where this happens, we take reasonable steps to ensure the data receives a standard of protection comparable to the PDPA, for example through the provider's contractual commitments.

7. How we protect it

• access is granted on a need-to-know basis to the people working on your build;
• any temporary admin access we are given is used only for the wiring and is removed once it is complete;
• credentials and keys are stored securely and not shared beyond those who need them;
• data is encrypted in transit, and we apply reasonable technical and organisational measures; and
• we never sell personal data.

8. How long we keep it

We keep personal data only for as long as needed for your engagement and the purposes above, or as the law requires. We return or securely delete it on your written request, subject to copies we must keep by law or that sit in routine, secured backups until deleted.

9. Your rights

Subject to the PDPA, you may ask to access or correct your personal data, or withdraw consent to our handling of it. Withdrawing consent may limit or prevent us from delivering or supporting the services. To make a request, contact us through our contact page at zelixlabs.com.

10. Data incidents

If a data breach occurs that is likely to result in significant harm, or is of a significant scale, we will take reasonable steps to address it and will notify you and, where required, the Personal Data Protection Commission, in line with the PDPA.

11. Changes

We may update this notice from time to time. The version in effect when you place your order applies to that engagement, and we will tell you about material changes.

12. Contact and governing law

For any data protection question or request, contact our Data Protection Officer through our contact page at zelixlabs.com. This notice is governed by the laws of Singapore.

Read our full Privacy Policy