DATAKEY SDN BHD — TERMS OF SERVICE

Effective Date: 10 August 2026

Last Updated: 10 August 2026

IMPORTANT NOTICE — PLEASE READ CAREFULLY

THESE TERMS OF SERVICE ("AGREEMENT") CONSTITUTE A BINDING LEGAL CONTRACT BETWEEN DATAKEY SDN BHD ("DATAKEY", "WE", "US", OR "OUR") AND THE COMMERCIAL ENTITY OR INDIVIDUAL ("CUSTOMER", "YOU", OR "YOUR") ACCESSING OR USING THE DATAKEY CLOUD BACKUP PLATFORM, DESKTOP AGENTS, MANAGEMENT PORTAL, OR ASSOCIATED SERVICES (COLLECTIVELY, THE "SERVICES").

BY CHECKING AN "I AGREE" BOX, EXECUTING AN ORDER FORM, DOWNLOADING THE DATAKEY DESKTOP AGENT, OR ACCESSING THE SERVICES, YOU REPRESENT AND WARRANT THAT YOU HAVE THE LEGAL AUTHORITY TO BIND YOUR ORGANIZATION TO THIS AGREEMENT. IF YOU DO NOT AGREE TO THESE TERMS, DO NOT ACCESS OR USE THE SERVICES.

1. DEFINITIONS AND STRUCTURE

1.1 "Customer Content" means all electronic files, database entries, records, and data uploaded, backed up, or transmitted to the Services by Customer or its end users.
1.2 "Data Processing Agreement (DPA)" means DataKey's standalone legal agreement governing the processing and protection of Personal Data, available at https://datakey.com.my/dpa, which is hereby incorporated into this Agreement by reference.
1.3 "Desktop Agent" means the software application licensed by DataKey for installation on Customer's servers, workstations, or endpoint devices to execute local backup jobs.
1.4 "Order Form" means an online checkout summary, subscription selection page, or formal written order executed by the parties specifying the plan tier, storage limits, pricing, and billing frequency.
1.5 "Personal Data" has the meaning given under the Malaysian Personal Data Protection Act 2010 (PDPA) and its 2024 Amendments.

2. ELIGIBILITY AND B2B REPRESENTATION

2.1 Commercial Entities Only. The Services are offered strictly for commercial, business, professional, or enterprise use. The Services are not intended for consumer or personal household use.
2.2 Authority to Bind. You represent and warrant that:

(a) You are at least eighteen (18) years of age; and

(b) You have full legal authority to represent, bind, and execute contracts on behalf of the commercial entity named during registration or checkout.

3. SERVICE SCOPE AND SOFTWARE LICENSING

3.1 Software License Grant (Desktop Agent). Subject to Customer's compliance with this Agreement, DataKey grants Customer a non-exclusive, non-transferable, non-sublicensable, revocable license to download, install, and execute the Desktop Agent solely on Customer's internal devices for the purpose of accessing the backup Services.
3.2 SaaS Service Provisioning. DataKey agrees to provide cloud backup infrastructure, automated snapshot scheduling, encryption, monitoring portals, and file restore functionalities in accordance with Customer's selected plan tier (Shield, Vault, or Fortress).
3.3 Feature Roadmap & Marketing Demonstrations. Customer acknowledges that marketing examples (such as hypothetical restore timing demonstrations) are illustrative performance benchmarks and do not constitute absolute strict guarantees or Service Level Agreements (SLAs) unless explicitly executed in a signed Enterprise SLA Annex.

4. FEES, BILLING, AND PRICING MODIFICATIONS

4.1 Subscription Fees. Customer agrees to pay the Subscription Fees specified on the live pricing page (https://datakey.com.my/pricing), Order Form, or checkout summary at the time of subscription. All fees are quoted in Malaysian Ringgit (MYR) and are exclusive of applicable Sales and Service Tax (SST) or statutory duties, which shall be borne by Customer.
4.2 Price Guarantee During Active Term. Subscription Fees agreed upon at checkout shall remain fixed for the duration of the initial paid Subscription Term (e.g., 12 months for an annual plan).
4.3 Price Modifications Upon Renewal. DataKey reserves the right to adjust subscription rates, tier structures, or package inclusions for subsequent Renewal Terms. DataKey shall provide Customer with at least thirty (30) days' written notice prior to the expiration of the current term regarding any price modifications. Continued subscription following the notice period constitutes acceptance of the new rates.
4.4 Third-Party Grant Claims. If Customer applies for government-subsidized technology digitization grants (e.g., MDEC / BSG grants) to offset SaaS costs, Customer acknowledges that full subscription fees remain Customer's sole legal responsibility. In the event a grant application is delayed, rejected, or uncollected, Customer shall remain fully obligated to pay the full subscription amount directly to DataKey.

5. CANCELLATION, REFUNDS, AND AUTO-RENEWAL

5.1 Auto-Renewal. Subscriptions automatically renew at the end of each billing cycle (monthly or annually) unless Customer cancels the subscription at least thirty (30) days prior to the renewal date via the admin management portal or by written notice to billing@datakey.com.my.
5.2 Non-Refundable Fees. All Subscription Fees paid are strictly non-refundable. DataKey does not issue pro-rated refunds or credits for partial subscription months or unused storage allocations upon early cancellation.

6. DATA OWNERSHIP AND ZERO-KNOWLEDGE ARCHITECTURE

6.1 Data Ownership. Customer retains absolute ownership of, and all intellectual property rights in, all Customer Content uploaded to the Services. DataKey acquires no right, title, or interest in Customer Content except for the limited license to store, encrypt, and restore such data for service delivery.
6.2 Confidentiality & Zero-Knowledge Architecture. DataKey warrants that it does not inspect, read, sell, or analyze the unencrypted contents of Customer Content. All backup payloads are encrypted client-side using per-tenant Customer Managed Keys (CMKs) under AES-256 standards. DataKey personnel do not hold customer decryption keys.

7. IMMUTABLE VAULTS (WORM) AND CRYPTO-SHREDDING

7.1 Immutable Storage (WORM Lock). Customer acknowledges that Customer Content committed to DataKey's backup vaults is stored under Write-Once-Read-Many (WORM) immutability settings to prevent ransomware modifications or unauthorized tampering. Once written, individual backup blocks cannot be modified or deleted by Customer or DataKey until the mandatory retention timer expires.
7.2 Crypto-Shredding as Deletion Method. In accordance with the PDPA Retention Principle (Section 10), Customer agrees that permanent data deletion or erasure requests are executed via Crypto-Shredding (the deliberate destruction of the tenant's unique cryptographic encryption key). Destroying the encryption key renders Customer Content forensically unrecoverable and permanently unreadable noise, satisfying statutory requirements for destruction.

8. SUSPENSION AND TERMINATION

8.1 Termination for Non-Payment. If any fees remain unpaid past the due date, DataKey shall enforce a staggered default process:

(a) Grace Period (Days 1–14): Automated billing notifications sent.

(b) Service Suspension (Day 15): Automated backup execution pauses, and the management portal shifts to read-only access.

(c) Contract Termination (Day 30): Subscription terminates, and the offboarding retention window commences.

8.2 Termination for Material Breach. Either party may terminate this Agreement immediately upon written notice if the other party materially breaches any term and fails to cure such breach within thirty (30) days of receiving formal written notice.
8.3 Immediate Suspension Rights. DataKey reserves the right to immediately suspend access without prior notice if DataKey reasonably suspects that Customer:

(a) Is reverse-engineering, hacking, or attempting to compromise the platform;

(b) Is using the Services to store illegal, malicious, or infringing payloads; or

(c) Poses an immediate security threat to DataKey's infrastructure or other tenants.

8.4 Post-Termination Offboarding & Data Deletion. Upon termination of this Agreement for any reason, Customer shall have a grace period of fourteen (14) calendar days to export or download Customer Content from the portal. Upon the expiration of the 14-day window, DataKey shall permanently Crypto-Shred all remaining Customer Content, and DataKey shall carry zero liability for post-termination data loss.

9. ACCEPTABLE USE AND MALWARE QUARANTINE

9.1 Prohibited Use. Customer shall not: (i) license, sell, or commercialize the Desktop Agent; (ii) upload data without statutory authority or third-party consent; or (iii) use the platform to distribute computer viruses, ransomware, or spyware.
9.2 Automated Malware Quarantine. DataKey reserves the right to quarantine isolated files or halt automated restore procedures if our security pipelines detect active malware signatures within a restore payload, to prevent re-infecting Customer's environment.

10. DISCLAIMERS AND LIMITATION OF LIABILITY

10.1 Disclaimer of Warranties ("As Is"). EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE SERVICES ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS. DATAKEY DISCLAIMS ALL WARRANTIES OF ANY KIND, EXPRESS, IMPLIED, OR STATUTORY, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
10.2 Pre-Infection & Credentials Disclaimer. DATAKEY WARRANTS THAT THE SERVICES UTILIZE IMMUTABLE ARCHITECTURE DESIGNED TO PROTECT BACKUP BLOCKS AGAINST MODIFICATION AT REST. HOWEVER, DATAKEY DOES NOT WARRANT THAT IT CAN RECOVER FILES THAT WERE ALREADY INFECTED, CORRUPTED, OR ENCRYPTED BY MALWARE PRIOR TO BEING TRANSMITTED TO THE SERVICE, OR WHERE DATA LOSS RESULTS FROM COMPROMISE OF CUSTOMER'S ADMINISTRATIVE CREDENTIALS.
10.3 Financial Liability Cap. TO THE MAXIMUM EXTENT PERMITTED BY MALAYSIAN LAW, DATAKEY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT SHALL BE STRICTLY CAPPED AT THE TOTAL FEES ACTUALLY PAID BY CUSTOMER TO DATAKEY IN THE SIX (6) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO LIABILITY.
10.4 Exclusion of Consequential Damages. IN NO EVENT SHALL DATAKEY BE LIABLE FOR ANY INDIRECT, CONSEQUENTIAL, SPECIAL, PUNITIVE, OR INCIDENTAL DAMAGES, INCLUDING LOSS OF PROFITS, LOSS OF REVENUE, BUSINESS INTERRUPTION, OR LOSS OF REPUTATION.

11. INDEMNIFICATION

11.1 Customer Indemnification. Customer agrees to defend, indemnify, and hold harmless DataKey, its directors, and employees against any third-party claims, fines, or damages arising out of Customer's breach of the PDPA, unlawful collection of Customer Content, or violation of Acceptable Use terms.
11.2 DataKey Security Indemnification. DataKey agrees to defend Customer against direct third-party damages awarded by a court resulting directly from a confirmed breach of DataKey's primary system infrastructure caused by DataKey's gross negligence, subject strictly to the limitation caps set forth in Section 10.

12. DATA PROTECTION AND DPA INCORPORATION

12.1 Regulatory Compliance. Both parties agree to comply with their respective obligations under the Malaysian Personal Data Protection Act 2010 (PDPA) and its 2024 Amendments.
12.2 Incorporation of DPA. To the extent that Customer Content contains Personal Data, the terms of DataKey's standalone Data Processing Agreement (DPA) (https://datakey.com.my/dpa) are hereby incorporated by reference. In the event of a direct conflict between this ToS and the DPA regarding data privacy, the DPA shall control.

13. MODIFICATIONS TO TERMS OF SERVICE

13.1 Non-Material Changes. Administrative corrections or non-material policy updates take effect immediately upon being published to https://datakey.com.my/terms.
13.2 Material Changes. For material modifications (including changes to liability limits, billing mechanics, or data protocols), DataKey shall provide Customer with at least thirty (30) days' prior notice via email or in-app dashboard notification.
13.3 Acceptance & Remedy. Continued access to the Services following the notice period constitutes binding acceptance of the updated Terms. If Customer objects to the revised terms, Customer's sole remedy is to cancel the subscription prior to the effective date.

14. GOVERNING LAW AND DISPUTE RESOLUTION

14.1 Governing Law. This Agreement shall be governed by, interpreted, and construed strictly in accordance with the laws of Malaysia.
14.2 Jurisdiction. The parties irrevocably submit to the exclusive jurisdiction of the Courts of Malaysia (or binding arbitration administered by the Asian International Arbitration Centre (AIAC) in Kuala Lumpur) for the resolution of any dispute arising out of this Agreement.
14.3 Controlling Language. This Agreement is executed in the English language, which shall be the controlling version in all respects. Any translation into Bahasa Malaysia is provided solely for statutory convenience or PDPA compliance.

15. FORCE MAJEURE AND CLOUD INFRASTRUCTURE OUTAGES

15.1 Force Majeure Events. Neither party shall be liable for failure or delay in performing obligations (except payment duties) due to causes beyond reasonable control, including acts of God, war, terrorism, government restrictions, utility disruptions, or power grid failures.
15.2 Cloud Regional Outages. Customer explicitly acknowledges that the Services rely on single-region primary cloud hosting infrastructure physically situated in Malaysia (e.g., AWS / Alibaba Cloud Malaysia Region). A widespread regional cloud infrastructure outage or hardware facility failure affecting the Malaysia region shall be deemed a Force Majeure Event, and DataKey shall not be held in breach of contract or liable for service availability claims during such an outage.

16. MISCELLANEOUS

16.1 Entire Agreement. This Agreement, together with the Privacy Notice, Order Forms, and DPA, constitutes the entire contract between the parties.
16.2 Severability. If any provision of this Agreement is held invalid or unenforceable, the remaining provisions shall remain in full force and effect.
16.3 Contact Information. For legal inquiries or formal notices, please contact:
Datakey Sdn Bhd
Attn: Legal & Compliance Department
Email: legal@datakey.com.my
Address: Level 1, Synergy 9, 9 Jalan Kajibumi U1/70, Temasya Glenmarie, 40150 Shah Alam, Selangor, Malaysia