DRAF / DRAFT — Dokumen ini masih dalam semakan undang-undang dan belum berkuat kuasa. This document is under legal review and is not yet in effect; items marked ⚠ are still to be settled.
Rebana

Rebana — Master Customer Agreement

Canang Technologies Sdn Bhd · Registration No. ⚠ [No. Pendaftaran SSM]
Status: DRAFT for legal review — not yet in use, not legal advice.
Last updated: ⚠ [date]

This Master Customer Agreement ("MCA") is between Canang Technologies Sdn Bhd ("Canang") and the organisation named as Customer in an Order (the "Customer"). "Order" means an order form, Perjanjian Langganan, letter of acceptance (Surat Setuju Terima) or other ordering document signed or issued by both parties that references this MCA. The MCA, each Order and the Data Processing Addendum ("DPA") together form the "Agreement". Canang and the Customer are each a "Party".

The Agreement takes effect when both Parties sign or accept the Order through their authorised officers. Clicking, using the Services or paying an invoice does not by itself bind a public body that has not issued an Order.

1. Definitions

2. The Services

2.1 Right to use. During the Subscription Term, and subject to the Agreement, Canang grants the Customer a non-exclusive, non-transferable right to use the Services on its Nodes, for its own public functions and operations, by Customer Users and Public Users, within the features and usage limits in the Order and its Entitlements.

2.2 Customer applications and integrations. The Customer may connect its own systems and applications to the Services through the APIs and sandbox environments described in the Documentation ("Customer Applications"), including through contractors it appoints. The Customer is responsible for Customer Applications. Canang will give reasonable notice of API changes it expects to break an integration that follows the Documentation.

2.3 Restrictions. The Customer will not, and will not allow others to: (a) resell or provide the Services to any organisation other than the Customer (a shared-service arrangement between public bodies needs Canang's written agreement in the Order); (b) copy, modify, decompile or reverse engineer the Services except as the law allows; (c) remove proprietary notices; (d) tamper with, forge or circumvent an Entitlement or any access control; (e) upload malicious code, or use the Services unlawfully or in a way that endangers their security or other customers; or (f) exceed the usage limits in the Order.

2.4 Security testing. The Customer may conduct, or appoint an assessor to conduct, security assessments and penetration tests of its Nodes, after giving Canang 10 working days' notice of the scope and window, so that Canang can protect other customers' infrastructure. Findings are the Customer's Confidential Information; Canang will remedy confirmed vulnerabilities within the timelines in the Order.

2.5 Accounts. The Customer controls who has access and at what role, keeps credentials confidential, and tells Canang promptly of any suspected compromise. The Customer is responsible for Customer Users' use of the Services.

2.6 Updates. Canang updates the Services from time to time. Updates are included in the subscription. Canang will not, during a Subscription Term, remove a feature the Customer is subscribed to or materially reduce the functionality of a subscribed Module without the Customer's consent. Upgrades to Nodes are scheduled with the Customer.

2.7 Maturity labels.

(a) Perintis (pilot) Modules are provided for evaluation and early use with the Customer's participation. The Order states the pilot scope, success criteria and duration and any conversion price. The service warranty in §9.1 applies to Perintis Modules only as stated in the Order. (b) Akan Datang Modules are not subscribed or supplied under an Order. Canang gives no commitment to a delivery date for them, and no fee is payable for them until they are added to an Order.

2.8 Pilot documents. Where the Customer cannot commit expenditure before an allocation is approved, the Parties may first sign a pilot memorandum (Memorandum Persefahaman Perintis) covering a defined pilot phase, with the subscription price schedule attached, followed by an Order once the allocation exists. The memorandum states which parts of this MCA apply during the pilot; the DPA always applies.

3. Delivery, included services and support

3.1 Nodes and Entitlements. Canang will provision each Node and issue its Entitlement for the Subscription Term. On renewal or change of Modules, Canang issues a replacement Entitlement. If an Entitlement expires, the Node continues to operate for a grace period (currently 14 days) before subscription features stop; the Customer's ability to read and export its data does not depend on a valid Entitlement (see §10.4).

3.2 Included in the subscription. For each subscribed Module: maintenance, bug fixes, security patches, updates and new releases of that Module; standard support as described in the Order; and, for Canang-hosted Nodes, hosting, monitoring, backups and disaster recovery at the levels in the Order. There is no separate annual maintenance fee.

3.3 On-premise Nodes. The Customer provides and operates the infrastructure to the specification in the Documentation, and gives Canang the remote or on-site access needed to install, upgrade and support the Node. Canang is not responsible for failures caused by infrastructure it does not control.

3.4 Service levels. Availability targets, support hours, response and resolution times, and any service credits are in the Order's service-level schedule. Service credits, where offered, are the Customer's financial remedy for missed service levels, without prejudice to termination under §10.

3.5 Professional Services. Canang will perform Professional Services in the Order with reasonable skill and care. Data migration is limited to the scope and person-day cap in the Order. The Customer will provide timely access to people, legacy data and decisions; delays caused by the Customer extend Canang's timelines accordingly.

4. Customer Data

4.1 Ownership. As between the Parties, the Customer owns all Customer Data, including Output. Canang assigns to the Customer any rights it may have in Output.

4.2 Canang's use. Canang may use Customer Data only to provide the Services, to comply with law, and as the DPA allows. Canang will not use Customer Data to train, fine-tune or evaluate AI models, other than a model deployed for and used only by the Customer at its written request.

4.3 Operational telemetry. Canang may collect technical information about the operation of the Services — such as versions, error logs, performance metrics and Entitlement status — to support and improve the Services. Telemetry does not include the content of Customer records or Customer Personal Data, except where a Customer User includes it in a support or issue report, in which case that report is Customer Data under the DPA.

4.4 Data Processing Addendum. The DPA governs Canang's processing of personal data in Customer Data.

4.5 Customer responsibilities. The Customer is responsible for the lawfulness and accuracy of Customer Data it enters, for giving any notices and obtaining any consents required from Public Users and staff, and for its own retention and archival obligations (including under the National Archives Act 2003).

5. AI features

5.1 Assistive only. AI features (for example Rebana Insight, citizen assistance and Rebana CRM) help officers find information and draft responses. AI Output can be incomplete or wrong. The Customer's officers remain responsible for checking Output before relying on it, and for every decision taken in the exercise of the Customer's statutory or administrative powers. The Services do not make such decisions.

5.2 Traceability. Where the Documentation says so, AI answers show the records or documents they were drawn from, so that officers can verify them.

5.3 Model location. The Order states, per Node, whether AI runs on a model hosted locally or by an external provider. Canang will not switch a Node to an external provider without the Customer's written approval (DPA §4.2).

5.4 Public-facing AI. Where the Customer enables AI responses to Public Users, the Customer decides the topics it may answer, and the Services will show that the response is AI-generated and offer a route to a human officer.

6. Suspension

6.1 Canang may suspend access to an affected Node or feature, only to the extent necessary, if: (a) there is an active threat to the security or integrity of the Services or of other customers; or (b) required by law or by an order of an authority.

6.2 Non-payment. Canang may suspend for non-payment only if an undisputed invoice remains unpaid 90 days after its due date and Canang has given at least 30 days' written notice to the Customer's head of department and finance officer. ⚠

6.3 Canang will give notice before any suspension where practicable, restore the Services promptly once the cause is resolved, and never delete or withhold Customer Data because of a suspension. During any suspension the Customer keeps read-only access and the right to export its data.

7. Third-party services

The Services may connect to third-party services the Customer chooses — for example payment gateways, collection hubs, WhatsApp, SMS and e-mail providers, government systems, or an external AI model provider. The Customer's use of such services is subject to its agreements with those providers. Canang is responsible for its connectors working as documented, but not for the third-party services themselves. Where Canang contracts a third party on the Customer's behalf, it is a sub-processor under the DPA.

8. Fees and payment

8.1 Fees. The Customer will pay the subscription fees and Professional Services fees in the Order ("Fees"). The Order states the fee for each year of the Subscription Term; the fee schedule is fixed for the Term and will not be increased during it.

8.2 Invoicing. Unless the Order states otherwise, subscription fees are invoiced annually in advance at the start of each subscription year, and Professional Services on the milestones in the Order. Fees are in Ringgit Malaysia.

8.3 Payment. The Customer will pay each correct invoice within 30 days of receipt, or the period required by the payment rules that bind the Customer, if shorter. The Customer will tell Canang within 14 days of receipt of any invoice it disputes, with reasons, and pay the undisputed part.

8.4 Taxes. Fees exclude Sales and Service Tax and any other applicable taxes, which Canang will charge in accordance with law and show on its invoices. Each Party bears its own income taxes.

8.5 Late payment. ⚠ [Late-payment charges apply only if stated in the Order.]

8.6 Changes in scope. Modules or Nodes added during the Term are charged pro rata to the end of the current subscription year, then at the Order rate. Modules removed take effect at the next subscription anniversary.

8.7 Budget allocation. ⚠ If the Customer's annual budget allocation for the Services is not approved for a subscription year, the Customer may end the Agreement at the end of the current subscription year by written notice given at least 60 days before it ends, without penalty. Fees already paid are not refunded, and Data Handback applies.

9. Warranties

9.1 Service warranty. Canang warrants that the Services will perform materially as described in the Documentation for the subscribed Modules. If they do not, and the Customer notifies Canang with reasonable detail, Canang will correct the non-conformity within 30 days (or the period in the service-level schedule). If Canang fails to do so, the Customer may terminate the affected Module and receive a pro-rata refund of prepaid Fees for the remaining Term.

9.2 Professional Services. Canang warrants that Professional Services will be performed with reasonable skill and care, by suitably qualified personnel. Canang will re-perform non-conforming work notified within 30 days of delivery.

9.3 Compliance. Canang warrants that it will comply with the laws applicable to its performance of the Agreement, and that it holds and will maintain the registrations required for the Customer to contract with it (for example with the Ministry of Finance, where applicable). ⚠

9.4 Regulatory content. The Services are designed around the statutory forms, circulars and standards named in the Documentation (for example KEW.PA, MPSAS, SKALA). Canang maintains them in line with published changes, within the timelines in the Order. The Services support the Customer's compliance; they do not by themselves make the Customer compliant, and a statement that the Services are "ready for audit" means the records are ready for inspection — not that any audit outcome is guaranteed.

9.5 Disclaimer. Except as stated in this Agreement, and to the extent the law allows, Canang gives no other warranties, express or implied, including of merchantability or fitness for a particular purpose. Canang does not warrant that the Services will be uninterrupted or error-free, or that AI Output will be accurate.

10. Term and termination

10.1 Term. The MCA continues while any Order is in force. Each Order runs for its Subscription Term. There is no automatic renewal; renewal is by a new or extended Order.

10.2 Termination for breach. Either Party may terminate an Order by written notice if the other Party commits a material breach and fails to remedy it within 30 days after written notice describing it.

10.3 Insolvency. Either Party may terminate if the other Party is wound up, has a receiver, manager or judicial manager appointed, enters a scheme of arrangement with creditors, or ceases business without a successor.

10.4 Termination for convenience. ⚠ [The Customer may terminate an Order by 90 days' written notice. Fees for the current subscription year are not refunded; no further Fees accrue.]

10.5 Effect of expiry or termination. (a) The right to use the Services ends, and the Entitlements are not renewed. (b) Data Handback: Canang will deliver a complete export of Customer Data within 10 working days of the Customer's request, in open, documented formats, and keep the Node available read-only for 6 months, as set out in DPA §10. Then Canang deletes Customer Data from Canang-hosted Nodes and certifies deletion. (c) If the Customer terminates for Canang's breach, or under §9.1, Canang refunds prepaid Fees for the unused part of the Term. Otherwise prepaid Fees are not refunded. (d) Each Party returns or destroys the other's Confidential Information, except copies the law requires it to keep.

10.6 Survival. Sections 4, 10.5, 11 to 16, and the DPA for as long as Canang holds Customer Data, survive expiry or termination.

11. Intellectual property

11.1 Canang and its licensors own the Services, the Documentation, the Entitlement mechanism and all related technology, including improvements. No rights pass to the Customer except those expressly granted.

11.2 The Customer owns Customer Data, its names, crests and marks, and any materials it supplies.

11.3 Work product created specifically for the Customer under Professional Services — such as data-mapping sheets, configuration and migration scripts for the Customer's legacy data — may be used by the Customer freely for its own purposes. Canang may reuse general know-how and generic components that contain no Customer Data or Confidential Information.

11.4 If the Customer gives feedback or suggestions about the Services, Canang may use them without obligation, but will not identify the Customer as their source without consent.

12. Liability

12.1 Indirect loss. Except for Excluded Claims, neither Party is liable for loss of profit, revenue or goodwill, or for indirect or consequential loss, arising from the Agreement.

12.2 Cap. Except for Excluded Claims, each Party's total liability arising from the Agreement is limited to the Fees paid and payable under the relevant Order in the 12 months before the event giving rise to the claim ⚠.

12.3 Excluded Claims are not limited by 12.1 or 12.2: (a) the Customer's obligation to pay Fees due; (b) indemnity obligations under §13; (c) a Party's breach of §14 (Confidentiality); (d) fraud, wilful misconduct, and death or personal injury caused by negligence; and (e) anything else that cannot be limited by law. For Canang's breach of the DPA, Canang's liability is limited to ⚠ [twice] the cap in 12.2.

12.4 Data restoration. Where Customer Data on a Canang-hosted Node is lost or corrupted through Canang's fault, Canang will restore it from the most recent backup at its own cost, in addition to any other remedy.

13. Indemnities

13.1 By Canang. Canang will defend the Customer against any third-party claim that the Services, as supplied by Canang and used in accordance with the Agreement, infringe that party's intellectual property rights, and will pay the damages and costs finally awarded or agreed in settlement by Canang.

13.2 Exceptions. §13.1 does not apply to claims arising from Customer Data, Customer Applications, modification of the Services other than by Canang, or combination with items Canang did not supply, where the claim would not have arisen without them.

13.3 Mitigation. If a claim under §13.1 is made or likely, Canang may procure the right for the Customer to continue using the Services, or modify or replace them without reducing their overall functionality; if neither is reasonably possible, Canang may terminate the affected Module and refund prepaid Fees for the unused part of the Term.

13.4 By the Customer. ⚠ [To the extent permitted by law applicable to the Customer, the Customer will be responsible for third-party claims arising from Customer Data it supplied in breach of law.]

13.5 Procedure. The indemnified Party will notify the claim promptly, allow the indemnifying Party to control the defence and settlement (the Customer's control over any matter of public interest or statutory function is preserved), and give reasonable cooperation at the indemnifying Party's cost. No settlement may admit fault on behalf of the indemnified Party without its consent.

13.6 This §13 states each Party's entire liability for third-party intellectual property claims.

14. Confidentiality

14.1 Confidential Information is non-public information disclosed by one Party to the other in connection with the Agreement that is marked confidential or would reasonably be understood to be confidential. Customer Data, and any information classified under the Official Secrets Act 1972, are the Customer's Confidential Information.

14.2 The recipient will protect Confidential Information with at least reasonable care, use it only for the Agreement, and disclose it only to personnel, contractors and advisers who need it and are bound by equivalent obligations.

14.3 Obligations do not apply to information that is public through no fault of the recipient, was lawfully known to it before, was lawfully received from a third party, or was independently developed.

14.4 Public accountability. Nothing in the Agreement prevents the Customer from disclosing the Agreement, including its prices, to the extent required by law, by the National Audit Department, by a public accounts committee, by Parliament or a State Legislative Assembly, by its governing body or procurement committee, or by government procurement and transparency rules. The Customer will not otherwise publish Canang's pricing or technical documentation.

14.5 A Party may disclose Confidential Information when required by law or a court, after notifying the other Party where lawful.

15. Integrity and anti-corruption

15.1 Each Party will comply with the Malaysian Anti-Corruption Commission Act 2009. Canang maintains adequate procedures under section 17A of that Act.

15.2 Canang will not offer or give any gift, hospitality, payment, employment or other benefit to any officer or member of the Customer, or their family, in connection with the Agreement or its award. Any benefit under Canang programmes is given to the Customer as an institution, on published and uniform terms, and never to an individual.

15.3 Canang will sign any integrity pact (Pakatan Integriti) the Customer's procurement rules require.

15.4 Breach of this §15 is a material breach that cannot be remedied, entitling the Customer to terminate immediately.

16. General

16.1 Publicity. Canang will not use the Customer's name, crest, logo or screenshots showing its marks or data in any marketing or public material, or name the Customer as a customer or reference, without the Customer's prior written consent, which the Customer may withdraw.

16.2 Assignment. Neither Party may assign the Agreement without the other's written consent, which will not be unreasonably withheld for a transfer to a successor to all or substantially all of Canang's business, or to a public body that succeeds to the Customer's functions.

16.3 Subcontractors. Canang may use subcontractors, remaining responsible for them. Subcontractors with access to Customer Personal Data are sub-processors under the DPA.

16.4 Force majeure. Neither Party is liable for delay or failure caused by events beyond its reasonable control (such as natural disaster, flood, epidemic, war, civil disturbance, or failure of public utilities or networks), provided it notifies the other promptly and uses reasonable efforts to mitigate. If the event continues for more than 60 days, either Party may terminate the affected Order, with a pro-rata refund of prepaid Fees.

16.5 Notices. Notices must be in writing and delivered by hand, by registered post, or by e-mail to the addresses in the Order (for Canang: ⚠ [registered address]; legal notices to ⚠ [legal@canang.com.my]). E-mail notice is effective on the next working day unless a delivery failure is received. Operational notices may be given through the Services.

16.6 Entire agreement and order of precedence. The Agreement is the entire agreement on its subject matter. If documents conflict, this order applies: (a) the DPA, on the processing of personal data; (b) the Order; (c) this MCA; (d) the Documentation. Where the Customer's procurement rules require its own standard contract conditions, the Order will state which of those conditions apply and they will prevail to that extent ⚠. The pre-printed terms of any purchase order or invoice have no effect.

16.7 Amendments. Amendments must be in writing and signed by authorised representatives of both Parties. Canang may update this MCA for future Orders; an update does not change an Order already in force.

16.8 Waiver and severability. A waiver must be in writing. If a provision is unenforceable, it is limited to the minimum extent necessary and the rest continues in force.

16.9 Independent parties. The Parties are independent contractors, not partners or agents.

16.10 Electronic execution. The Order may be executed electronically and in counterparts, in accordance with the Electronic Commerce Act 2006 (and the Digital Signature Act 1997 where a digital signature is used).

16.11 Stamp duty. ⚠ [Stamp duty on the Agreement, if any, is borne by Canang / the Customer.]

16.12 Language. The Agreement may be executed in Bahasa Malaysia, English or both. ⚠ [If both, the Bahasa Malaysia text prevails.]

16.13 Governing law and disputes. The Agreement is governed by the laws of Malaysia. (a) Escalation. A dispute will first be referred to the Parties' project leads, then to the Customer's head of department (or Secretary / Chief Executive) and Canang's chief executive, who will meet within 21 days of referral. (b) Mediation. If unresolved within 30 days after that meeting, the Parties may refer the dispute to mediation under the rules of the Asian International Arbitration Centre (AIAC), Kuala Lumpur. (c) Courts. Failing settlement, the courts of Malaysia have exclusive jurisdiction ⚠ [or, if the Order so states, the dispute is resolved by arbitration in Kuala Lumpur under the AIAC Arbitration Rules, in accordance with the Arbitration Act 2005]. (d) The Parties will continue to perform the Agreement, and Canang will continue to provide the Services and Data Handback, while a dispute is being resolved.