Data, Messaging and Liability Agreement

Version 2026-10-23.3. Last updated: 23 October 2026

This Data, Messaging and Liability Agreement (the “Agreement”) is between you (the customer, and the company you act for) and Agensi Pekerjaan Talent Focus Sdn Bhd, the owner and operator of BossLead (“BossLead”, “we”, “us”). It forms part of our Terms of Service. If this Agreement and the Terms of Service differ on how data, messages or liability are handled, this Agreement applies. You accept it by ticking the boxes when you sign up or when we ask you to, and by using the Service.

1. Words used in this Agreement

Service: BossLead, its website, app, crawler, data and features.
Company Data: company and contact information we make available in the Service, including names, job titles, work email addresses, phone and WhatsApp numbers, addresses and websites of businesses and the people who work for them.
Connected Accounts: the email mailboxes (for example Gmail, Google Workspace, Microsoft 365, Outlook or any IMAP/SMTP mailbox) and WhatsApp numbers you connect to the Service.
Your Messages: the emails and WhatsApp messages in, sent from or received by your Connected Accounts, and their attachments, contacts and details.
Outreach: every email, WhatsApp message, call or other contact you make with the help of the Service, whether written by you or by AI.
PDPA: the Personal Data Protection Act 2010 of Malaysia, as amended (including by the Personal Data Protection (Amendment) Act 2024), and its regulations, standards and codes of practice.

2. Your permission to access your email and WhatsApp

You authorise us to access, read, download, store, analyse, send from and manage Your Messages and your Connected Accounts, for as long as they are connected, so that we can run the Service for you. This includes:

sending the emails and WhatsApp messages you set up (campaigns, flows, follow-ups, replies);
reading incoming messages to find replies, bounces, out-of-office answers and opt-outs (“unsubscribe”, “STOP”), and stopping messages to people who opted out;
showing your conversations in the Inbox and keeping your contact book and pipeline up to date;
drafting, classifying and summarising messages with AI;
checking deliverability, inbox placement, authentication (SPF, DKIM, DMARC) and account health, and pausing an account to protect it;
if you switch it on, WhatsApp warm-up: your number sends and receives short, ordinary chats with other numbers in the warm-up network (your own numbers, other customers’ numbers and ours). Warm-up chats are kept out of your Inbox and leads.

We act as your data processor for Your Messages: we use them only to provide the Service to you, on your instructions. We do not sell them, use them for advertising, add them to the Company Data other customers search, or share them with other customers. Our staff do not read Your Messages, except in a support session you agree to or ask for, to investigate abuse or keep the Service secure, or when the law requires it.

For Google accounts, our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We do not use data from Gmail or Google Workspace to train general artificial-intelligence models.

You confirm that you have the right to connect each Connected Account, and, for a company mailbox or number, that your employer allows it. You can disconnect an account at any time. After you disconnect it or close your account, we stop accessing it and delete or anonymise Your Messages within a reasonable time, except records we must keep by law or to resolve a dispute.

3. Company Data and the PDPA

Company Data is collected from public sources (company websites, public directories, government registers, maps and business listings), from data partners and from businesses that list themselves. Business contact details of a named person are still personal data under the PDPA, even when anyone can find them online. Being public does not by itself make every use of them lawful.

When you reveal, save, export or contact anyone using Company Data, you decide why and how that personal data is used. You are the data controller (data user) for that use and you are fully responsible for complying with the PDPA and every other law that applies, including that you:

use Company Data only to offer products or services to businesses, for a lawful purpose directly related to your business;
tell each person you contact, in your first message, who you are, how to reach you, where you got their details from (for example “from your company website”) and how to stop further messages;
stop contacting anyone who asks you to, at once and through every channel, and never contact them again by other means to get around their opt-out;
answer requests from people to access, correct or delete their data within the time the PDPA requires, and tell us straight away if a request concerns data in the Service;
keep exports and downloads safe, do not keep them longer than you need, and report any leak of them to the Personal Data Protection Commissioner and the affected people where the law requires;
follow the law of the country of each person you contact (for example Singapore’s Personal Data Protection Act and Do Not Call rules, Indonesia’s Personal Data Protection Law, or the GDPR in Europe) when it is stricter;
do not use Company Data to contact consumers about personal matters, for debt collection, for political campaigns, or to decide on anyone’s credit, insurance, housing or employment;
where the PDPA requires it of your business, register with the Personal Data Protection Commissioner, appoint a data protection officer, and keep the records the PDPA requires (including of consents, opt-outs and requests);
keep Company Data only as long as you need it for your purpose, and when your account ends, delete the Company Data you exported or copied within 30 days (unless the law requires you to keep it) and confirm this to us in writing if we ask.

For Company Data, you and we are each separately responsible for our own processing. We are not a joint controller of your Outreach, and nothing in this Agreement makes us your agent, partner or employee.

We do not promise that Company Data is accurate, complete, current or lawful to use for your purpose. Check important details before relying on them. If someone asks us to remove their details, we remove them from the Service; you must then stop using any copy you have.

4. Your Outreach is your responsibility

You are the sender of all Outreach. You decide who to contact, what to say, how often, from which account and at what volume, and you are solely responsible for it, including messages written by AI that you send or set up to send. We do not review Outreach before it is sent.

You must not use the Service:

to send spam, scams, phishing, malware, threats, harassment, defamatory, obscene or misleading content, or to impersonate anyone;
to promote anything illegal, including unlicensed money lending, gambling, pyramid or investment schemes, counterfeit goods, or controlled drugs;
to contact children, or to collect or use sensitive personal data (health, religion, political opinions, criminal records, biometric data and similar);
in breach of the Communications and Multimedia Act 1998, the PDPA, the Private Employment Agencies Act 1981 (for recruitment outreach), anti-spam laws, or the terms of Google, Microsoft, Meta/WhatsApp or any other provider whose service you use with ours;
to resell, publish, share or give away Company Data, or to build or improve another database or service with it.

5. Email and WhatsApp accounts are at your own risk

Email and WhatsApp providers decide on their own whether to deliver, limit, filter, suspend or ban an account. Our sending limits, warm-up, pauses and checks lower that risk but cannot remove it.

A WhatsApp number linked by scanning a QR code uses an unofficial connection, not Meta’s official WhatsApp Business Platform, and WhatsApp warm-up is not approved by Meta. Using either may breach WhatsApp’s terms, and WhatsApp may restrict or permanently ban the number, with the loss of its chats and contacts. Use a number you can afford to lose. You choose to use these features entirely at your own risk.

We are not responsible for any limit, suspension or ban of an email or WhatsApp account, for messages going to spam or not being delivered, or for any loss that follows.

6. Your promises to us

Each time you use the Service you promise that: the details you gave us are true; you are authorised to bind the company you act for; you have a lawful basis for every use you make of Company Data and Your Messages; your Outreach complies with the law and this Agreement; and you have read this Agreement and had the chance to take legal advice on it. We rely on these promises when we provide the Service.

You are responsible for everyone who uses the Service through your account or workspace (your team members, agencies and clients) as if their acts were your own, and you will make sure they follow this Agreement.

If we ask, you will within 7 days give us reasonable evidence that you comply (for example, how you tell people where you got their details, and your record of opt-outs and requests). We may limit or monitor reveals, exports and sending to detect misuse.

7. Complaints, requests and data breaches

You will tell us in writing within 2 business days if you receive a complaint, a request from a person about their data, or any letter, notice or question from the Personal Data Protection Commissioner, the police, the Malaysian Communications and Multimedia Commission or any other authority, about your Outreach or about data that came from the Service.

If Company Data or Your Messages in your control are lost, stolen, leaked or accessed without permission (for example through your exports, your devices or your team), you will tell us at once, notify the Commissioner within 72 hours and the affected people where the PDPA requires, and follow our reasonable instructions. You are responsible for that breach and its costs.

You allow us to contact the person who complained, to remove their data, to stop all messages to them from every account, and to answer the authority directly. If you do not deal with a complaint properly, we may do so at your cost.

8. Limits on our liability

To the fullest extent the law allows, Agensi Pekerjaan Talent Focus Sdn Bhd, BossLead and our directors, officers, employees, agents and partners are not liable to you or anyone claiming through you for:

how you, your team or your clients collect, use, store, export or disclose Company Data or Your Messages;
your Outreach, and any complaint, claim, investigation, compound, fine or penalty that results from it, including under the PDPA or any anti-spam, telecommunications or consumer law in any country;
the accuracy, completeness or lawfulness of Company Data or of AI-written content;
the limitation, suspension or ban of any email, WhatsApp or other account, or undelivered or late messages;
acts or failures of Google, Microsoft, Meta/WhatsApp, Stripe, AI providers, hosting and other third parties;
any loss of profit, revenue, business, contracts, goodwill, data or opportunity, or any indirect, special or consequential loss.

Where we are liable despite this, our total liability for all claims in any 12 months is limited to the fees you paid us in those 12 months.

Nothing in this Agreement excludes or limits liability that cannot be excluded or limited by law, including liability for our own fraud or wilful misconduct, or any right that the law does not allow to be taken away.

9. You protect us (indemnity)

You agree to defend, indemnify and hold harmless Agensi Pekerjaan Talent Focus Sdn Bhd, BossLead, our related companies, resellers and partners, and their directors, officers, employees and agents from and against every claim, demand, complaint, investigation, action, compound, fine, penalty, damage, loss, cost and expense (including reasonable legal fees on a solicitor-and-client basis, investigation and response costs, and, to the extent the law allows them to be recovered, any compound, fine or penalty imposed on us) arising from or connected with: your use of the Service; your Outreach; your collection, use or disclosure of Company Data or Your Messages; the content and data you put into the Service; your Connected Accounts; or your breach of this Agreement, the Terms of Service or any law. This applies also to anything done by your team members, your clients and anyone using your account.

You will pay these amounts on demand. We may deduct them from any amount we owe you, suspend your account until they are paid, and recover them as a debt.

If a person or authority contacts us about your Outreach or your use of data, you will cooperate with us promptly and give us the information we reasonably ask for. We may give an authority information about your account, including your identity, your Outreach and our records of your acceptance, where the law requires it or to defend ourselves.

10. What we may do to protect the Service and others

We may, without notice and without refund: pause or stop campaigns, flows or accounts; limit sending; remove data; disconnect a Connected Account; or suspend or close your account, if we believe you are breaking this Agreement or the law, if we receive complaints, or to protect people, providers or the Service.

We keep records of your acceptance of this Agreement (version, date and time, IP address and browser), and logs of what is sent from your account, and may use them as evidence.

11. Service providers and transfers outside Malaysia

We use service providers to run the Service, such as hosting, Cloudflare, Google, Microsoft, Meta/WhatsApp, Stripe, email delivery services and AI providers. Some of them process data outside Malaysia. You consent to these transfers, which we make in line with section 129 of the PDPA. Our Privacy Policy explains how we handle personal data.

12. Resellers, partners and agencies

If you give access to the Service to your own clients or team (as a reseller, partner or agency), you must make them accept terms at least as protective as this Agreement, and you are responsible to us for everything they do with the Service.

If you resell the Service, or offer it to customers in, or to contact people in, any country (including Malaysia), it is solely your responsibility to check and comply with the laws of that country before you do so and for as long as you do so, including its data protection law (such as Singapore’s Personal Data Protection Act and Do Not Call rules, Indonesia’s Personal Data Protection Law, Thailand’s Personal Data Protection Act, the Philippines’ Data Privacy Act or the GDPR), anti-spam, telecommunications, consumer protection, tax, licensing and registration laws. This includes any registration, appointment of a data protection officer or local representative, notices, consents and contracts that country requires of you or of your customers.

We make no promise that the Service, Company Data or any feature is lawful, suitable or available in any country outside Malaysia. You are liable for, and will indemnify us under section 9 against, any claim, complaint, fine or penalty in any country that arises from your reselling or use of the Service there, or from your customers’ use of it.

13. General

Any claim against us must be brought within 12 months after the event it is about; after that it is waived, to the extent the law allows. We are not responsible for delays or failures caused by events outside our reasonable control, including outages and changes made by Google, Microsoft, Meta or other providers.

If a court finds any part of this Agreement unenforceable, that part is applied to the greatest extent the law allows and the rest stays in force. Sections 3 to 10 continue after your account closes. We may update this Agreement; we will ask you to accept a new version before you continue using the Service. Electronic acceptance is binding under the Electronic Commerce Act 2006. This Agreement is governed by the laws of Malaysia, and the courts of Malaysia have exclusive jurisdiction. If this Agreement is translated, the English version applies.

Questions about this Agreement: Agensi Pekerjaan Talent Focus Sdn Bhd, [email protected].