1. Summary and decision

Fictional NightDesk Support Pte. Ltd. is proposed to provide out-of-hours web-shop customer support, with agents in Singapore and Manila. The B9 review identified evidence received and matters that remain unresolved, including the scope of the Manila operations, breach-notice timing, deletion and AI processing. On 18 January 2027, the DPO decided to proceed to a three-month pilot starting on 1 March 2027 only if the conditions in DA-13 are met. The COO approved that conditional decision on 20 January 2027; the DPO must confirm the conditions are met before the pilot starts.

2. What is proposed

The Head of Customer Service proposed NightDesk on 14 December 2026 to answer web-shop chat and email from 18:00 to 23:00 and at weekends. NightDesk agents would work from Singapore and Manila. Access from Manila would involve an overseas transfer and needs to be considered in the B10 transfer review and by Quillmarrow’s lawyer.

NightDesk would act as a data intermediary for the proposed service. Its agents would access Fictional Helpdesk tickets and web-chat transcripts, PD-06, and have read-only order lookup in Fictional ShopCloud for web-shop customer accounts and orders, PD-01 and PD-02. The proposed access should be limited to those ticket and order-lookup roles as a condition of the pilot.

NightDesk’s tooling offers AI reply suggestions. The feature is not approved for the pilot and must remain off under the conditions in DA-13. The questionnaire was sent on 17 December 2026 and answers were received on 8 January 2027.

3. Questions asked

The B9 checklist review covers the following questions. “Evidence provided” means material was received; it does not, by itself, establish that the material is sufficient or that a condition has been met.

4. Evidence received and evidence missing

Evidence received

• Draft data processing terms.
• Security summary.
• ISO/IEC 27001 certificate covering NightDesk’s Singapore office only.
• Staff confidentiality undertaking template.
• List of sub-processors.

These documents support the review but do not resolve all questions or demonstrate that the pilot conditions have been met.

Evidence missing

• Confirmation of the scope of the Manila operations under the certificate.
• NightDesk’s breach-notice timing to clients.
• Details of deletion at contract end.
• The location where AI reply-suggestion data is processed.
• Whether AI reply-suggestion data is used to train models.

The Head of Customer Service should obtain the missing evidence under DA-13. If it is not available or does not resolve the review points, the pilot must not start on the basis of the existing conditional approval.

5. Risks and how they are handled

The ratings below are review assessments for the proposed pilot, not legal conclusions.

6. Points for Quillmarrow’s lawyer

The following are points for Quillmarrow’s lawyer to advise on and agree with the relevant parties. They are not legal conclusions in this record.

1. Data intermediary obligations: whether the proposed terms adequately describe NightDesk’s responsibilities for the service and the personal data it processes.
2. Manila transfer safeguards: the safeguards and supporting evidence appropriate to access from Manila.
3. Breach notice: notifying Quillmarrow without undue delay of a suspected breach, with a contractual target of 24 hours.
4. Return and deletion: arrangements for returning and deleting data at contract end, including the evidence Quillmarrow should obtain.
5. Audit and evidence rights: what evidence and review rights Quillmarrow should be able to request.
6. Sub-processor changes: how proposed changes are communicated and addressed.
7. AI feature: the terms needed to keep reply suggestions switched off unless approved.

Legal questions should be confirmed with a Singapore-qualified lawyer. Agreement of the lawyer’s contract points is a condition of DA-13, not an outcome recorded as complete in this review.

7. AI features

NightDesk offers AI-generated reply suggestions as part of its tooling. The review has not established where the data used for those suggestions is processed or whether it is used to train models. Both points remain missing evidence.

For the proposed pilot, reply suggestions must be off. Any later proposal to use the feature should be reviewed under B14 before Quillmarrow decides whether to approve it. The conditional pilot decision does not approve the AI feature.

8. Conditions before the pilot

DA-13 is owned by the Head of Customer Service and is due on 28 February 2027. Each condition below must be met before the pilot starts; the DPO confirms the conditions before 1 March 2027.

1. Missing evidence received — Head of Customer Service; due 28 February 2027. Obtain the outstanding Manila certificate-scope, breach-notice, deletion and AI-processing information, and retain it with C4.
2. Lawyer’s contract points agreed — Head of Customer Service, with advice from Quillmarrow’s lawyer; due 28 February 2027. Record the agreed position on the points in section 6.
3. AI reply suggestions off — Head of Customer Service; due 28 February 2027. Confirm the feature is switched off for the pilot.
4. Access limited — Head of Customer Service; due 28 February 2027. Confirm access is limited to ticket and read-only order-lookup roles.
5. B9 and B3 updated — Head of Customer Service; due 28 February 2027. Ensure the vendor record and personal data inventory reflect the proposed service and its conditions.

A B9 record adding DV-04 with pilot conditions was logged under PC-10 on 20 January 2027. The required pre-pilot updates and condition check must still be completed; that entry alone is not evidence that DA-13 is closed.

9. Decision record

10. Follow-up

The Head of Customer Service should maintain the DA-13 evidence and progress in C2 and C4. The DPO’s pre-pilot check should distinguish evidence received, contract points agreed and controls confirmed from matters still open. If a condition is not met, the pilot should not start under the conditional decision.

B3 and B9 must reflect the service, data access, locations and conditions before the pilot. If the pilot starts after the conditions are met, a pilot check is planned after 30 days. Any findings or further decisions should be recorded at that point rather than assumed in advance.