สัญญาประมวลผลข้อมูล (DPA)

1. Purpose and Scope

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Deep Chain Technology Co., Ltd. (“Processor”) and the customer (“Controller”).

This DPA applies when the Processor processes Personal Data on behalf of the Controller in connection with the Services.

2. Roles of the Parties

The Controller determines the purposes and means of processing Personal Data.

The Processor processes Personal Data solely on documented instructions from the Controller and in accordance with the Terms and this DPA.

3. Nature and Purpose of Processing

Processing activities may include:

• Collection
• Storage
• Organization
• Analysis
• Automation
• Transmission
• Backup
• Deletion

Processing is performed solely to provide the Services described in the Terms.

4. Categories of Data

Personal Data processed may include, but is not limited to:

• Name
• Email address
• Telephone number
• Address
• IP address
• Usage data
• Website interaction data
• Marketing data
• Behavioral analytics

The Processor does not intentionally process Sensitive Personal Data unless explicitly instructed by the Controller.

The Controller is solely responsible for ensuring lawful collection of all Personal Data, including data relating to minors.

5. Processor Obligations

The Processor shall:

• Process Personal Data only for the purpose of providing the Services
• Implement appropriate technical and organizational security measures
• Ensure personnel are bound by confidentiality
• Not sell Personal Data
• Notify the Controller of Data Breach as described in section 10

6. Security Measures

The Processor implements reasonable security measures including:

• Access controls
• Encryption where appropriate
• Secure cloud infrastructure
• Monitoring and logging
• Backup procedures

Security measures are proportionate to the nature of the Services.

7. Sub-Processors

The Controller authorizes the Processor to engage Sub-Processors, including but not limited to:

• Cloud infrastructure providers
• Payment service providers
• Analytics providers
• CRM providers

The Processor shall ensure that Sub-Processors are subject to appropriate data protection obligations.

8. International Data Transfers

Personal Data may be transferred to or stored in jurisdictions outside the Controller’s country, including for cloud backup or processing.

The Processor shall implement appropriate safeguards consistent with applicable data protection laws.

9. Data Subject Rights Assistance

The Processor shall provide reasonable assistance to the Controller in responding to Data Subject requests, to the extent technically feasible.

The Controller remains responsible for responding to such requests.

10. Data Breach Notification

The Processor shall notify the Controller without undue delay after becoming aware of a confirmed Personal Data Breach affecting Controller Data.

The notification shall include reasonably available information about the nature of the breach and mitigation measures.

11. Data Retention and Deletion

Upon termination of the Services, Personal Data shall be deleted in accordance with the Company’s retention policy, unless retention is required by law.

12. Audit Rights

The Controller may request reasonable information regarding data protection practices.

Formal audits shall be limited to reasonable scope and frequency and may be subject to confidentiality and cost allocation.

13. Liability

Liability under this DPA shall be subject to the limitations set forth in the Terms of Service.