数据处理附录

1. Scope and roles

1.1 This Addendum forms part of the Master RaaS Agreement between OLOSO INC (“OLOSO”) and the customer (“Customer”) and applies to OLOSO’s processing of Customer Personal Data.

1.2 “Customer Personal Data” means personal information relating to Customer’s personnel which OLOSO processes on Customer’s behalf in providing the Platform and Services, as described in Annex 1.

1.3 Roles. In respect of Customer Personal Data, Customer is the business or controller and OLOSO is the service provider or processor.

1.4 What this Addendum does not cover. This Addendum does not apply to: personal information OLOSO processes as a business or controller in its own right, including the contact, account, order and payment information described in the OLOSO Privacy Policy; operating records that do not identify an individual; aggregated or de-identified data; or information relating to Customer’s own consumers, which OLOSO does not receive.

2. OLOSO’s obligations

OLOSO will:

• process Customer Personal Data only on Customer’s documented instructions, which are given by the Agreement and by Customer’s use of the Platform, and as required by law;

• not sell or share Customer Personal Data, and not retain, use or disclose it for any purpose other than performing the Services, except as permitted by applicable law;

• not combine Customer Personal Data with personal information from another source except as permitted for a service provider under applicable law;

• ensure that personnel with access are bound by confidentiality obligations;

• maintain the technical and organisational measures described in Annex 2;

• provide reasonable assistance, at Customer’s cost, with Customer’s obligations in respect of individuals’ requests and security incidents, taking into account the nature of the processing and the information available to OLOSO;

• make available information reasonably necessary to demonstrate compliance with this Addendum; and

• notify Customer if it determines it can no longer meet its obligations under applicable law.

3. Customer’s obligations

Customer will: provide all required notices to, and obtain any required consent from, its personnel; ensure it has a lawful basis for the processing; configure Platform accounts and permissions appropriately; issue instructions that comply with applicable law; and be responsible for the accuracy of Customer Personal Data.

4. Sub-processors

4.1 Authorisation. Customer generally authorises OLOSO to engage sub-processors, including OLOSO’s affiliates and the providers listed in Annex 3.

4.2 Changes. OLOSO will give notice of a new sub-processor by updating Annex 3 on its website or by email. Customer may object on reasonable data protection grounds within [ten (10)] days. If the objection cannot be resolved, Customer’s sole remedy is to terminate the affected Service on notice, subject to the early termination provisions of the Agreement.

4.3 Liability. OLOSO remains responsible for its sub-processors’ performance of the obligations in this Addendum, subject in all cases to the limitation of liability in clause 19 of the Agreement.

5. Affiliate access and international processing

5.1 Access. Customer acknowledges and agrees that authorised technical personnel of OLOSO and of its affiliate TEDIA Technology, including personnel located outside the United States and in particular in China, may access Customer Personal Data for the purpose of operating, maintaining, troubleshooting and supporting the Platform and the Equipment. Access is limited to designated authorised personnel on a least-privilege basis, using individual accounts with segregated permissions for administration systems and databases. Access to Customer Personal Data made through OLOSO’s administration systems is logged, recording the operator, the time and the action taken. Direct database-level access is not available to all technical personnel; it is enabled only on a temporary, as-needed basis where required to resolve complex faults, and is controlled at account level.

5.2 Hosting location. Customer Personal Data is hosted by Amazon Web Services in its Asia Pacific (Singapore) region (ap-southeast-1). Customer acknowledges that Customer Personal Data is accordingly stored outside the United States, in Singapore, and may be accessed from China as described in clause 5.1.

5.3 Changes. OLOSO will not change the hosting region, or the countries from which Customer Personal Data is accessed, without giving notice under clause 4.2.

6. Security incidents

OLOSO will notify Customer without undue delay after confirming a security incident affecting Customer Personal Data, and will provide the information then available to it and reasonable cooperation.

Notification is not an acknowledgement of fault or liability.

7. Individuals’ requests

If OLOSO receives a request from an individual relating to Customer Personal Data, it will, unless prohibited by law, direct the individual to Customer and notify Customer. OLOSO will provide reasonable assistance, at Customer’s cost, in responding.

8. Audit

OLOSO will respond to reasonable written information requests, no more than once in any twelve (12) months, to verify compliance with this Addendum. Any on-site audit is subject to OLOSO’s express consent with no less than 30 days’ prior notice with a well-defined scope of access to the extent necessary only.

9. Retention, deletion and return

On termination, OLOSO will make Customer Personal Data available for export as provided in clause 13.6 of the Agreement. Thereafter, Customer Personal Data will be retained, and deleted, in accordance with the retention periods in Annex 1, which apply both during the Term and after termination. OLOSO is not obliged to delete Customer Personal Data on termination before the end of the applicable retention period, and may also retain it to the extent required or entitled under applicable law or for legal, tax, food-safety, audit, security or dispute purposes. Backups are taken daily and each backup is retained for seven (7) days; because Customer Personal Data is not deleted from primary systems on termination, later backups will continue to contain it until it is deleted under the applicable retention period. This Addendum continues to apply to any Customer Personal Data that OLOSO retains after termination.

10. General

This Addendum is subject to, and does not increase, the limitations of liability in clause 19 of the Agreement. In the event of conflict, this Addendum prevails over the Agreement in respect of the processing of Customer Personal Data. Governing law and dispute resolution are as stated in the Agreement. The English-language version controls.

Annex 1 — Details of processing

Annex 2 — Technical and organisational measures

As at the effective date, these comprise: encryption of communications in transit; encryption of sensitive data at rest; management of credentials and connection strings through a dedicated secrets manager; role-based access control separating customer and administrative roles; least-privilege access, with individual accounts and segregated permissions for administration systems and databases; limitation of direct database-level access to designated authorised technical personnel, enabled temporarily and only where required to resolve complex faults; logging of data queries made through administration systems, recording operator, time and action; logging of Platform user sign-ins and operations; signed communication between Equipment and Platform; sign-in by one-time verification code; request rate limiting; daily backups, each retained for seven (7) days; and hosting of all Platform data stores within a single AWS region (Singapore).

Annex 3 — Sub-processors