Data processing agreement

1. Definitions

"Customer personal data": personal data in customer content that we process on the customer's behalf, mainly about shoppers and the customer's team members.

"Data protection laws": laws that apply to processing customer personal data, including Singapore's PDPA, the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the California CCPA as amended by the CPRA, each to the extent it applies.

"Controller", "processor", "data subject" and "personal data breach" have the meanings given in the GDPR. Under the PDPA the customer is an "organisation" and we are a "data intermediary"; under the CCPA we are a "service provider".

"Subprocessor": a third party we engage to process customer personal data. Other terms have the meanings given in the Terms of service.

2. Roles and scope

The customer is the controller and we are the processor. The subject matter, nature, purpose and duration of processing, and the types of personal data and categories of data subjects, are set out in Annex 1.

The customer is responsible for having a lawful basis for the processing, giving data subjects the required notices and obtaining required consents, and ensuring its instructions comply with data protection laws.

3. Processing on instructions

We process customer personal data only on the customer's documented instructions. Instructions given through the Terms of service, this DPA, console settings and API calls count as documented instructions.

If we believe an instruction breaches data protection laws, we will tell the customer promptly and may suspend that instruction.

If the law requires us to process data in another way, we will tell the customer before doing so unless the law forbids it.

4. CCPA commitments

We will not sell customer personal data or share it for cross-context behavioural advertising; we will not retain, use or disclose it outside our direct business relationship with the customer or for any purpose other than those in the Terms of service; and we will not combine it with personal data from other sources except as the CCPA permits. We will tell the customer if we can no longer meet our obligations under the CCPA.

5. Confidentiality of personnel

Employees and contractors who can access customer personal data are bound by confidentiality obligations and access it only as needed for their duties.

6. Security

We apply the technical and organisational measures in Annex 2 and update them as risks and technology evolve, without lowering the overall level of protection.

7. Subprocessors

The customer gives general authorisation for us to engage subprocessors. The current list is in our Subprocessor list (yinke.ai/subprocessors).

Before adding or replacing a subprocessor, we update that page and notify customers by email at least 15 days in advance. The customer may object in writing on reasonable data protection grounds within that period, and the parties will discuss it in good faith; if it cannot be resolved, the customer may terminate the affected services and receive a pro rata refund of prepaid, unused fees.

We bind each subprocessor by written contract to data protection obligations no less protective than this DPA, and remain responsible to the customer for its performance.

For commercial confidentiality, some subprocessors are listed by category only; customers under contract can request their names at privacy@yinke.ai.

8. Assistance

Taking into account the nature of the processing, we help the customer respond to data subjects' requests for access, correction, deletion and so on, through console features or reasonable assistance. If a data subject contacts us directly, we pass the request to the customer and do not respond ourselves unless the law requires it.

We give reasonable assistance with data protection impact assessments, prior consultations with regulators, and the customer's security and breach notification obligations.

9. Personal data breaches

After becoming aware of a breach affecting customer personal data, we notify the customer without undue delay and in any case within 48 hours, with what is known at the time: the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact person. We provide further information as it becomes available and take reasonable steps to contain and mitigate the breach.

10. International transfers

Customer personal data may be processed in Singapore, the United States and other countries where subprocessors operate.

For customer personal data transferred from the European Economic Area, the Standard Contractual Clauses approved by European Commission Decision (EU) 2021/914 (Module Two: controller to processor) apply and are incorporated into this DPA by reference as if signed by the parties, with these options: Clause 7 does not apply; Clause 9 Option 2 applies, with the notice period in section 7 of this DPA; the optional wording in Clause 11 does not apply; and under Clauses 17 and 18 the law and courts of Ireland apply. Annexes 1 and 2 of this DPA are the annexes required by the clauses.

For data transferred from the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner also applies; for data transferred from Switzerland, the clauses apply with the adjustments Swiss law requires.

For transfers under the PDPA, we make sure recipients provide a standard of protection comparable to the PDPA.

11. Audits

We make available the information reasonably needed to demonstrate compliance with this DPA. The customer may audit us once a year on 30 days' written notice, during business hours, at its own cost, subject to confidentiality and without disrupting our operations. We may first offer written answers to a questionnaire or third-party reports instead of an on-site audit.

12. Deletion and return

After the Service ends, the customer may ask within 30 days to export customer personal data; after that we delete it, except where the law requires us to keep it. Copies in backups are removed as backups roll over within 14 days.

13. Liability and term

Each party's liability under this DPA is subject to the limitation of liability in the Terms of service, except where data protection laws do not allow it to be limited.

This DPA remains in effect for as long as we process customer personal data on the customer's behalf.

Annex 1: Description of processing

Data subjects: the customer's shoppers; the customer's team members.

Types of personal data: conversation content; shopper identifiers the customer passes to us (such as a member ID, nickname or email); conversation language and inferred country; ratings; products, quantities, quotes and order numbers in AI-assisted ordering; team members' names, emails and activity records. Unless the Service expressly supports it, customers should not submit sensitive personal data such as health information, government ID numbers or payment card numbers.

Nature of processing: storage, retrieval, embedding, answer generation and translation by language models, forwarding to the customer's systems and agents, and statistics.

Purpose: providing the AI customer service to the customer.

Duration and frequency: continuous for the term of the Service, then deletion under section 12.

Annex 2: Technical and organisational measures

Encryption: HTTPS (TLS 1.2 or higher) for all traffic; passwords and API keys stored only as hashes; channel and signing secrets stored encrypted.

Access control: role-based permissions and least privilege; platform administrators sign in with a password plus two-factor authentication; access to customer conversations is audit-logged.

Tenant isolation: all data is separated by customer, and every access checks which customer it belongs to.

Network and hosts: servers expose only necessary ports behind a firewall; operating systems and dependencies receive security updates promptly.

Availability: daily database backups kept for 14 days; monitoring and alerting for services and errors.

People: staff are bound by confidentiality and given access according to their role.