Data Processing Agreement

1. Parties, roles and priority

This DPA forms part of a merchant service order that expressly incorporates it. The merchant legal entity identified in that order is the controller for the instructed processing and CoreCharge Cloud (Shenzhen) AI Technology Co., Ltd. is the processor. If the merchant is itself a processor, its authority and the corresponding subprocessor role must be recorded before activation. Publication or ordinary login is not execution of a new agreement.

The DPA applies to instructed customer data and prevails over inconsistent service wording for that processing. It does not reclassify independently controlled business contacts, billing or legally required records. Mandatory law and applicable approved transfer clauses retain priority.

2. Documented instructions and confidentiality

The processor shall process covered data only on documented lawful instructions, including the completed service scope and approved transfer instructions, unless required otherwise by applicable law. Where permitted, it shall inform the merchant of that requirement. It shall notify the merchant if an instruction appears to conflict with applicable data protection law.

People authorized to process covered data shall be subject to confidentiality duties and access limited to their role. Covered data shall not be used for the processor’s unrelated advertising or sold as a dataset.

3. Security and incident assistance

The standard controls in Schedule B apply to this service. Additional controls agreed in the signed order are maintained for that project. Measures are assessed against data types and risks; material reductions require prior notice and lawful resolution.

The processor shall notify the merchant without undue delay after becoming aware of a personal data breach affecting covered data, provide available relevant facts and updates, support containment and preserve necessary evidence. This does not substitute for the controller’s own assessment and legally required notifications. The contract must provide working incident contacts.

4. Subprocessors

Schedule C shall list authorized subprocessors, functions and countries. The processor shall bind them to appropriate data-protection obligations, remain responsible for their performance within the agreed scope and provide evidence of the authorization arrangement.

Change process: give at least 30 days’ notice of a planned new subprocessor, with a channel for a substantiated data-protection objection and a documented resolution. Urgent substitutions need a separately agreed process and prompt notice; an unresolved objection is handled through an agreed alternative or termination of the affected service.

5. Rights, assessment and assurance

The processor shall promptly forward requests about covered data to the merchant and assist it using agreed reasonable procedures. It shall not independently decide a controller’s customer request unless authorized or legally required. The parties shall agree assistance for impact assessments, regulator consultations and incident reporting where relevant.

The processor shall make information reasonably necessary to demonstrate its obligations available and support agreed audits, subject to safeguards for confidentiality, service availability and other tenants. The agreement shall set the audit process and allocation of reasonable costs without removing legally required oversight.

6. International transfers

Schedule C must identify production, backup and support-access countries and the entities involved. Where a restricted transfer requires safeguards, the parties shall select and execute the applicable lawful mechanism and complete its annexes before the transfer.

This DPA does not reproduce or purport to replace approved EU, UK or ANPD standard clauses. Any required official text, modules, assessments and supplementary measures must be attached or identified separately for the actual transfer. A server location alone is not a transfer mechanism.

7. Return, deletion and retention

On termination, the processor shall return or delete covered data according to the merchant’s documented choice and the approved service exit schedule, unless applicable law requires specified retention. It shall record the completion and any remaining justified exception.

Backup expiry, restoration handling, authorized export, deletion verification and statutory records must be defined in Schedule D. Restored data must remain subject to outstanding deletion instructions. Data held solely for a legal requirement shall be isolated from ordinary processing and retained only as necessary.

Standard processing schedules

Related documents

• Merchant SaaS Terms
• Privacy Policy
• Website Terms of Use