Data Processing Addendum (DPA)

1. Purpose and scope

This addendum applies when the Controller entrusts the Processor with processing personal data through the service, and forms part of the terms of service and the service agreement.

On matters of data protection, this addendum prevails over the service agreement.

2. Details of processing (Annex I)

3. Processor obligations

• Process only on the Controller's documented instructions (service agreement, service settings, administrator actions) and inform the Controller immediately if an instruction appears to infringe the law (Art. 28(3)(a)).
• Bind persons authorised to process to confidentiality ((b)).
• Implement the technical and organisational measures in Annex II (Art. 32, (c)).
• Provide features (personal data export, request queue, erasure execution) and assistance so the Controller can respond to data subject requests ((e)).
• Assist with security, breach notification, impact assessments and prior consultation (Art. 32–36, (f)).
• At the end of the agreement, return and delete data at the Controller's choice; where the law requires retention, keep it separately for that period ((g)).
• Make available information demonstrating compliance with this addendum and cooperate with audits after reasonable notice (written questionnaires and third-party certification reports first) ((h)).
• No processing beyond the purpose, restrictions on further outsourcing, acceptance of supervision, and liability for damages (PIPA Art. 26(1), Enforcement Decree Art. 28).

4. Sub-processors

The Controller gives general authorisation for the sub-processors in Annex III. The Processor gives 30 days' notice before adding or replacing a sub-processor, and the Controller may object on reasonable grounds (Art. 28(2) and (4)). Sub-processors are bound by contract to obligations at the same level as this addendum.

5. International transfers

Transfers of EU/EEA personal data to the Republic of Korea rely on Commission adequacy decision (EU) 2022/254. Transfers to third countries where sub-processors are located rely on an adequacy decision (such as the EU-U.S. DPF) or on the Standard Contractual Clauses (SCC, (EU) 2021/914 — Module 3: processor to processor) with supplementary measures.

6. Personal data breach notification

The Processor notifies the Controller without undue delay after becoming aware of a breach (target: within 24 hours) and provides, as far as known, the nature and scope, affected data subjects and data categories, likely consequences and measures taken, so the Controller can report within 72 hours (GDPR Art. 33, PIPA Art. 34).

7. Technical and organisational measures (Annex II)

• Encryption in transit (TLS 1.2 or later); secrets and access tokens encrypted at rest (AES-256-GCM, keys in a cloud key vault)
• Per-tenant data separation (database row-level security), role-based access control, least privilege
• Tamper-evident audit records (hash chain) — e-mail addresses, phone numbers and similar values masked before writing
• Only the minimum data a request needs is sent to AI model providers; resident registration numbers and similar data masked before upload and indexing
• Backup and recovery, observability, vulnerability checks
• Training and confidentiality undertakings for staff handling personal data

8. List of sub-processors (Annex III)

The table in section 16-4 (Recipients and sub-processors) of the privacy policy is the current list.

9. Term and effect

This addendum takes effect and ends together with the service agreement. Obligations to return and delete data and to keep confidentiality survive termination.