Data Processing Agreement

This Data Processing Agreement ("DPA") applies where PATTRANS COMPANY LIMITED (Tax code 0111399245), Unit 0315, C2 Building, 119 Tran Duy Hung Street, Yen Hoa Ward, Hanoi, Vietnam ("Pattrans", "processor") processes personal data on behalf of a customer using the Service in the course of a trade, profession or organisation ("you", "Customer", "controller") — regardless of whether you are incorporated. It forms part of, and is subject to, our Terms of Service, and takes effect when you accept the Terms or begin using the Service for such purposes; your account and the applicable Terms and DPA versions form the record of acceptance. For personal data processed on your instructions, this DPA prevails over the Terms and the Privacy Policy in the event of conflict. "Customer Content" means the documents, text, terminology and My Termbase entries you submit to or store in the Service, the Output, and any intermediate representations of that material created solely to provide the Service. It does not include account, billing, project metadata (including project names or folder labels), security or service-telemetry data, even where such metadata is supplied by you or reflects a document title; however, any document text, terminology, My Termbase content, Output or intermediate representation embedded in those records remains Customer Content.

1. Roles and scope

For the personal data in Customer Content, you act as the controller (or as processor for a further controller) and Pattrans acts as your processor. To the extent Pattrans processes that personal data to produce results for you, operate or secure the Service in connection with your use, provide support you request, or (on your instructions) evaluate results for you, Pattrans acts as your processor. Pattrans does not independently determine a cross-customer improvement purpose for that personal data. Pattrans is an independent controller for account, billing, security and legal-compliance data, governed by the Privacy Policy, not this DPA.

2. Details of the processing

• Subject matter — machine translation of the documents you submit, and support for that Service.
• Duration — for the term of your use of the Service, subject to §9.
• Nature and purpose — performing the machine-translation workflow requested by the Customer. For that purpose, Pattrans receives, stores and, where needed, transmits Customer Content to sub-processors; translates and formats documents; checks processing faults; stores and applies terminology and My Termbase entries; creates and processes intermediate representations; returns Output; and deletes Customer Content in accordance with §9. Document processing is job-by-job; stored terminology and My Termbase entries may be processed on an ongoing basis for the term.
• Types of personal data — any personal data you include in Customer Content, which may include identifiers and other personal data and may occasionally contain sensitive personal data.
• Categories of data subjects — individuals referenced in your documents, such as inventors, applicants, employees or other third parties.
• Regions, retention, sensitive-data handling and sub-processor categories — described in the Privacy Policy and available in more detail on request.

3. Your instructions and warranties

Pattrans processes Customer Content only on your documented instructions — the Terms, the Privacy Policy, this DPA and your use and configuration of the Service — except where required by law, in which case we will inform you unless the law prohibits it. If Pattrans reasonably believes an instruction violates applicable personal-data law, it will notify you and may suspend the affected processing until the instruction is amended or its legality is established. You warrant that you have an applicable lawful condition and authority to submit or store the documents, text, terminology and My Termbase entries you provide to the Service, including any third-party or sensitive personal data, and to give these instructions; where you act as processor for a further controller, you warrant that controller has established the lawful condition and authorised you to appoint Pattrans and issue these instructions. You are responsible for the accuracy and lawfulness of the documents, text, terminology and My Termbase entries you provide to the Service.

4. Our obligations

Pattrans will: process Customer Content only as in §2 and on your instructions; ensure authorised personnel are bound by confidentiality; apply technical and organisational measures appropriate to the nature, scale and risks of the processing — including encryption in transit and, for server-stored Customer Content, at rest; least-privilege access controls; logical separation between customer accounts; authentication and access logging; monitoring and incident response; secure deletion; personnel confidentiality; sub-processor due diligence; and periodic security and compliance review — without materially reducing the overall level of protection when updating them; treat Customer Content as confidential and not disclose it to third parties except sub-processors under §5 or where required by law; taking into account the nature of the processing and the information available to us, assist you to respond to data-subject requests (including access, correction, deletion, restriction, objection, consent withdrawal, provision of data and complaints) and to meet your security, breach-notification and impact-assessment obligations, and support the technical operation of consent withdrawal, suppression and deletion; and make available information reasonably necessary to demonstrate compliance (§8). Pattrans will not respond substantively to a data-subject request concerning Customer Content except on your instructions or where required by law. Pattrans does not use Customer Content to train or fine-tune general-purpose AI models, or for any cross-customer improvement purpose, and imposes the same restrictions on its sub-processors under §5.

5. Sub-processors

You give general authorisation for Pattrans to engage sub-processors in the categories described in the Privacy Policy. Pattrans imposes on each sub-processor, by written contract, data-protection obligations that are substantially equivalent to the obligations applicable to Pattrans under this DPA and appropriate to the sub-processor's processing — including purpose and instruction limitations, confidentiality, security, breach notification, assistance with data-subject rights, deletion or return, restrictions on onward transfers, and provision of relevant compliance information — and remains responsible to the Customer for the sub-processor's performance of those obligations. Pattrans discloses current sub-processor identities on request and gives you reasonable advance notice of any new sub-processor that will process Customer Content (excluding tools with no access to Customer Content). You may object on reasonable data-protection grounds; we will work with you in good faith and, failing resolution, you may stop using the affected feature or terminate the affected Service. Any unused paid Standard Words remain governed by the Terms and Refund Policy; termination following a reasonable objection does not itself cancel, forfeit or make those Standard Words exchangeable for cash.

6. Cross-border transfer

Customer Content may be processed outside Vietnam by our sub-processors. Pattrans will prepare, maintain, submit and update the personal-data-processing and cross-border-transfer impact-assessment dossiers required of Pattrans for processing and transfers it arranges, and applies appropriate contractual and security safeguards. The Customer remains responsible for any assessment, filing or other obligation applicable to it as controller or transferor; taking into account the nature of the processing and the information available to Pattrans, Pattrans will provide information reasonably necessary to assist the Customer with those obligations. You will provide the information about purpose, data subjects and lawful condition reasonably needed for Pattrans's assessments, and are responsible for any transfer you direct outside our standard configuration. Pattrans notifies you of a material change to processing destinations. Current processing regions are available on request.

7. Personal-data breach

Pattrans will notify you without undue delay after becoming aware that a personal-data breach affecting Customer Content has occurred. Where reasonably practicable, Pattrans will provide the initial notice within 72 hours after becoming aware of the breach, without waiting for the investigation to be completed; information not yet available may be provided in stages. The notice will include, so far as known: the nature of the breach; the categories and approximate number of data subjects and records; likely consequences; measures taken or proposed; any affected sub-processor and country; a contact point; and timing. This helps you meet your own notification obligations, including to the competent authority and affected individuals where required by law.

8. Audit and information

Pattrans will make available information reasonably necessary to demonstrate compliance, ordinarily through available security and compliance documentation, relevant policies or summaries, responses to a reasonable questionnaire, and any certifications or independent reports that Pattrans then holds. Where the information provided under this section is reasonably insufficient, or following a breach or identified material risk affecting the Customer, the Customer may request an additional audit. The parties will first seek to address the request through documents, written questions or a remote review. Any further inspection must be reasonably necessary and proportionate, conducted by the Customer or an independent auditor bound by confidentiality, on reasonable prior notice during business hours, and scoped to the processing under this DPA; it must not compromise the security, source code, trade secrets or data of other customers. Except where required by a competent authority or justified by a breach attributable to Pattrans, the Customer bears its own audit costs and any reasonable exceptional costs incurred by Pattrans.

9. Return and deletion

During the term, the Customer may use the Service's available functions to export or delete Customer Content made available through those functions, subject to processing already required to complete an active job and to applicable law. On expiry or termination of the affected Service, the Customer may export available Customer Content before account closure; Pattrans will then delete the remaining Customer Content from active systems, or, at the Customer's request before deletion, provide a copy of Customer Content then available to the Customer through the Service, within the periods stated in the Privacy Policy. Residual backup and security-log copies will be deleted under their ordinary cycles, and Pattrans will require its sub-processors to delete or return the data as applicable — except to the extent Pattrans is required by law to retain it, in which case it continues to protect it and process it only as required. Pattrans will provide written confirmation of deletion on reasonable request.

10. Liability, third-party rights and precedence

This DPA is subject to the Terms of Service, including the limitation of liability and the non-excludable liabilities and data/confidentiality carve-outs in Terms §11.3. It forms part of the agreement between you and Pattrans and does not create contractual third-party-beneficiary rights, without limiting any statutory rights of data subjects. If it conflicts with the Terms or Privacy Policy regarding personal data processed on your instructions, this DPA prevails.

11. Changes and governing law

Pattrans may update this DPA to reflect changes in law or the Service; material changes will be notified and will not materially reduce data-protection obligations for existing processing. You may object to a material adverse change and terminate the affected Service if no reasonable resolution is available. This DPA is governed by the laws of Vietnam. This DPA takes effect as stated above without requiring a separate signature; to request a signed copy, provide controller details, obtain the confidential sub-processor information, or discuss additional documented instructions, contact [email protected].