Data Processing Agreement

This Data Processing Agreement ("DPA") applies where PATTRANS COMPANY LIMITED (Tax code 0111399245), Unit 0315, C2 Building, D' Capitale, 119 Tran Duy Hung Street, Yen Hoa Ward, Hanoi, Vietnam ("Pattrans", "processor") processes personal data on behalf of a customer using the Service in the course of a trade, profession or organisation ("you", "Customer", "controller") — regardless of whether you are incorporated. It forms part of, and is subject to, our Terms of Service, and takes effect when you accept the Terms or begin using the Service for such purposes; your account and the applicable Terms and DPA versions form the record of acceptance. For personal data processed on your instructions, this DPA prevails over the Terms and the Privacy Policy in the event of conflict. "Customer Content" means the files you submit and the Output.

1. Roles and scope

For the personal data in Customer Content, you act as the controller (or as processor for a further controller) and Pattrans acts as your processor. Where Pattrans independently determines a cross-customer improvement purpose, it acts as controller for that purpose; processing solely to produce, support, or (on your instructions) evaluate results for you remains processor activity. Pattrans is an independent controller for account, billing, security and legal-compliance data, governed by the Privacy Policy, not this DPA.

2. Details of the processing

• Subject matter — machine translation of the documents you submit, and support for that Service.
• Duration — for the term of your use of the Service, subject to §10.
• Nature and purpose — receiving, storing, transmitting to sub-processors, translating, formatting, fault-checking, returning and deleting Customer Content to produce your Output; processing is job-by-job and ongoing for the term.
• Types of personal data — any personal data you include in Customer Content, which may include identifiers and other personal data and may occasionally contain sensitive personal data.
• Categories of data subjects — individuals referenced in your documents, such as inventors, applicants, employees or other third parties.
• Regions, retention, sensitive-data handling and sub-processor categories — described in the Privacy Policy and available in more detail on request.

3. Your instructions and warranties

Pattrans processes Customer Content only on your documented instructions — the Terms, the Privacy Policy, this DPA and your use and configuration of the Service — except where required by law, in which case we will inform you unless the law prohibits it. If Pattrans reasonably believes an instruction violates applicable personal-data law, it will notify you and may suspend the affected processing until the instruction is amended or its legality is established. You warrant that you have an applicable lawful condition and authority to submit Customer Content, including any third-party or sensitive personal data, and to give these instructions; where you act as processor for a further controller, you warrant that controller has established the lawful condition and authorised you to appoint Pattrans and issue these instructions. You are responsible for the accuracy and lawfulness of Customer Content.

4. Our obligations

Pattrans will: process Customer Content only as in §2 and on your instructions; ensure authorised personnel are bound by confidentiality; apply the security measures in the Privacy Policy appropriate to the risk; treat Customer Content as confidential and not disclose it to third parties except sub-processors under §5 or where required by law; taking into account the nature of the processing and the information available to us, assist you to respond to data-subject requests (including access, correction, deletion, restriction, objection, consent withdrawal, provision of data and complaints) and to meet your security, breach-notification and impact-assessment obligations, and support the technical operation of consent withdrawal, suppression and deletion; and make available information reasonably necessary to demonstrate compliance (§9). Pattrans will not respond substantively to a data-subject request concerning Customer Content except on your instructions or where required by law.

5. Sub-processors

You give general authorisation for Pattrans to engage sub-processors in the categories described in the Privacy Policy. Pattrans imposes on each sub-processor, by contract, obligations no less protective than this DPA — including processing only on instructions, confidentiality, security, breach notification, assistance with data-subject rights, deletion or return, transfer restrictions, and provision of compliance information — and remains responsible for their performance. Pattrans discloses current sub-processor identities on request and gives you reasonable advance notice of any new sub-processor that will process Customer Content (excluding tools with no access to Customer Content). You may object on reasonable data-protection grounds; we will work with you in good faith and, failing resolution, you may stop using the affected feature or terminate the affected Service, and any unused paid Credits for the affected Service are handled under the Refund Policy without penalty for a reasonable objection.

6. Cross-border transfer

Customer Content may be processed outside Vietnam by our sub-processors. Pattrans prepares the required impact assessment and filing for transfers it arranges, and applies appropriate contractual and security safeguards; you provide the information about purpose, data subjects and lawful condition needed for those assessments, and are responsible for any transfer you direct outside our standard configuration. Pattrans notifies you of a material change to processing destinations. Current processing regions are available on request.

7. Optional quality improvement using identifiable content

By default, Pattrans does not use identifiable Customer Content to improve the Service for other customers; the quality-improvement option in the Privacy Policy excludes personal data. Any use of identifiable Customer Content (including any human review) for quality improvement requires a separate written addendum specifying the dataset, data subjects, lawful condition and evidence, human reviewers, sensitive-data handling, destinations, retention, deletion, purpose and security controls. Absent such an addendum, identifiable Customer Content is not used for cross-customer improvement. In all cases Pattrans keeps such material strictly internal, does not disclose it to third parties or other customers, and does not use it to train or fine-tune AI models.

8. Personal-data breach

Pattrans will notify you without undue delay after becoming aware of a personal-data breach affecting Customer Content and, where reasonably practicable, within 72 hours of confirming it, without waiting to complete its investigation; further information may follow in stages. The notice will include, so far as known: the nature of the breach; the categories and approximate number of data subjects and records; likely consequences; measures taken or proposed; any affected sub-processor and country; a contact point; and timing. This helps you meet your own notification obligations, including to the competent authority and affected individuals where required by law.

9. Audit and information

Pattrans will make available information reasonably necessary to demonstrate compliance, first by providing certifications, independent reports, security summaries or a completed questionnaire. Where these are insufficient, or following a breach or a specific risk, you or an auditor you mandate may conduct an audit or inspection, on reasonable prior notice, during business hours, no more than once a year unless required by a supervisory authority or following a breach, subject to confidentiality and to not compromising the security or data of other customers.

10. Return and deletion

On expiry or termination, or on your request, you may export Customer Content before closure; Pattrans will then delete or (at your choice) return it — active copies within the periods in the Privacy Policy, residual backup and log copies under their cycle, and it will instruct its sub-processors to delete or return it — except to the extent Pattrans is required by law to retain it, in which case it continues to protect it and process it only as required. Pattrans will provide written confirmation of deletion on reasonable request.

11. Liability, third-party rights and precedence

This DPA is subject to the Terms of Service, including the limitation of liability and the non-excludable liabilities and data/confidentiality carve-outs in Terms §11.3. It forms part of the agreement between you and Pattrans and does not create contractual third-party-beneficiary rights, without limiting any statutory rights of data subjects. If it conflicts with the Terms or Privacy Policy regarding personal data processed on your instructions, this DPA prevails.

12. Changes and governing law

Pattrans may update this DPA to reflect changes in law or the Service; material changes will be notified and will not materially reduce data-protection obligations for existing processing. You may object to a material adverse change and terminate the affected Service if no reasonable resolution is available. This DPA is governed by the laws of Vietnam. To put this DPA into effect for your organisation, contact support@pattrans.ai.