Data Processing Addendum

Roles and instructions

For customer-controlled personal data, the customer acts as controller or processor and Taicho acts as processor or subprocessor. Taicho processes only documented instructions in the agreement, product configuration, and support requests unless law requires otherwise.

People, security, and incidents

• Personnel access is need-based, confidential, authenticated, and auditable.
• Technical measures include tenant isolation, least-privilege roles, protected credentials, encryption in transit, signed ingress, bounded egress, backups, and privacy-filtered observability.
• Taicho will notify the contractual contact of a confirmed personal-data breach without undue delay and provide available facts, mitigation, and updates.

Subprocessors and transfers

Approved subprocessors are bound by data-protection obligations appropriate to their services. Transfer mechanisms, hosting regions, notice periods, and objection rights must be completed in the signed DPA for the launch markets.

Assistance and end of service

Taking into account the nature of processing, Taicho will reasonably assist with data-subject requests, security assessments, impact assessments, and regulator consultation.

At termination, Taicho will return or delete customer personal data according to the approved retention schedule, subject to legal holds and backup expiry.

Annexes requiring signature

• Parties, roles, term, nature and purpose of processing.
• Categories of data subjects and personal data, including sensitive-data restrictions.
• Approved subprocessors, locations, and transfer safeguards.
• Security measures, breach contacts, audit method, deletion periods, and customer instructions.

Contact

Legal notices: Legal contact pending legal approval. Privacy requests: Privacy contact pending legal approval.

Operator: Legal entity pending legal approval, Registered address pending legal approval.