Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Master Subscription Agreement or other agreement (the “Agreement”) between Front End Engineering Consultancy Limited, a private company limited by shares incorporated in Hong Kong (Business Registration No. 75797664), with its registered office at Unit B6, 12th Floor, Wing Wah Building, No. 677 King’s Road, Quarry Bay, Hong Kong (“FEEC”), and the customer named in the Agreement (“Customer”). It applies when FEEC processes Customer Personal Data in providing the Service.

1. Definitions

1.1 Capitalised terms not defined here have the meaning given in the Agreement.

1.2 In this DPA:

• “Data Protection Laws” means all laws on privacy and personal data that apply to the processing under this DPA, which may include: Regulation (EU) 2016/679 (“EU GDPR”); the EU GDPR as retained in UK law and the Data Protection Act 2018 (“UK GDPR”); the Swiss Federal Act on Data Protection; Thailand’s Personal Data Protection Act B.E. 2562 (2019) and its subordinate regulations (“Thai PDPA”); Hong Kong’s Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”); Singapore’s Personal Data Protection Act 2012 (“Singapore PDPA”); Australia’s Privacy Act 1988 (Cth); and US state privacy laws, in each case as amended.
• “Personal Data” means any information relating to an identified or identifiable natural person, or information defined as “personal data” or “personal information” under Data Protection Laws.
• “Customer Personal Data” means Personal Data in Customer Data that FEEC processes on Customer’s behalf in providing the Service or Professional Services.
• “Controller”, “Processor”, “Data Subject”, “Processing” and “Supervisory Authority” have the meanings given in the EU GDPR. They include equivalent terms under other Data Protection Laws, such as “data controller” and “data processor” under the Thai PDPA and PDPO, and “organisation” and “data intermediary” under the Singapore PDPA.
• “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data transmitted, stored or otherwise processed by FEEC or its Sub-processors.
• “Sub-processor” means a third party FEEC engages to process Customer Personal Data.
• “EU SCCs” means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
• “UK Addendum” means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (version B1.0, in force 21 March 2022), as amended.
• “Restricted Transfer” means a transfer of Customer Personal Data to a country or recipient that requires additional safeguards under Data Protection Laws.

2. Roles and scope

2.1 Roles. For Customer Personal Data, Customer is the Controller (or a Processor acting for its own customer or affiliate, who is the Controller) and FEEC is the Processor (or Sub-processor). FEEC is a Controller only for the Personal Data it processes for its own purposes, such as account administration, billing, security logging and its website, as described in FEEC’s Privacy Policy. This DPA does not apply to that processing.

2.2 Details of processing. Annex 1 describes the subject matter, duration, nature and purpose of processing, and the categories of Personal Data and Data Subjects.

2.3 Self-hosted deployments. Where Customer runs the Software under a Self-Hosted Licence, FEEC does not process Customer Personal Data except when FEEC personnel access Customer’s environment or receive data (for example in a support ticket) with Customer’s permission. This DPA applies only to that processing.

2.4 Customer obligations. Customer: (a) is responsible for the lawfulness of the Customer Personal Data and its instructions, including having a legal basis and giving any notices and obtaining any consents needed (for example to employees who use the mobile app to capture photos and location); (b) will not submit special categories of Personal Data, sensitive personal data, government identification numbers, financial account data or data about children, unless the parties agree otherwise in writing; the Service is not designed for such data; and (c) where Customer is a Processor, confirms that its Controller has authorised its instructions and FEEC’s engagement.

3. FEEC’s obligations as Processor

3.1 Instructions. FEEC will process Customer Personal Data only on Customer’s documented instructions, including for transfers to third countries, unless required to do otherwise by law that applies to FEEC. In that case FEEC will inform Customer before processing, unless the law prohibits it on important grounds of public interest. The Agreement, this DPA, the Order Form and Customer’s use and configuration of the Service are Customer’s complete documented instructions. Additional instructions must be agreed in writing and may be charged for. FEEC will inform Customer if, in its opinion, an instruction infringes Data Protection Laws, but FEEC is not obliged to perform a legal review of Customer’s instructions.

3.2 Confidentiality. FEEC will ensure that persons it authorises to process Customer Personal Data are bound by written confidentiality obligations or an appropriate statutory duty of confidentiality, and receive appropriate data protection training.

3.3 Security. FEEC will implement and maintain the technical and organisational measures in Annex 2, which are designed to ensure a level of security appropriate to the risk, as required by Article 32 of the EU GDPR, section 40(2) of the Thai PDPA, Data Protection Principle 4 of the PDPO and section 24 of the Singapore PDPA. FEEC may update the measures, provided that the overall level of security is not materially reduced.

3.4 Access within FEEC. FEEC personnel do not access Customer Personal Data through the application except through time-limited support access that Customer approves (which is recorded in Customer’s audit log), or while performing Professional Services Customer has requested. A limited number of authorised FEEC administrators have infrastructure-level access to servers, databases and backups, and use it only to operate, maintain and secure the Service, restore data, respond to incidents or comply with law.

3.5 No other use. FEEC will not sell Customer Personal Data, will not “share” it for cross-context behavioural advertising, and will not retain, use or disclose it outside the direct business relationship with Customer or for any purpose other than providing the Service, except as permitted by Data Protection Laws. Where the California Consumer Privacy Act applies, FEEC acts as a “service provider” and certifies that it understands and will comply with these restrictions.

4. Sub-processors

4.1 General authorisation. Customer gives FEEC general authorisation to engage Sub-processors. The Sub-processors in use at the date of the Agreement are listed at emitledger.com/legal/subprocessors (Annex 3), and Customer approves them.

4.2 Sub-processor obligations. FEEC will enter into a written agreement with each Sub-processor that imposes data protection obligations that provide at least the same level of protection as this DPA, to the extent applicable to the service the Sub-processor provides. FEEC remains responsible to Customer for the performance of its Sub-processors’ obligations.

4.3 Notice of changes. FEEC will give at least 30 days’ notice before a new Sub-processor starts processing Customer Personal Data, by updating the sub-processor page and emailing Customer’s administrators or subscribers to sub-processor updates. In an emergency (for example to maintain security or availability following the failure of a Sub-processor) FEEC may give a shorter notice, and will give notice as soon as practicable.

4.4 Objection. Customer may object to a new Sub-processor on reasonable data-protection grounds by writing to privacy [at] emitledger.com within the notice period. The parties will discuss the objection in good faith. FEEC may offer an alternative, such as not using the Sub-processor for Customer’s data or a different Hosting Option. If the parties cannot resolve the objection within 30 days after it is received, Customer may terminate the affected part of the Service by written notice, and FEEC will refund prepaid Fees for the period after termination. This is Customer’s sole and exclusive remedy for an objection. If Customer does not object within the notice period, the Sub-processor is deemed approved.

5. Assistance

5.1 Data Subject requests. Taking into account the nature of the processing, FEEC will assist Customer by appropriate technical and organisational measures in responding to requests from Data Subjects to exercise their rights. The Service lets Customer’s administrators view, correct, export and delete users and records. If FEEC receives a request directly from a Data Subject that relates to Customer Personal Data, FEEC will forward it to Customer without undue delay and will not respond to it except to direct the Data Subject to Customer, unless required by law.

5.2 Other assistance. Taking into account the nature of the processing and the information available to FEEC, FEEC will provide reasonable assistance to Customer with data protection impact assessments, prior consultations with Supervisory Authorities, and Customer’s security obligations, where Customer cannot reasonably meet them using the Service, the Documentation and the information in this DPA.

5.3 Costs. Assistance that goes beyond the Service’s self-service features and FEEC’s standard documentation may be charged at FEEC’s then-current rates, unless the assistance is needed because of FEEC’s breach of this DPA.

6. Personal Data Breaches

6.1 Notification. FEEC will notify Customer of a Personal Data Breach without undue delay, and in any event within 48 hours after FEEC confirms it. Notice will be sent to Customer’s administrators’ email addresses (and any security contact Customer registers).

6.2 Content. The notice will include, as far as the information is then available: a description of the nature of the breach, the categories and approximate number of Data Subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects; and a contact point at FEEC (security [at] emitledger.com). Where not all information is available at once, FEEC will provide it in phases without undue further delay.

6.3 Response. FEEC will take reasonable steps to contain, investigate and remedy the breach, and will provide reasonable cooperation to help Customer meet its own obligations to notify Supervisory Authorities and Data Subjects (including the 72-hour notice to the Thai PDPC and EU/UK authorities where required).

6.4 No admission. FEEC’s notice of or response to a Personal Data Breach is not an acknowledgement of fault or liability.

6.5 Unsuccessful attempts. Unsuccessful attempts or activities that do not compromise the security of Customer Personal Data (such as pings, port scans, blocked login attempts or denial-of-service attacks that do not result in access to data) are not Personal Data Breaches and do not require notice.

7. Audits and information

7.1 Documentation first. On Customer’s written request (no more than once a year, unless required by a Supervisory Authority or following a Personal Data Breach), FEEC will make available information reasonably necessary to demonstrate its compliance with this DPA. This may include completing Customer’s reasonable security questionnaire, a written description of its security controls, summaries of penetration test results once available, and relevant certifications or reports of its Sub-processors. FEEC does not currently hold ISO/IEC 27001 certification or a SOC 2 report.

7.2 On-site audits. If the information in clause 7.1 is not reasonably sufficient to demonstrate compliance, Customer (or an independent auditor it appoints who is not a competitor of FEEC and is bound by confidentiality) may carry out an audit, provided that: (a) Customer gives at least 30 days’ written notice with a proposed scope; (b) the audit takes place no more than once in any 12-month period, during FEEC’s Business Hours (as defined in the SLA), and does not last more than 2 business days; (c) the parties agree the scope, timing and methodology in advance; (d) the audit does not give access to other customers’ data, to FEEC’s commercially sensitive information unrelated to Customer, or to Sub-processors’ facilities (for which FEEC will provide the Sub-processor’s own audit reports or certifications where available); (e) the audit does not unreasonably disrupt FEEC’s operations or compromise the security of the Service; and (f) Customer bears all costs of the audit, and pays FEEC for the time of its personnel at FEEC’s then-current rates, unless the audit reveals a material breach of this DPA by FEEC.

7.3 Findings. Customer will give FEEC a copy of any audit report, which is FEEC’s Confidential Information. FEEC will address any material non-compliance it confirms within a reasonable time.

7.4 SCCs. The parties agree that audits under the EU SCCs are carried out in accordance with this clause 7.

8. Return and deletion

8.1 During the Subscription Term, Customer can export and delete Customer Personal Data using the Service.

8.2 At the end of the Agreement, FEEC will make Customer Data available for export and delete it as described in clause 14 of the Agreement: an export on request during the 30-day Retrieval Period, deletion from the live environment within 30 days after the Retrieval Period, and deletion from encrypted backups as they rotate out under FEEC’s backup retention schedule (currently up to 12 months). FEEC will not restore or use Customer Personal Data from backups after deletion, except to recover from a disaster, in which case it will delete it again promptly.

8.3 FEEC may keep Customer Personal Data where required by law, and will continue to protect it under this DPA and not process it for any other purpose.

8.4 On Customer’s written request, FEEC will confirm deletion in writing. For the purposes of Clause 8.5 and Clause 16(d) of the EU SCCs, this clause 8 applies.

9. International transfers

9.1 Locations. FEEC processes Customer Personal Data in the locations described in Annex 1 and on the sub-processor page. For the Shared Cloud, the live Service is hosted in Germany, and encrypted backups are stored in the European Union (Cloudflare R2, EU jurisdiction) and on the hosting server in Germany. For Dedicated Hosting, the hosting region is stated in the Order Form.

9.2 EU transfers. To the extent that FEEC’s processing of Customer Personal Data involves a Restricted Transfer from the European Economic Area (including because FEEC, as a Hong Kong company, is established outside the EEA), the EU SCCs are incorporated into this DPA by reference and apply as follows: (a) Module Two (controller to processor) applies where Customer is a Controller, and Module Three (processor to processor) applies where Customer is a Processor; (b) Customer is the “data exporter” and FEEC is the “data importer”; (c) Clause 7 (docking clause) applies; (d) Clause 9(a): Option 2 (general written authorisation) applies, with the notice period in clause 4.3 of this DPA; (e) Clause 11(a): the optional language does not apply; (f) Clause 13: the competent Supervisory Authority is the authority determined in accordance with Clause 13(a) of the EU SCCs; (g) Clause 17: Option 1, the law of the EU Member State in which Customer is established or, if Customer is not established in the EU, Ireland; (h) Clause 18(b): the courts of that Member State; and (i) Annexes I and II of the EU SCCs are completed by Annexes 1 and 2 of this DPA, and Annex III by Annex 3.

9.3 UK transfers. For Restricted Transfers subject to the UK GDPR, the UK Addendum is incorporated by reference. Table 1 is completed with the parties’ details in the Agreement; Table 2 selects the modules and options in clause 9.2; Table 3 is completed by Annexes 1 to 3; and in Table 4 either party may end the UK Addendum as set out in its Section 19.

9.4 Swiss transfers. For transfers subject to the Swiss Federal Act on Data Protection, the EU SCCs apply as set out in clause 9.2, with references to the GDPR read as references to that Act, the Swiss Federal Data Protection and Information Commissioner as the competent authority, and “Member State” interpreted to allow Data Subjects in Switzerland to bring claims in Switzerland.

9.5 Thailand. For transfers of Customer Personal Data subject to the Thai PDPA to a country that the Thai Personal Data Protection Committee has not recognised as having adequate standards, FEEC will ensure appropriate safeguards under sections 28 and 29 of the Thai PDPA and its subordinate notifications, which may include the standard contractual clauses recognised by the Committee.

9.6 Hong Kong, Singapore and Australia. FEEC will: (a) use contractual or other means to protect Customer Personal Data transferred to Sub-processors, as required by Data Protection Principles 2(3) and 4(2) of the PDPO; (b) provide a standard of protection comparable to the Singapore PDPA for transfers subject to section 26 of that Act; and (c) take reasonable steps so that overseas recipients do not breach the Australian Privacy Principles, for transfers subject to APP 8.

9.7 Conflict. If the EU SCCs or UK Addendum conflict with this DPA or the Agreement, the EU SCCs or UK Addendum prevail to the extent of the conflict.

9.8 Government access requests. If FEEC receives a legally binding request from a public authority for Customer Personal Data, FEEC will (unless legally prohibited) notify Customer promptly, review the legality of the request, challenge it where there are reasonable grounds, and disclose only the minimum required.

10. Liability

10.1 Each party’s liability arising out of or relating to this DPA (including the EU SCCs and UK Addendum, to the extent permitted by them) is subject to the exclusions and limitations of liability in the Agreement, and counts towards the same aggregate cap. Nothing in this clause limits either party’s liability to Data Subjects under the EU SCCs or Data Protection Laws where such limitation is not permitted.

11. Term and general

11.1 This DPA lasts as long as FEEC processes Customer Personal Data under the Agreement.

11.2 FEEC may update this DPA to reflect changes in Data Protection Laws, guidance or approved transfer mechanisms, by giving notice under the Agreement. An update will not reduce the overall protection of Customer Personal Data.

11.3 The governing law and dispute resolution provisions of the Agreement apply to this DPA, except where the EU SCCs or UK Addendum require otherwise.

11.4 If any provision of this DPA is invalid, the rest remains in effect.

Annex 1 — Description of processing

Annex 2 — Technical and organisational security measures

FEEC does not hold ISO/IEC 27001 certification or a SOC 2 report. The measures below describe the controls FEEC maintains for the Shared Cloud and FEEC-operated Dedicated Hosting. Items marked (planned) are not yet in place.

A. Tenant isolation

1. Each customer is a separate tenant. Every table holding customer data carries a tenant identifier, and PostgreSQL row-level security is enabled and forced on each of them, so the database refuses rows from other tenants even if application code is faulty.
2. The application runtime database role cannot bypass row-level security. Platform administration uses a separate database role with no access to tenant data tables.
3. References between customer tables include the tenant identifier, so records cannot point to another tenant’s records.
4. An automated cross-tenant leakage test suite covers every API route and table, and the build fails if a new route or table lacks an isolation test.
5. Access within a tenant can be restricted by role and by country or asset scope, enforced in database queries.

B. Identity and access control

1. Authentication via OpenID Connect with PKCE through a self-hosted Keycloak identity service, with brute-force detection. Self-registration is disabled.
2. Multi-factor authentication (a time-based one-time password) is required for every user: each new account must set it up at first sign-in, and it is also required for FEEC administrators of the identity service.
3. Role-based access control with least privilege (client admin, methodology owner, data provider, reviewer, country manager, executive viewer, external verifier). Only client administrators manage members, and the last administrator cannot be removed.
4. FEEC support access to a tenant requires Customer approval, is time-limited, is read-only and is recorded in the tenant’s audit log.
5. Infrastructure access is limited to named FEEC administrators, using SSH keys only (no passwords), with access reviewed periodically.
6. Web session tokens are held in browser session storage and expire; mobile tokens are stored in the device keychain or keystore and revoked at sign-out.

C. Encryption

1. All traffic between users and the Service is encrypted in transit with TLS, with HTTPS enforced and HSTS enabled. Traffic passes through Cloudflare’s network (see the sub-processor list), which terminates TLS at its edge and re-encrypts it to the hosting server with a validated certificate (Let’s Encrypt).
2. Backups are encrypted client-side before leaving the server (restic, AES-256), and are transported over TLS.
3. Secrets are kept out of source control and stored on servers with restrictive file permissions.
4. The production server volumes are not encrypted at rest at the volume level. Customer Data on them is protected by the access controls in section B and the hosting provider’s physical security, and every copy that leaves the server (backups) is encrypted as described in point 2.

D. Logging and monitoring

1. An append-only audit log per tenant records creation, changes, submissions, approvals, locks, reopenings, restatements, imports, calculation runs, exports and support access, with before/after values. The runtime role can insert and read, but not change or delete, audit entries.
2. Platform administration actions are recorded in a separate platform audit log.
3. Application logs are structured and exclude activity values, file contents and tokens. Logs are rotated.
4. Availability monitoring and backup-job alerting.

E. Application and infrastructure security

1. The application is developed against the OWASP Application Security Verification Standard (ASVS) Level 2.
2. Hardened Linux hosts: firewall limited to web and SSH ports, intrusion blocking, automatic security updates.
3. Containers run as non-root users.
4. Dependencies and container images are scanned for known vulnerabilities in continuous integration, together with secret scanning.
5. Uploaded spreadsheets are parsed in a background worker; macros are never executed; macro-enabled content, ActiveX, embedded objects and external links are rejected; size, row-count and compression-ratio limits and XML entity-expansion protection apply. File types are detected from content, and executables are refused.
6. Independent penetration test before the first paying customer and annually after that (planned).
7. Vulnerability disclosure channel: security [at] emitledger.com and a published security.txt.

F. Availability, backup and recovery

1. Nightly encrypted backups of the database and stored files to off-site object storage in the European Union, with deletion protection (bucket lock) so that recent backups cannot be deleted for 30 days, even from the production server.
2. A second encrypted copy on the hosting server for fast restores.
3. Retention: off-site, daily backups for 35 days and monthly backups for 12 months; on the server, 7 daily and 4 weekly backups.
4. Weekly backup integrity checks and a monthly automated restore test.
5. A documented full-restore procedure, with a recovery point objective of 24 hours.

G. Organisational measures

1. A lightweight information security management system (policies, risk register, access reviews).
2. Confidentiality obligations for all personnel and contractors with access to customer data, and security and privacy awareness training.
3. Incident response procedure covering detection, containment, assessment, notification (clause 6), remediation and lessons learned.
4. Sub-processor due diligence and written data protection terms.
5. Change management: all deployments use the same versioned software and database migrations across tiers, and code changes go through automated tests and review before release.

Annex 3 — Sub-processors

The current list, including each Sub-processor’s purpose, data processed, location and transfer safeguards, is published at emitledger.com/legal/subprocessors and is incorporated into this DPA by reference.