This Data Processing Agreement ("DPA") forms part of the Master Service Agreement between:

AR HANG SERVICE (HK) LIMITED ("Service Provider" / "Processor" where applicable); and [CLIENT FULL LEGAL NAME] ("Client" / "Controller" where applicable).

This DPA applies where the Service Provider processes Personal Data on behalf of the Client in connection with the Services.

1. Roles

1.1 Where the Service Provider processes Personal Data on behalf of the Client under the Client's instructions, the Service Provider is a Processor and the Client is a Controller.

1.2 Where the Service Provider processes Personal Data for its own recruitment, engagement, payroll, compliance or statutory purposes, the Service Provider acts as an independent controller or, where applicable, a separate controller.

1.3 If the Parties are joint controllers for a specific processing activity, they shall agree a separate joint controller arrangement.

2. Details of Processing

The processing details are set out in Annex 1 to this DPA.

3. Processor Obligations

The Service Provider shall:

3.1 process Personal Data only on documented instructions from the Client, unless required by Applicable Law;

3.2 ensure that persons authorised to process Personal Data have committed themselves to confidentiality;

3.3 implement appropriate technical and organisational security measures as described in Annex 2;

3.4 not engage sub-processors without prior general or specific written authorisation;

3.5 assist the Client with data subject rights requests, taking into account the nature of the processing;

3.6 assist the Client with security, breach notification, data protection impact assessments and regulator consultations, where required;

3.7 notify the Client without undue delay, and in any event within [48] hours after becoming aware of a confirmed Personal Data breach, where the breach concerns Client Personal Data;

3.8 at the Client's choice, delete or return Personal Data after termination, subject to legal retention requirements;

3.9 maintain records of processing activities to the extent required by Data Protection Laws.

4. Sub-processors

4.1 The Client grants general authorisation for the Service Provider to use sub-processors listed in Annex 3, as updated from time to time.

4.2 The Service Provider shall impose data protection obligations on sub-processors no less protective than this DPA.

4.3 The Service Provider remains liable for sub-processor performance to the extent required by Applicable Law.

5. International Transfers

5.1 If Personal Data is transferred outside the UK/EEA and such transfer requires a safeguard under Data Protection Laws, the Parties shall implement an appropriate mechanism, including Standard Contractual Clauses or UK International Data Transfer Addendum.

5.2 Transfer details are set out in Annex 4.

6. Security Measures

The Service Provider shall implement measures appropriate to the risk, including those listed in Annex 2, such as:

• access controls;
• encryption in transit;
• multi-factor authentication where feasible;
• logging and monitoring;
• secure configuration;
• backups;
• vulnerability management;
• incident response procedures;
• personnel confidentiality obligations.

7. Audit

7.1 The Service Provider shall make available information reasonably necessary to demonstrate compliance.

7.2 The Client may carry out audits no more than once per year, unless required by a regulator, upon [30] days' notice and during business hours.

7.3 Audits shall be conducted confidentially, securely and without materially disrupting operations.

8. Liability

Liability under this DPA shall be subject to the limitation of liability provisions in the MSA, unless otherwise required by Data Protection Laws.

9. Precedence

In case of conflict between this DPA and the MSA regarding Personal Data, this DPA shall prevail.

Subject matter of processing:

Provision of IT staffing / Contractor of Record services, including candidate assessment, personnel onboarding, contract administration, timesheets, invoicing, client support and compliance.

Duration:

Duration of the MSA and applicable Service Orders, plus retention periods required by law.

Nature and purpose:

Processing necessary to provide the Services, administer contracts, verify identity, perform compliance checks, and process payments.

Categories of data subjects:

Client representatives, candidates, engineers, contractors, and personnel.

Categories of Personal Data:

Name, contact details, CV, employment history, skills, identity data, right-to-work data, bank details, tax data, timesheets, performance records, compliance screening results.

Special categories of data:

Not intentionally processed. If processed, only where required by law and with appropriate safeguards.

Examples:

1. role-based access controls;
2. least privilege access;
3. encryption in transit;
4. secure password policies;
5. multi-factor authentication where available;
6. endpoint protection;
7. logging of access to key systems;
8. secure backups;
9. incident response procedure;
10. staff confidentiality undertakings;
11. vendor due diligence;
12. secure disposal of documents;
13. separation of environments where feasible.

Initial sub-processors may include:

Where required:

• Transfer mechanism: [EU SCCs / UK IDTA / UK Addendum / adequacy / other]
• SCC Module: [Module 1 / 2 / 3 / 4 as applicable]
• Transfer destination: [country]
• Nature of transfer: [hosting, payroll, support, client access, etc.]