Data Processing Agreement

This Data Processing Agreement (the DPA) forms part of the agreement between you and GeBeCert for the service (the Agreement). It applies where we process personal data on your behalf.

You are the controller and GeBeCert is the processor in respect of personal data contained in the verification events recorded against your products, the personal data of your team members who hold accounts, and any personal data you submit to the platform.

We are an independent controller in respect of our own account administration data — the records we need to operate the platform and to meet our legal obligations — and that data is governed by our Privacy Policy, not this DPA.

The categories of personal data, the categories of data subjects, the nature of processing, and the duration are set out in the table below. The table is a summary; the Agreement and this DPA govern.

We process personal data only on your documented instructions, including with regard to transfers of personal data to a third country, unless required to do so by applicable law. Where law requires us to deviate from your instructions, we inform you of that legal requirement before processing, unless the law prohibits us from disclosing it.

We immediately inform you if, in our opinion, an instruction infringes the data protection laws applicable to the processing.

You warrant that you hold the necessary rights and consents over the personal data you submit and configure, and that your instructions do not infringe the rights of any data subject.

We implement and maintain appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to it. The measures include:

• Encryption in transit and at rest. TLS 1.3 or better in transit, AES-256 or equivalent at rest, with encryption keys held separately from the data they protect.
• Access control. Production access is restricted to named engineers, authenticated with hardware-backed multi-factor authentication, time-bound, and logged. Every production query is recorded.
• Segregation. Personal data belonging to different customers is kept logically separated, and access scopes are enforced per account.
• Credential hygiene. Passwords are stored as salted hashes and never in recoverable form. Session and API credentials are rotated and revocable.
• Continuous vulnerability management. Dependency scanning, runtime patching, and independent security testing are part of the standard release cycle, not an annual exercise.
• Resilience. Backups are taken on a rolling basis, and restoration is tested rather than assumed.

We review and test the effectiveness of these measures no less than annually, and within 30 days after we detect a personal data breach affecting your data.

The full control set is described on our Security page.

We notify you without undue delay, and in any event within 72 hours after becoming aware of a personal data breach affecting your personal data. The notice describes the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed.

Our notification is not an acknowledgement of fault or liability, and it does not limit your rights under the Agreement. Where a breach originates at a subprocessor, we obtain the underlying detail from them and pass it to you rather than making you chase it.

Where a breach is likely to result in a risk to the rights and freedoms of natural persons, we notify the competent supervisory authority within the statutory deadline, on our own initiative. We make available the information you need to meet your own notification obligations, and we provide reasonable assistance with those notifications.

You grant us general authorisation to engage the subprocessors listed on our subprocessor page. We impose on every subprocessor, by contract, data protection obligations no less protective than those in this DPA, and we remain fully liable to you for the performance of a subprocessor’s obligations where that subprocessor fails to meet them.

We notify your account administrator of any intended change to that list, through the appointment or replacement of a subprocessor, at least 30 days in advance, by email and by an update to the published list.

You may object to the appointment or replacement of a subprocessor before it takes effect, provided the objection is based on reasonable grounds relating to data protection. If we cannot resolve the objection, we will either not appoint or replace the subprocessor or, if that is not possible, you may suspend or terminate the affected service without prejudice to fees incurred before the termination, and we will refund any prepaid, unused fees for the affected service.

Taking into account the nature of the processing, we assist you by appropriate technical and organisational measures, insofar as it is possible, in fulfilling your obligation to respond to requests to exercise data subject rights, including requests to access, rectify, erase, restrict, object to, or port personal data.

We notify you without undue delay if we receive a request directed to us that concerns personal data you control and that we process on your instructions, so that you can meet the applicable deadline. We do not respond to such a request ourselves unless you instruct us to, or where the law requires us to do so.

We also assist you with your obligations under Articles 32 to 36 of the GDPR — security, breach notification, and data protection impact assessment — by providing the information you reasonably need, and by allowing you to submit a written question, which we answer within 30 days.

GeBeCert is established in Hong Kong. Our infrastructure is operated by a cloud hosting provider whose data centres sit outside Hong Kong, and our email and geolocation processors operate outside Hong Kong as well.

Where a transfer of personal data is subject to a restricted-transfer regime, we put in place an appropriate safeguard before the transfer takes place. We rely on the applicable standard contractual clauses where they are available, and on an adequacy decision where the destination is covered by one. Where we cannot satisfy either, we do not transfer the data.

You may request a copy of the safeguard we rely on for any transfer by writing to [email protected].

We satisfy our audit obligations in the first instance by providing documentation. On written request at reasonable intervals, we make available to you relevant information demonstrating our compliance, in the form of our most recent third-party audits and certifications — which may include a SOC 2 Type II report, a summary of our most recent independent penetration test, and our current subprocessor list.

Where that documentation is not sufficient to demonstrate our compliance, you may audit us on at least 30 days’ written notice, no more than once per calendar year except following a personal data breach, during normal business hours, at your own cost, subject to a written confidentiality undertaking and to not disrupting the service. We will reasonably cooperate with the audit, including by making our personnel and systems available.

On termination of the Agreement, and at any earlier point on your written request, we return or delete the personal data processed under this DPA, unless applicable law requires us to retain it.

We make the data available to you for export for 30 days following termination. After that window, we delete it from our live systems and from backups on the following rotation, and we delete any remaining derived data. We confirm completion of deletion in writing on request.

Data that we are required by law to retain — for example records needed to demonstrate the integrity of a verification event in a dispute — is isolated, kept under restricted access, and deleted once the retention obligation expires. The retention schedule that governs each category is published in our Privacy Policy.

This DPA is governed by the laws of the Hong Kong Special Administrative Region, without prejudice to any mandatory consumer protections available to you. The courts of the Hong Kong Special Administrative Region have exclusive jurisdiction.

If a provision is held unenforceable, the remainder continues in full effect. Where this DPA conflicts with the Agreement, this DPA prevails on the subject of processing personal data. Where it conflicts with the Agreement’s liability provisions, the liability provisions continue to apply as written.

To execute this DPA on your behalf, or to request a signed copy: write to [email protected].