Data Processing Addendum

Last updated: 27 October 2026

This Data Processing Addendum (DPA) applies to Convinced Creations Company Limited, trading as Tatship, when processing personal data on behalf of a business customer under an agreement that expressly incorporates it. It does not apply automatically to individual consumer use or replace an existing signed agreement.

Tatship is registered in Hong Kong. Its address is 9/F, AMTEL BUILDING, 148 DES VOEUX ROAD CENTRAL, Hong Kong. Contact [email protected].

1. Scope and roles

The customer is the controller, or a processor authorised by its controller, and Tatship is its processor or subprocessor for Customer Personal Data processed solely on the customer's behalf. Each party must comply with data-protection law applicable to its role.

Processing supports the design, preview, storage, sharing, and related business services specified in the service agreement. It may include collection, use, storage, transmission, and deletion of client or staff contact details, photos, supplied content, results, communications, and related service information. Data subjects include the customer's clients, personnel, and people whose information is lawfully submitted. Processing continues for the agreed service period and applicable return, deletion, or lawful retention period.

The parties must record deployment-specific processing details, security measures, locations, retention arrangements, and authorised subprocessors in the service agreement or supporting schedules. Processing of sensitive information outside the agreed scope requires separate agreement and appropriate safeguards. Children's data and biometric identity-verification uses are outside scope.

Tatship acts independently for its own account administration, billing, and other purposes described in the Privacy Policy.

2. Instructions and customer responsibilities

Tatship processes Customer Personal Data on documented instructions in the agreement, authorised settings, and agreed support requests, unless law requires otherwise. Where permitted, it will inform the customer of that legal requirement. Tatship will inform the customer if an instruction appears to infringe applicable data-protection law and may suspend affected processing pending resolution.

The customer is responsible for lawful collection, required notices and permissions, the accuracy and legality of its instructions, and authorised access to its account. Processing for Tatship's own advertising or general-purpose model training is outside this DPA's instructions.

Where applicable US law requires service-provider or contractor restrictions, Tatship will process covered data only for the specified business purposes and other legally permitted purposes; it will not sell or share it for cross-context behavioural advertising or combine it with unrelated data except as permitted. Tatship will notify the customer if it cannot meet those requirements and permit legally required steps to verify or remediate compliance.

3. Confidentiality and security

Tatship will ensure authorised personnel are subject to confidentiality obligations and maintain technical and organisational measures appropriate to the processing and risk. Tatship may update its security measures, provided they remain appropriate to the processing and risk and satisfy applicable law and any expressly agreed security requirements.

4. Subprocessors

Subprocessors require the customer's specific or general written authorisation. The agreed subprocessor record identifies their entities, functions, processing locations, and relevant safeguards. Under general authorisation, Tatship will give advance notice of intended additions or replacements and a reasonable opportunity to object on data-protection grounds, following the agreed notice procedure and applicable law.

The parties will consider reasonable ways to resolve an objection. If it cannot be resolved, affected services may be suspended or ended under the service agreement and applicable law. Tatship will not engage a subprocessor without the required authorisation.

Tatship will impose equivalent applicable data-protection obligations on subprocessors and remains responsible for their performance as required by applicable law.

5. Assistance and incidents

Taking account of the nature of processing and information available, Tatship will provide assistance required by applicable law with individual rights, security, breach notifications, impact assessments, and regulatory consultations. Requests concerning Customer Personal Data will be referred to the customer unless law requires a direct response.

Tatship will notify the customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data, provide available information needed for the customer's response, and supplement it as appropriate. Each party remains responsible for notifications legally required of it. A notification is not an admission of liability.

Reasonable charges for assistance beyond the included service scope may be agreed, subject to mandatory obligations and responsibility for Tatship's own breach.

6. International transfers

Restricted international transfers require documented instructions and an applicable lawful transfer mechanism and safeguards. Where required, the parties must complete the relevant EU Standard Contractual Clauses, UK transfer instrument, or other applicable arrangement with the necessary schedules before the transfer. Mandatory transfer terms prevail over inconsistent commercial terms.

7. Return and deletion

At the end of covered processing, Tatship will, at the customer's choice, return or delete Customer Personal Data and delete copies, unless binding law requires retention. Implementation follows an agreed schedule consistent with applicable law, including handling by subprocessors. Retained backup data must remain protected and outside ordinary use until removed through the applicable deletion cycle. Completion information will be provided as required by law or the agreement.

8. Compliance information and audits

Tatship will provide information and allow and contribute to audits and inspections required to demonstrate compliance with applicable processor obligations. Where sufficient, relevant documentation or assurance reports may be used first.

Audits are subject to reasonable notice, confidentiality, protection of other customers' information, and arrangements to minimise disruption. Unless otherwise agreed or legally required, the customer bears its audit costs and reasonable additional assistance costs agreed in advance. These arrangements must not prevent legally required audits, regulator access, or necessary investigation of a breach.

9. Liability and priority

The service agreement's lawful limitations of liability apply to this DPA. No separate indemnity is created by this DPA. Mandatory statutory liability and individual or regulator rights are unaffected.

This DPA takes priority for its data-protection subject matter, subject to mandatory law and applicable transfer terms. Obligations concerning retained Customer Personal Data continue for as long as required by applicable law and the agreement. Amendments to existing arrangements follow their agreed amendment procedure and applicable law.