Data Processing and Sharing Agreement

1. Agreement structure

This document applies to Vietnam Compliance Assistant and supplements the service agreement between FACS and the client organisation. A separately signed DPA prevails where inconsistent.

An individual click does not replace corporate signature. Tenant-level acceptance is recorded only when a Client Admin confirms representative authority.

2. Roles

The client determines purposes and means for company, employee and third-party data it submits and is responsible for legal basis and notices. FACS processes that data on valid client instructions.

FACS determines purposes for account, security, fraud prevention, acceptance evidence, system administration and FACS's own legal duties.

3. Subject, duration and processing

Processing occurs during the service and a reasonable retention period. Operations include collection, recording, structuring, storage, retrieval, rules-based analysis, instructed transmission, backup, restriction and deletion.

Purposes include company profiles, compliance calendars, task status, access control, support and client-selected functions.

4. Data subjects and categories

• Subjects: users, representatives, employees, suppliers, customers and related persons the client may lawfully include.
• Data: business identity/contact, company, workforce, tax, accounting, investment, insurance, compliance and technical data.
• Sensitive data may be submitted only where necessary, lawful and approved within the service scope.

5. Instructions and lawfulness

FACS processes under the agreement, recorded configuration and instructions unless law requires otherwise. Potentially unlawful instructions may be suspended pending clarification.

The client warrants lawful, accurate and minimised data collection and manages users within its tenant.

6. Security and access control

• Tenant separation and server-side authorisation.
• Encrypted transport, least privilege and administration logs.
• Risk-appropriate change, backup/recovery and incident procedures.
• Confidentiality duties for authorised staff and providers.

7. Subprocessors and transfers

The client generally authorises necessary providers such as OpenAI/ChatGPT and Cloudflare for authentication, hosting, operation and security. FACS remains responsible for selection, scope limitation and appropriate safeguards.

Material provider changes are notified through reasonable channels. Cross-border transfers follow applicable assessment and documentation requirements.

8. Data incidents

FACS provides reasonable notice after confirming an incident affecting client data, with available information on nature, scope, impact and response. Notice is not an admission of fault or liability.

The client cooperates and determines its own notification duties to individuals or authorities.

9. Individual rights and audit

FACS reasonably assists with rights requests, impact assessments and compliance. Audits must have reasonable scope, protect other clients and avoid disruption; out-of-scope costs may be separately agreed.

10. Return, deletion and retention

On valid request or termination, FACS returns/exports data in an available format and deletes or anonymises remaining data under the retention schedule, except legally required, disputed, security or contract-evidence records.

11. Acceptance and effect

A Client Admin accepting for the organisation confirms authority, required internal notices and agreement to processing under this document. Other users acknowledge and comply with the processing applicable to their account.

Sharing beyond what is necessary for the service requires a separate basis and, where required, separate consent.