Data Processing Agreement
Marc Chow (the "Site") is operated by Marc Chow ("we", "us", "our"), based in Hong Kong.
1. Who we are and the roles we take
Marc Chow ("we", "us") acts as:
- controller of the personal data we collect to operate the Site — account data, billing data, usage logs and analytics; and
- processor of personal data you submit to us for processing, where applicable.
Where we act as processor, this Data Processing Agreement (the "DPA") governs that processing.
2. What we process
Personal data you submit to the Site for processing (for example, order, account and support data) — names, email addresses, postal addresses, order details and payment metadata.
3. Our obligations
We will:
- process personal data only on your documented instructions, unless required by law;
- ensure that people authorised to process the data are bound by confidentiality;
- implement appropriate security measures, including TLS 1.2 or higher in transit, encryption at rest, role-based access control, multi-factor authentication for internal access, monitoring and daily backups;
- not engage another processor (sub-processor) without informing you and giving you a reasonable opportunity to object;
- assist you in responding to data subject rights requests;
- notify you without undue delay, and in any event within 72 hours, of a personal data breach;
- delete or return personal data within 30 days of termination, unless the law requires us to keep it.
4. Sub-processors
Our current sub-processors are listed on our Sub-processors page. We notify you of material changes at least 30 days in advance.
5. International transfers
We are established in Hong Kong. Where personal data is transferred to a jurisdiction without an adequacy decision, we use the European Commission's Standard Contractual Clauses and, for UK transfers, the UK ICO's International Data Transfer Addendum.
6. Your obligations
You will: provide accurate and lawful instructions; ensure you have a lawful basis for the processing you ask us to carry out; and comply with data protection and anti-spam law, including the Unsolicited Electronic Messages Ordinance (Cap. 593) of Hong Kong and applicable overseas equivalents.
7. Governing law
This DPA is governed by the laws of the Hong Kong Special Administrative Region. Disputes are resolved by HKIAC arbitration in Hong Kong, conducted in English by a single arbitrator, except where applicable data protection law requires a different forum.
8. Contact
[email protected] · Security incidents: [email protected] · Data Protection Officer: [email protected]
