Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the PackKUB Terms of Service between the Merchant (“Controller”) and VRPA Company Limited / PackKUB (“Processor”) for personal data processed by PackKUB on the Merchant’s behalf in providing the service.

If this DPA conflicts with the general Terms regarding processing of Merchant Personal Data, this DPA prevails for that subject matter.

• ERP and customer/contact records.
• Marketplace integrations and synchronization.
• Orders, payments, packing, fulfillment and returns.
• Inventory transactions containing personal data.
• Accounting or finance records containing personal data.
• Customer communications carried out on the Merchant’s instructions.
• Support, troubleshooting and security operations necessary to provide the service.

PackKUB processes Merchant Personal Data only on documented instructions reflected in the agreement, system settings, feature use, integrations and support requests, unless law requires otherwise.

If PackKUB reasonably believes an instruction may violate applicable data-protection law, it may notify the Merchant and pause the affected processing until an appropriate instruction is provided.

• Maintain a valid legal basis and required notices for the personal data submitted.
• Provide only data necessary for the service purpose.
• Configure user permissions and integrations appropriately.
• Respond to data-subject requests as Controller, except where PackKUB assists under this DPA.
• Comply with applicable law and the terms of marketplaces or other user-directed integrations.

PackKUB limits access to personnel and providers that need the data to perform their duties and requires appropriate confidentiality obligations.

PackKUB maintains technical and organizational measures appropriate to risk, including access controls, authentication, tenant/scope separation, logging and network/system protections, and reviews those measures as appropriate.

The Merchant gives general authorization for PackKUB to use subprocessors necessary to deliver the service. PackKUB will impose appropriate data-protection obligations relevant to each provider’s role.

The current Subprocessor List is published at packkub.com/subprocessors and may be updated as providers change.

Where a subprocessor or user-directed service processes data outside Thailand, PackKUB will consider appropriate safeguards and legal mechanisms required by applicable law and limit transfers to the relevant service purpose.

If PackKUB receives a request relating to Merchant Personal Data, PackKUB may route it to the Merchant and will provide reasonable assistance, taking into account the nature of processing and information available to PackKUB.

If PackKUB becomes aware of a personal data breach affecting Merchant Personal Data, PackKUB will notify the Merchant without undue delay and provide available information reasonably needed to assess, mitigate and meet applicable notification duties.

PackKUB will make reasonable information available to demonstrate compliance with this DPA and may support proportionate audits, subject to confidentiality, security, other customers’ rights and reasonable operational constraints.

At the end of the service, PackKUB will return, export, delete or anonymize Merchant Personal Data according to available service functionality, lawful instructions and applicable legal/retention requirements.

Backup copies may remain temporarily until removed under the relevant backup-retention cycle and will not be repurposed while awaiting deletion.

This DPA does not cover processing for which PackKUB acts as an independent Controller, such as account administration, billing, security, fraud prevention, support and legal compliance. That processing is addressed in the PackKUB Privacy Policy.

[email protected] · VRPA Company Limited, 12 Soi Ramintra 93, Khanna Yao Subdistrict, Khanna Yao District, Bangkok 10230, Thailand · Telephone 083-528-4496.