Data Processing Agreement (standard terms)

This Data Processing Agreement ("DPA") forms part of the agreement between LET ME LLC, operator of Canton Check ("Processor", "we"), and the business customer using the Service ("Customer"). It applies only to personal data that the Customer, or people acting for it, submits to the Service, and that we process on the Customer's behalf ("Customer Personal Data").

To sign a countersigned copy, request it through /contact (request type "DPA / legal"). Until a signed copy exists, these standard terms apply to business customers who accept our Terms of Service.

1. Scope and roles

1.1 Customer Personal Data includes:

• account details of the Customer's authorized users (such as email addresses),
• search queries and notes submitted by the Customer, where they contain personal data,
• messages the Customer sends us.

1.2 For Customer Personal Data, the Customer is the controller and we are the processor.

1.3 Information in reports about Chinese companies, including names of company officers and shareholders taken from public records, is compiled by us independently of any customer. We are an independent controller of that data, as described in our Privacy Policy (/privacy). This DPA does not cover it.

2. Processing details

3. Our obligations

We will:

1. process Customer Personal Data only on the Customer's documented instructions, which are given by the agreement and the Customer's use of the Service, unless the law requires otherwise; in that case we will tell the Customer, unless the law forbids it;
2. make sure personnel authorized to process the data are bound by confidentiality;
3. apply the security measures in Annex 1;
4. use sub-processors only as set out in section 5;
5. help the Customer, taking into account the nature of the processing, to respond to data-subject requests and to meet its security, breach-notification, impact-assessment and consultation obligations;
6. notify the Customer without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting Customer Personal Data, with the information reasonably available to us;
7. make available the information reasonably needed to demonstrate compliance with this DPA (see section 7).

4. Customer obligations

The Customer is responsible for:

• the lawfulness of the instructions it gives,
• having a valid legal basis for the Customer Personal Data it submits,
• not using the Service in breach of our Acceptable Use Policy.

5. Sub-processors

5.1 The Customer authorizes our use of the sub-processors listed in Annex 2.

5.2 We will give at least 30 days' notice of any new or replacement sub-processor by updating Annex 2, which is published at /dpa, and showing a notice on the Service. The Customer may object on reasonable data-protection grounds within that period. If we cannot address the objection, the Customer may stop using the affected part of the Service.

5.3 We impose data-protection obligations on each sub-processor that are substantially as protective as this DPA, and we remain responsible for their performance.

6. International transfers

Customer Personal Data may be processed in the United States and other countries where our sub-processors operate. Where this involves a transfer from the EEA, UK or Switzerland to a country without an adequacy decision, the parties agree to the EU Standard Contractual Clauses (Commission Decision 2021/914; Module 2, controller-to-processor). Where applicable, the UK International Data Transfer Addendum and the Swiss amendments apply as well. Both are incorporated by reference, with this DPA supplying the required details.

7. Audits

We do not currently hold a SOC 2 or ISO 27001 certification. On written request, no more than once a year, we will answer a reasonable security questionnaire and provide relevant documentation. Further audits may be agreed in writing, at the Customer's cost and subject to confidentiality.

8. Liability

Each party's liability under this DPA is subject to the limitations in our Terms of Service, unless mandatory law requires otherwise.

9. Deletion and return

When the Customer stops using the Service, or on request, we will delete Customer Personal Data within 30 days, unless the law requires us to keep it. Before deletion, the Customer may request an export of its account data through /contact.

10. Governing law and precedence

This DPA is governed by the law that governs our Terms of Service, except where the Standard Contractual Clauses require otherwise. If there is a conflict, the order of precedence is: (1) the Standard Contractual Clauses, (2) this DPA, (3) the Terms of Service.

Annex 1 — Security measures

• Encryption in transit: HTTPS/TLS for all traffic to the website, API and database.
• Access control:
  • database row-level security;
  • internal tables (caches, logs, messages, unlock records) are reachable only by server-side code, never from the browser;
  • admin functions require a server-verified admin role.
• Report access: full reports are returned only to the user who created them, an admin, or a viewer who unlocked them with their own allowance.
• Data minimisation:
  • IP addresses are stored only as one-way hashes;
  • API keys are stored only as hashes and shown once;
  • passwords are handled by the authentication provider and never stored by us in plain text.
• Abuse prevention: usage quotas and rate limits on searches, checks and message forms.
• Logging: calls to data-collection providers are logged with status, duration and cost, without user personal data.
• Infrastructure: hosted on managed providers (Lovable, Supabase, Cloudflare) that operate their own security programmes.
• Incident response: breaches are investigated and notified as described in section 3.6.

Annex 2 — Sub-processors