Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between you ("Customer") and Hong Kong Chongde Industrial Limited ("CacheVerifier"). It applies whenever customer content you send to the service — queries, answers, cached queries, labels and feedback signals — contains personal data. For that data, Customer is the controller and CacheVerifier is the processor. Terms not defined here have the meaning given in the GDPR (EU 2016/679), the UK GDPR, or other applicable data-protection law ("Data Protection Law"). Customer accepts this DPA by accepting the Terms; if you need a countersigned copy, email support@cacheverifier.com.

• Subject matter and purpose: scoring (query, candidate answer) pairs, storing labeled feedback, and fine-tuning and serving a verifier model for Customer only.
• Nature: receipt, in-memory scoring, storage, model training, deletion.
• Duration: for as long as Customer's account is open, plus the deletion periods in section 9.
• Data subjects: Customer's end users whose messages appear in customer content, and any individuals those messages mention.
• Personal data: whatever personal data Customer includes in customer content. Customer controls what is sent and must not send the categories excluded by section 5 of the Terms.

CacheVerifier processes customer content only on Customer's documented instructions, which are the Terms, this DPA, and Customer's use and configuration of the service — unless the law requires otherwise, in which case CacheVerifier will tell Customer first where the law allows. CacheVerifier will inform Customer if it believes an instruction infringes Data Protection Law. CacheVerifier never uses customer content to train or evaluate any other customer's model.

Anyone CacheVerifier authorises to process customer content is bound by confidentiality. CacheVerifier maintains appropriate technical and organisational measures, including:

• encryption of all traffic in transit (TLS), with origin servers accepting web traffic only from Cloudflare;
• logical separation of every customer's data by workspace, enforced on every API request;
• hashed passwords (bcrypt) and API keys, and short-lived signed dashboard sessions;
• production access restricted to CacheVerifier's operator;
• daily database backups with 14-day rotation;
• error reporting configured not to transmit request bodies or customer content.

Customer gives general authorisation for CacheVerifier to use the sub-processors below. CacheVerifier imposes data-protection obligations on each that are no less protective than this DPA, and remains responsible for their performance. CacheVerifier will update this list at least 14 days before a new sub-processor starts processing customer content; Customer may object on reasonable data-protection grounds, and if we can't resolve the objection, Customer may terminate the affected service and receive a pro-rata refund of prepaid fees for it.

Customer content is stored in the United States and may be accessed from Hong Kong. Where Data Protection Law restricts a transfer of personal data from the EEA, the UK or Switzerland to CacheVerifier, the Standard Contractual Clauses adopted by European Commission Decision 2021/914 (Module 2, controller-to-processor, or Module 3, processor-to-processor, as applicable) are incorporated into this DPA by reference, with Customer as data exporter and CacheVerifier as data importer; the optional docking clause and Clause 9(a) Option 2 (general authorisation) apply; the governing law and forum under Clauses 17 and 18 are those of Ireland; and Annexes I and II are completed by sections 2 and 4 of this DPA. For UK transfers, the UK International Data Transfer Addendum applies alongside them; for Swiss transfers, the Clauses apply with references to the GDPR read as references to the Swiss FADP.

Taking into account the nature of the processing, CacheVerifier will help Customer respond to data-subject requests (access, correction, deletion and so on) and meet its obligations on security, breach notification, data-protection impact assessments and prior consultation. CacheVerifier will pass on to Customer, without responding itself, any request it receives directly from a data subject about customer content.

CacheVerifier will notify Customer without undue delay — and where feasible within 72 hours — after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to customer content, with the information Customer reasonably needs to meet its own notification obligations.

Customer can delete its account at any time from the dashboard, which immediately erases customer content and fine-tuned models from the live system; copies in backups are overwritten within 14 days. Verify verdict records contain no customer content and are kept for 90 days. On request at the end of the service, CacheVerifier will confirm deletion in writing.

CacheVerifier will make available the information reasonably necessary to demonstrate compliance with this DPA, including written answers to reasonable security questionnaires. Where that isn't sufficient, or a regulator requires it, Customer may audit CacheVerifier on at least 30 days' notice, at Customer's expense, no more than once a year, under reasonable confidentiality terms.

The limitation of liability in the Terms applies to this DPA, except where Data Protection Law or the Standard Contractual Clauses don't allow it. If this DPA conflicts with the Terms, this DPA prevails; if it conflicts with the Standard Contractual Clauses, the Clauses prevail.