Legal

Data Processing Agreement (DPA)

Version 1.0 · Updated 2026-10

This is a v1.0 draft. It will be finalized under review by licensed counsel before commercial launch; the finalized version will govern.

This page is a public template and is not an executed data processing agreement. The DPA is provided with the order form and its annexes are completed item by item; clauses marked “TBD” are not yet determined and constitute no commitment.

Contracting entity (to be completed)

The following fields are not yet settled. This page fills in no placeholder company name, registration number or email address. Until they are settled, this template cannot be used as a signable text.

Registered legal name of the contracting entity (Chinese / English)TBD: As recorded on the business licence; the Chinese and English names must correspond.
Unified social credit codeTBD: Used to identify the party in Annex I.A.
Registered address and principal place of businessTBD: State both separately where they differ.
Contact point for data protection mattersTBD: Must be a monitored address and is carried into the Art. 30 records.
EU representative (GDPR Art. 27) and its Member StateTBD: Required in writing for processors caught by Art. 3(2) with no EU establishment; still under assessment.
Data protection officer (GDPR Art. 37)TBD: Whether the Art. 37 designation triggers apply has not yet been determined.
Whether an offshore contracting entity exists, and which entity EU customers sign withTBD: Determines the transfer chain and the description of the transfer in Annex I.B.

1. Nature and status of this document

This page is the publicly published data processing agreement (DPA) template of HaiWen HQ, so that prospective customers can see the processor obligations we are prepared to take on during procurement review.
This page is not an executed data processing agreement. The DPA is provided with the order form and its Annexes I to III are completed item by item; the version signed by both parties (including electronic signature) governs.
GDPR Art. 28(9) requires the processor contract to be in writing, including in electronic form.
Clauses marked "to be determined (TBD)" in this template are not yet settled and constitute no commitment; the contracting entity details are set out in the "Contracting entity (to be completed)" block below.

2. Roles of the parties and scope

For the business data the customer enters into or generates in the workspace, the customer is the controller and HaiWen is the processor, processing under this agreement and the customer’s documented instructions.
For account registration, billing and platform security audit data, HaiWen is the controller for that processing, and the Privacy Policy applies rather than this agreement.
This agreement takes effect with the main service contract (the Terms of Service or the order form) and covers all authorised users within the customer’s organisation.
GDPR Art. 28(10): a processor that infringes the Regulation by determining the purposes and means of processing is considered a controller in respect of that processing. HaiWen does not use customer business data for its own purposes beyond this agreement.

3. Subject-matter, duration, nature and purpose of the processing (Art. 28(3), first subparagraph)

Subject-matter: personal data the customer submits to, or generates within, the HaiWen HQ go-global compliance and ESG self-service advisory platform.
Duration: from the effective date of the main service contract until termination of the service, continuing until deletion or return is completed under section 11.
Nature and purpose: the collection, storage, retrieval, use, transmission and deletion necessary to provide diagnosis, knowledge retrieval, evidence management, report generation, AI advisory and collaboration features.
Platform outputs are decision-support information and do not constitute legal advice, audit opinions or certification conclusions; this agreement does not change that characterisation in section 1 of the Terms of Service.

4. Types of personal data and categories of data subjects (Art. 28(3), first subparagraph)

The types of personal data and the categories of data subjects are itemised in Annex I and confirmed with the customer when the order form is signed.
The four categories the live service actually processes (account information, company profile and business data, usage data, AI conversation content) match section 1 of the Privacy Policy.
The platform does not ask customers for special categories of personal data under GDPR Art. 9; customers should not enter such data into free-text fields, and any genuine need must be agreed in writing beforehand (to be determined (TBD)).

5. Processing only on documented instructions (Art. 28(3)(a))

HaiWen processes personal data only on documented instructions from the customer, including with regard to transfers of personal data to a third country or an international organisation; this agreement, the order form and the customer’s in-product configuration form the initial documented instructions.
Where Union or Member State law to which HaiWen is subject requires a processing operation, HaiWen informs the customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
Art. 28(3), second subparagraph: HaiWen immediately informs the customer if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.
A boundary that has to be stated honestly: the statutory exception above covers only Union or Member State law. Mandatory requirements under Chinese law fall outside it and are handled under section 15.

6. Confidentiality and personnel (Art. 28(3)(b))

HaiWen ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
Access separation on the platform side is implemented through row-level security policies and server-side key isolation; the measures are set out in Annex II.
Personnel policy details (scope of background checks, confidentiality agreement template, deadline for revoking access on departure, handling of breaches): to be determined (TBD), to be supplied before the order form is signed.

7. Security of processing (Art. 28(3)(c) / Art. 32)

HaiWen implements technical and organisational measures appropriate to the risk under Art. 32; the inventory is in Annex II.
Annex II lists only measures already implemented on the platform and capable of being verified. Unverifiable wording such as "industry-standard measures" is not offered as a commitment.
Priority controls in the AI setting: access control and encryption for training data and model weights, minimisation and masking of personal data in inference logs, retention policy for prompts and outputs, and controls on the model provider’s side.
Certification status, stated honestly: HaiWen holds no ISO/IEC 27001 certification and has issued no SOC 2 report. Should either be obtained, it may supplement the audit arrangements in section 12 (to be determined (TBD)).

8. Sub-processors (Art. 28(3)(d) / Art. 28(2) and (4))

The current sub-processor list is in Annex III and is updated as the service changes.
The authorisation model (specific prior authorisation or general written authorisation, the choice required by Art. 28(2) and Clause 9(a) of the Standard Contractual Clauses) and the notice period for adding or replacing sub-processors: to be determined (TBD), settled on the order form.
Under a general written authorisation, HaiWen informs the customer in writing of intended additions or replacements within the agreed notice period, giving sufficient time to object; how an objection is handled (alternative arrangement or termination right): to be determined (TBD).
HaiWen will impose on each sub-processor, by written contract, data protection obligations that are in substance the same as those in this agreement; as at this version those agreements with the sub-processors listed in Annex III are still being put in place (TBD). Either way, where a sub-processor fails to fulfil its data protection obligations, HaiWen remains fully liable to the customer (Art. 28(4)).

9. Assistance to the customer: data subject rights and Arts. 32 to 36 (Art. 28(3)(e) and (f))

Taking into account the nature of the processing, HaiWen assists the customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the obligation to respond to requests for exercising the data subject rights laid down in Chapter III of the GDPR (Art. 28(3)(e)).
Taking into account the nature of processing and the information available to it, HaiWen assists the customer in ensuring compliance with Arts. 32 to 36 — security of processing, personal data breach notification, data protection impact assessment and prior consultation (Art. 28(3)(f)).
A technical difficulty to state honestly: deleting personal data from vector retrieval corpora, AI session history, runtime logs and caches spans several storage layers and cannot be guaranteed to complete in a single operation; the concrete procedure and completion timelines follow the order form (to be determined (TBD)).
Where HaiWen receives a request directly from a data subject it does not answer it itself but refers it to the customer, unless the customer instructs otherwise in writing.

10. Personal data breach notification (Art. 33(2))

HaiWen notifies the customer without undue delay after becoming aware of a personal data breach affecting the customer’s personal data, and provides the information the customer needs to meet its obligations under Arts. 33 and 34.
Art. 33(2) sets no fixed deadline for the processor (the 72 hours in Art. 33(1) is the controller’s deadline towards the supervisory authority, not the processor’s towards the controller). This template therefore states no fixed deadline; any committed timeline follows the order form (to be determined (TBD)).
On-call arrangements and incident response exercises: to be determined (TBD).

11. Deletion or return after the end of the services (Art. 28(3)(g))

After the end of the provision of services relating to processing, HaiWen deletes or returns all the personal data at the customer’s choice and deletes existing copies, unless Union or Member State law requires storage of the personal data.
The window for the customer to make that choice, the export format, and the completion deadline for deleting copies held on backup media: to be determined (TBD).
Section 7 of the Terms of Service already states that the customer may stop using the service and request deletion of organisation data at any time; this section connects to that and adds no new restriction.

12. Information and audits (Art. 28(3)(h))

HaiWen makes available to the customer all information necessary to demonstrate compliance with the obligations in this section, and allows for and contributes to audits, including inspections, conducted by the customer or another auditor mandated by the customer.
Audit frequency, notice period, cost allocation and confidentiality requirements on the auditor: to be determined (TBD).
Art. 28(5): adherence to an approved code of conduct (Art. 40) or an approved certification mechanism (Art. 42) "may be used as an element" in demonstrating sufficient guarantees — it is not an exemption from the audit duty. HaiWen currently has neither such a code registered nor such a certification, so no third-party report substitutes for an audit at this stage.

13. Records of processing activities (Art. 30(2))

HaiWen maintains a record of all categories of processing activities carried out on behalf of each controller, containing: the name and contact details of the processor and of each controller (and, where applicable, of their representatives and data protection officers); the categories of processing carried out for each controller; transfers to a third country or an international organisation, including identification of the destination and documentation of suitable safeguards; and a general description of the security measures referred to in Art. 32(1).
The records are in writing, including in electronic form, and are made available to the competent supervisory authority on request.
The "name and contact details of the processor" field depends on the "Contracting entity (to be completed)" block below and cannot be finalised until that information is settled.

14. International transfers and China-side outbound obligations

HaiWen’s operating entity is located in China. Mainland China is not on the European Commission’s adequacy list, so the default basis for an EU customer (controller) transferring personal data to HaiWen (processor) is the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914).
The module follows the parties’ real roles: Module Two (controller to processor) where the customer is a controller; Module Three (processor to processor) where the customer is itself another party’s processor. The module, Annex I.A/B/C, the Annex II technical and organisational measures and the Annex III sub-processor list are settled item by item when the order form is signed.
Clause 14 requires a transfer impact assessment (TIA) to be completed and documented before the transfer, as a continuing duty. HaiWen’s position is to prepare the assessment material proactively from the China side and supply it with customer due diligence; stated honestly, however, as at the date of this version HaiWen has issued no transfer impact assessment conclusion for any customer scenario, and the assessment is run case by case at the ordering stage.
Remote access is itself a transfer: operations access from China-based teams to an EU production environment, support desks, cross-border logs and backups all belong on the transfer inventory.
The China-side outbound duty runs in the opposite direction and is assessed separately: Art. 4 of the Provisions on Promoting and Regulating Cross-Border Data Flows (CAC Order No. 16) exempts personal information collected and generated outside China, brought into China for processing and then provided abroad again — provided no domestic personal information or important data was introduced during processing — from the security assessment filing, the standard contract and certification. Whether that article applies to a given project is determined case by case in writing; no general commitment is made.
Whether or not that exemption applies, the notification, separate consent and personal information protection impact assessment duties under the Personal Information Protection Law are not waived (restated in Art. 10 of CAC Order No. 16), and the assessment report and processing records are kept for at least three years (Arts. 55 and 56 of the Personal Information Protection Law).

15. Public authority access requests (SCC Clause 15 / Art. 36 of the Data Security Law)

Under SCC Clause 15.1(a): if HaiWen receives a legally binding request from a public authority of the country of destination, including judicial authorities, for disclosure of data under this agreement, or becomes aware of direct access by public authorities to such data, it promptly notifies the customer and, where possible, the data subject; the notification covers the personal data requested, the requesting authority, the legal basis and the response given.
Under Clause 15.1(b): where the law of the country of destination prohibits such notification, HaiWen uses its best efforts to obtain a waiver of the prohibition and documents those efforts so that they can be demonstrated at the customer’s request.
Under Clause 15.1(c) and (d): to the extent permissible under the law of the country of destination, HaiWen provides the customer at regular intervals for the duration of the contract with information on the requests received (number, types of data requested, requesting authorities, whether requests were challenged and the outcome), preserves that information for the duration of the contract and makes it available to the competent supervisory authority on request.
Under Clause 15.2: HaiWen reviews the legality of a disclosure request, challenges it where after careful assessment there are reasonable grounds to consider it unlawful, pursues appeals and seeks interim measures suspending its effects, does not disclose until required to do so under the applicable procedural rules, and documents the legal assessment and the challenge.
The interaction with Chinese law has to be stated honestly: Art. 36 of the Data Security Law provides that, without the approval of the competent authorities of the People’s Republic of China, no organisation or individual within China may provide data stored within China to a foreign judicial or law-enforcement authority; Art. 48 sets the penalties. That article governs "providing data to a foreign authority", a different direction from Clause 15.1 "notifying the customer", and the two can operate in parallel. HaiWen’s internal procedure is: receive, freeze, legal assessment, seek approval under Chinese law, then notify the customer to the extent the law permits.
HaiWen makes no commitment such as "we will refuse every government data request" — no processor can guarantee that as a matter of law, and such a promise would cut against the honest assessment a transfer impact assessment requires. The customer’s assessment should address the real procedure set out above.
The named owner of that receive-and-freeze procedure, the legal support available on the Chinese and EU sides, and whether Clause 15.1(c) transparency statistics are supplied to customers on a regular cadence: to be determined (TBD).

16. EU representative, data protection officer, changes and contact

GDPR Art. 27 requires a controller or processor caught by Art. 3(2) with no establishment in the Union to designate a representative in the Union in writing; the exemption covers only processing that is occasional, does not include large-scale processing of Art. 9(1) special categories or Art. 10 criminal data, and is unlikely to result in a risk to the rights and freedoms of natural persons. Whether HaiWen designates an EU representative, who it is and in which Member State: to be determined (TBD), under assessment.
Whether the Art. 37 triggers for designating a data protection officer apply, and the external contact point for data protection matters: to be determined (TBD).
Allocation of liability and indemnities follows the main service contract; changes to this template are published on this page, and changes to an executed DPA are notified as the main service contract provides.
Until the formal contact point is settled, please raise questions about this agreement through the contact page on this site or with your customer-success advisor.

Annex I · Description of the transfer

The rows below describe the live service as it currently stands; rows marked “TBD” are confirmed with the customer item by item when the order form is signed.

Item

Content

Categories of data subjects

The customer’s employees and users authorised in the workspace; business contacts entered by the customer. Whether end individuals, job applicants or other categories are covered is settled case by case on the order form.TBD

Categories of personal data

Account information (registration email, phone number, company name and role); company profile and business data; usage data (sign-in logs, feature usage records, security audit events); AI conversation content. Consistent with section 1 of the Privacy Policy.

Sensitive data

The platform does not ask for GDPR Art. 9 special categories of personal data. Where a customer genuinely needs such processing, the scope and additional safeguards must be agreed in writing beforehand.TBD

Frequency of the transfer

Continuous (an online SaaS service; transfers occur in real time as the customer uses it).

Nature and purpose of the processing

See section 3: processing necessary to provide diagnosis, knowledge retrieval, evidence management, report generation, AI advisory and collaboration features.

Retention period

Coterminous with the main service contract; deleted or returned under section 11 after termination. Per-category retention periods are agreed on the order form.TBD

Subject-matter, nature and duration of sub-processing

See Annex III; each sub-processor’s processing runs for the term of the main service.

Competent supervisory authority (Annex I.C)

Determined by the customer’s (exporter’s) place of establishment or that of its EU representative, and entered on the order form.TBD

Annex II · Technical and organisational measures

Annex II of the Standard Contractual Clauses requires measures to be specific and auditable. This table lists only measures already implemented on the platform and open to review; items not yet formalised are left explicitly blank rather than filled with generic wording.

Measure

Description

Encryption in transit and at rest

Business data is hosted on Supabase (Postgres) with encryption in transit and at rest, consistent with section 3 of the Privacy Policy.

Multi-tenant isolation

Database row-level security (RLS) per organisation, verified end to end with a script running real user sessions.

Key and privilege separation

The service-role key is used only in controlled server environments and never enters the client bundle; user-less scenarios (webhooks, scheduled updates, seeding) are authorised separately.

Human approval and audit of Multi-Tool Agent Advisor writes

Writes proposed by the Multi-Tool Agent Advisor are committed only after approval by an organisation owner or admin, and leave audit events.

Interface hardening

Public APIs are rate-limited and production access is narrowed by a cross-origin allow-list.

Log retention, key rotation cadence, backup and restoration drills, penetration testing, availability commitments

Not yet formalised into commitments that can be made externally; no placeholder such as "industry-standard measures" is offered in their place.TBD

Annex III · List of sub-processors

This list covers only providers that may come into contact with customer personal data, listed truthfully against what the codebase actually uses or has implemented but not yet enabled in production; both are disclosed, with status stated separately.

Provider

Purpose

Data involved

Status

Region

Supabase

Database and identity hosting (Postgres, Auth)

Workspace business data, account information, audit events

In use

TBD

Vercel

Application hosting and edge network

Request data processed by the application and runtime logs

In use

TBD

DeepSeek

AI inference (chat and non-streaming completions); its embeddings endpoint is implemented in code but not enabled in production

Conversation content and the injected company-profile context

In use

TBD

SiliconFlow

Retrieval embeddings (lib/embedding.ts)

Retrieval text of user questions and the platform knowledge-base corpus

In use

TBD

Upstash

Cache and rate limiting (Redis REST)

Cache keys and rate-limit counters, which may carry account or origin identifiers

In use; falls back to in-process memory when unconfigured

TBD

Resend

Transactional email delivery

Recipient email address and message body

Implemented in code; the key is not configured in production, so it is not active

TBD

Aliyun SMS

Mobile OTP delivery (lib/auth/providers/aliyun-sms.ts)

Mobile numbers and OTP delivery records

Implemented in code; signature and credentials not configured in production, currently not enabled

TBD

WeChat Open Platform

Website QR sign-in (lib/auth/providers/wechat.ts)

UnionID / OpenID and the basic profile returned on sign-in callback

Implemented in code; open-platform qualification not obtained, currently not enabled

TBD

Zhipu AI

Alternative retrieval-embedding provider (lib/embedding.ts)

If enabled: retrieval text of user questions and the platform knowledge-base corpus

Implemented in code; not enabled in production

TBD

OpenAI

Alternative retrieval-embedding provider (lib/embedding.ts)

If enabled: retrieval text of user questions and the platform knowledge-base corpus

Implemented in code; not enabled in production

TBD

Stripe / Alipay / WeChat Pay

Payment and order callbacks (lib/payments/*)

Order identifiers and transaction data returned by the channel (HaiWen does not handle full card numbers)

Implemented in code; online payment deliberately not launched, merchant credentials not configured in production, currently not enabled

TBD

The “Region” column is left blank throughout: the region of each provider’s project, and where AI inference actually runs, cannot be verified from our published material, and no speculative value is entered.
The search service used for the weekly regulatory news job handles only public-information queries; whether it ever touches customer personal data has not been verified, so it is neither listed here nor silently omitted.
This list is updated as the service changes; the notification mechanism and notice period are in section 8 (TBD).

Sources and verification note

GDPR Arts. 27, 28, 30 and 32 to 36, and Clauses 9, 14 and 15 of the Standard Contractual Clauses, were taken on 12 Sep 2026 from the content-negotiation endpoint of the Publications Office of the EU official text repository (CELEX 32016R0679 and 32021D0914) and compared word for word.
The usual reading entry points are EUR-Lex CELEX:32016R0679 and Implementing Decision (EU) 2021/914; on 12 Sep 2026 that site reported itself as temporarily not fully available, and this page makes no claim to have tested those links.
On the China side the page cites Arts. 36 and 48 of the Data Security Law, Arts. 55 and 56 of the Personal Information Protection Law, and Arts. 4 and 10 of the Provisions on Promoting and Regulating Cross-Border Data Flows (CAC Order No. 16), based on the 2026-09 edition of the platform knowledge corpus.
This page is decision-support material, not legal advice; have licensed counsel review it before any signature.