Data Processing Agreement
1. Parties and when this agreement applies
This Data Processing Agreement (DPA) is between FGC Co., Ltd. as processor and the customer business identified in an accepted order as controller. It applies when incorporated into that order or separately accepted by both parties. Publishing or reading it does not establish a processing agreement. For processing on the customer’s behalf, this DPA prevails over conflicting general service terms; a specifically agreed data-protection addendum may supplement it.
2. Processing details
The subject matter is delivery of the customer’s subscribed PorThorOS service, for its agreed term and the subsequent return or deletion process. Activities include collection through authorized inputs, organization, hosting, retrieval, access, reporting, export and deletion. Data subjects may include the customer’s owners, staff, suppliers, customers and patients. Data may include identity and contact information, permissions, sales and stock records, and health or prescription records where enabled. The accepted order must identify the enabled scope and any additional categories.
3. Instructions and lawful collection
FGC shall process customer personal data only on documented lawful instructions, including the accepted order and authorized use of service features, unless applicable law requires otherwise. FGC shall inform the customer of a legally required departure unless prohibited, and flag instructions it considers unlawful. The customer shall establish lawful bases, issue notices, obtain required consent and restrict sensitive data to necessary, authorized uses. This DPA is not a substitute for patient consent or a lawful exception.
4. Confidentiality and security
FGC shall limit access to authorized personnel subject to confidentiality duties and apply technical and organizational measures appropriate to the data and risks, including access management, secure handling and incident response. The parties shall document service-specific security requirements before processing sensitive records. The customer shall manage its users, devices and credentials. This DPA does not represent a security certification or a specified recovery-time guarantee.
5. Subprocessors and international transfers
Before engaging a subprocessor for customer data, FGC shall provide its identity, role and processing location and obtain the customer’s written authorization, specific or general. Under general authorization, FGC shall give advance notice of changes and a reasonable opportunity to object on data-protection grounds. FGC shall impose equivalent processing obligations on subprocessors and remain responsible for their performance of those obligations. Transfers outside Thailand require an applicable lawful mechanism and safeguards. A provider inventory and relevant transfer arrangements must be supplied with the customer’s processing arrangements; website analytics providers are not automatically authorized for patient records.
6. Personal-data breaches
FGC shall notify the customer without undue delay after becoming aware of a personal-data breach affecting customer data. Available information shall include the nature and scope, affected data and people where known, likely consequences, mitigation and a contact for follow-up; information may be provided in stages. FGC shall cooperate in investigation and containment. The customer remains responsible for controller notifications to authorities and individuals, with FGC’s assistance; FGC remains responsible for its own statutory duties.
7. Rights requests and compliance assistance
FGC shall promptly pass requests relating to customer-controlled data to the customer and shall not independently decide them unless legally required or instructed. Taking account of the processing and available information, FGC shall assist with access, correction, deletion, restriction, portability, incident notifications and relevant risk assessments. FGC shall maintain required processing records and provide information reasonably necessary to demonstrate compliance, including proportionate audits agreed with safeguards for other customers’ information.
8. Return, deletion and legal retention
On termination or the customer’s lawful instruction, FGC shall return or delete customer personal data as the customer directs, subject to legal retention requirements. Before closure, the parties shall document the export method, delivery and deletion timetable, backup handling and any required retained records. Retained copies shall remain protected and restricted to the retention purpose; FGC shall confirm completion on request. A billing dispute does not remove statutory data-protection duties.
9. Customer contacts and FGC’s own processing
The customer shall nominate authorized instruction and incident contacts and keep them current. Send processing requests and incident notices to hello@porthoros.com, identifying the business without unnecessary sensitive attachments. FGC’s independent processing of service administration, billing and security information is described in the Privacy Policy; it is not permission to repurpose patient records for marketing.
10. Law, changes and completion of the order
Thai law and applicable data-protection law govern this DPA. Changes require the applicable agreement process, not merely a website update. Before accepting an order involving personal data, the parties must record the customer identity, scope, authorized contacts, subprocessors and locations, security requirements, and return/deletion arrangements. Thai and English versions are available; any agreed language precedence belongs in the order.
