Data Processing Agreement

Roles

TATC TECHNOLOGY CO., LTD. acts as the Personal Data Controller for tenant relationship data. Where external model providers process prompts on our instruction, they act as sub-processors under our DPA terms and the safeguards below.

Cross-Border Transfer Safeguards

Compute and storage data is processed in our data centre in Pathum Thani, Thailand and does not leave Thailand. Where limited metadata processing occurs outside Thailand (currently only email delivery via Feishu (Lark) SMTP for form submissions), it is safeguarded by the data protection clauses in our customer agreement and the sub-processor's own terms, as disclosed in Privacy Policy Section 5.

Sub-processors

• Self-hosted Thailand facility (Pathum Thani) — GPU compute, token inference & storage
• External frontier-model endpoints — LLM inference where a model is hosted by the upstream provider
• Feishu Corporation (Lark International) — SMTP email delivery for contact forms, quote requests and support tickets. Email metadata may be processed outside Thailand under the safeguards described above. Privacy policy: larksuite.com/en-US/privacy

Security Measures

Single-tenant physical isolation for bare-metal instances, TLS in transit, encrypted backup media, 24/7 NOC monitoring and role-based access control with logged administrative actions.

Template Download

The full DPA template is available as a placeholder document. Contact info@tatc.cloud for a countersigned copy.