附件一　数据处理附录（DPA）

LayraxAI Pte. Ltd.（新加坡）　版本：【1.0】　生效日期：【年】年【月】月【日】日

本《数据处理附录》（下称“本附录”或“DPA”）是《LayraxAI 企业服务协议》与《LayraxAI 专业服务协议》的附件一（视客户类型所适用的一份，以下统称“主协议”），并构成主协议的组成部分，用以规范 LayraxAI 就客户个人数据所进行的处理。本附录自其生效日起生效，由客户与 LayraxAI Pte. Ltd.（一家根据新加坡法律设立的公司，下称“LayraxAI”、“我们”）签署。

优先顺序（重要）。　就客户个人数据的处理事项，本附录与主协议不一致的，以本附录为准（主协议第 5.1 条）；本附录、主协议与《服务模块说明》就特定服务模块另有约定的，就该模块以该特别约定为准。本附录附表所列跨境传输机制为补充性安排，不减损任何适用法域强制性法律所要求的保护措施。

1. 定义

1.1　“个人数据”　指与已识别或可识别的自然人有关的任何信息，不包括经匿名化后已不能识别特定自然人的数据。依适用法域不同，该术语分别对应：新加坡《2012 年个人数据保护法》（PDPA）项下的“personal data”；以及适用的美国隐私法律项下的“personal information”。

1.2　“敏感个人数据”　指适用法域法律予以特别保护的个人数据类别，包括但不限于适用法律所定义的敏感个人信息或特殊类别个人数据（如精确地理位置、特定健康信息、生物识别信息等，以适用法律的定义为准）。

1.3　“处理”　指对个人数据进行的任何操作，包括收集、记录、存储、组织、检索、使用、披露、传输、删除与销毁。

1.4　“控制者”与“受托处理者”　“控制者”指决定处理目的与方式的主体，即新加坡 PDPA 项下的“组织”；“受托处理者”指代表控制者并按其指示处理个人数据的主体，在各适用法域下分别对应新加坡 PDPA 项下的“数据中介”、美国隐私法律项下的“service provider”（服务提供者）等相应角色。

1.5　"客户个人数据"指我们为提供本服务而代表客户处理的、包含于客户内容中的个人数据，以及客户为其最终用户开通账号而提供的该等最终用户的账号注册、身份核验、登录与使用信息。

1.6　“数据主体”　指个人数据所涉的自然人。

1.7　“数据保护法律”　指适用于我们处理客户个人数据的各法域数据保护、隐私与网络安全法律及其附属规定，包括新加坡 PDPA 及其附属条例（含《个人数据保护（数据泄露通知）条例 2021》《个人数据保护条例 2021》），以及客户所在法域其他适用的数据保护与隐私法律。

1.8　“个人数据泄露”　指因安全措施被破坏，导致我们所存储、传输或以其他方式处理的客户个人数据，被意外或非法销毁、丢失、篡改、未经授权披露或访问的事件。

1.9　“子处理者”　指我们为提供本服务而委托处理客户个人数据的关联方或第三方服务提供方。

1.10　“去标识化数据”　指客户个人数据经本附录第 5 条去标识化处理后的数据集。去标识化数据仍属个人数据，本附录关于个人数据的规定均予适用。

1.11　“安全事件”　与主协议第 3.5 条、第 5.5 条所使用者同义。

1.12　“匿名化数据”　指客户个人数据经处理后已不能识别特定自然人且不能复原的数据。匿名化数据不属于个人数据，其处理见第 5.5 条。

2. 适用范围与角色

2.1　适用范围。

(a) 本附录适用于我们为提供本服务而代表客户处理的客户个人数据，即客户商业账号下客户内容（含业务数据）中的个人数据；本附录对《LayraxAI 企业服务协议》项下的企业、机构或其他组织客户，以及《LayraxAI 专业服务协议》项下的自然人客户，一体适用。

(b) 本附录不适用于：

(i) 业主、甲方等终端客户以其自身名义自行注册账号、自行上传或生成内容所形成的个人数据——该等处理由我们作为控制者依《隐私政策》进行（终端客户通过客户邀请链接激活账号、并在客户商业账号下查看或留言的，不在此列，仍属客户个人数据，依本附录处理）；

(ii) 我们以自身名义作为控制者所处理的数据（如网站访客数据、市场推广与销售线索数据、计费与合同联系人的必要数据），该等处理适用我方隐私政策；

(iii) 客户依主协议第 4.10 条主动公开的作品与内容（适用该条的展示许可安排）。

本附录仅适用于第 2.1 条(a) 款所述商业账号下的客户个人数据。

(c) 因客户启用第三方服务或第三方集成而产生的个人数据处理，由客户与该第三方依其各自条款与适用法律承担；我们不就该等处理承担受托处理者责任（主协议第 2.10 条）。

2.2　角色。　就客户个人数据，客户为控制者（新加坡 PDPA 项下的“组织”），我们为受托处理者（PDPA 项下的“数据中介”），仅按照客户的指示、本附录与主协议的约定处理该等数据（主协议第 5.2 条）。去标识化处理不改变本款所述角色；主协议第 2.2 条 (e) 款关于内容按账号归属与账号隔离的安排，亦不影响本章角色的认定。

2.3　服务模块的特别约定。　《服务模块说明》就特定服务模块另有数据处理、副本提供或保留安排的，就该模块优先适用该特别约定；该特别约定未涉及的，适用本附录。

2.4　不扩大责任。　本附录不扩大任何一方在主协议项下的义务或责任；主协议第 10 条（赔偿）与第 11 条（责任限制）适用于本附录项下的处理。

3. 处理详情

我们处理客户个人数据的性质与目的、处理期限、数据类别、数据主体类别、敏感个人数据的处理、处理频率与向子处理者的转移，载明于本附录附表一。

4. 客户的指示

4.1　指示的构成。　下列内容共同构成客户关于处理客户个人数据的书面指示（下称“客户指示”）：

(a) 本附录；

(b) 主协议及其订单表；

(c) 客户（含其管理员）通过账户控制台、产品内配置工具或其他由我们提供的工具作出的配置与指令；

(d) 客户就特定处理事项另行作出的书面授权。

4.2　仅依指示处理。　我们仅依客户指示处理客户个人数据，以提供、维护本服务并保障其安全，法律另有强制性要求的除外（该情形下我们将在处理前通知客户，法律禁止通知的除外）。就客户个人数据进行去标识化并将去标识化数据用于模型训练、改进与质量保障的，依第 4.4 条及第 5 条处理。

4.3　指示违法的通知。　如我们认为某项客户指示违反数据保护法律，我们将及时以书面方式通知客户。

4.4　训练与模型改进的特别指示。　客户依主协议第 4.4 条作出的指示，构成客户指示的组成部分：我们就客户内容进行去标识化处理，并将去标识化数据用于我们人工智能模型与算法的训练、改进与质量保障；我们就该等数据作进一步处理使其达到匿名化标准（主协议第 4.4 条 (d) 款）。上述处理的标准与限制见本附录第 5 条。

4.5　后续指示。　客户可依第 4.1 条 (c) 项所列工具随时调整指示，但限于本服务所提供的工具与配置选项支持的范围；超出本服务既有功能、或需要额外成本与技术投入的处理，需经双方另行书面约定。

4.6　处理者的额外承诺。　我们就客户个人数据承诺：

(a) 不以任何形式向第三方出售、共享或交换客户个人数据，亦不以对价换取该等数据；双方确认，客户未将客户个人数据出售或共享给我们。本款所称“出售”“共享”等概念，依适用法域法律的定义确定。

(b) 不将客户个人数据用于跨上下文行为广告或类似用途（主协议第 13.3 条）。

(c) 仅在提供本服务所必需的业务目的范围内保留、使用与披露客户个人数据，不在我们与客户的直接业务关系之外使用该等数据，不将其与我们从其他来源获取的个人数据合并（经客户指示或法律允许的除外）。

(d) 如我们确定无法继续履行本附录项下的义务，将及时通知客户；客户合理认为我们的处理不符合本附录约定或适用数据保护法律并向我们发出合理通知的，双方本着诚信原则合作解决；合作后客户仍合理认为问题无法解决的，我们依客户书面指示停止处理受影响的客户个人数据。

5. 去标识化与模型训练

5.1　去标识化。　我们就训练目的对客户个人数据进行的处理，应达到去标识化标准，即移除或转换直接标识符及其他可用于识别特定自然人的要素。我们采取的技术与管理措施包括但不限于：

(a) 移除直接标识符，包括姓名、联系方式、精确地址、账号标识与设备持久标识符；

(b) 对客户内容（含图纸、影像、自由文本）进行派生转换，转换为我们自有的几何或结构化表示，不保留原始文件、图层、文档属性、依赖路径与时间戳等元数据；

(c) 切断派生数据与原始数据之间的链接，不保留可据以回溯至原始数据或同一来源的标识；

(d) 将派生数据集与客户原始内容分别存储，并对该数据集限制访问。

5.2　不还原承诺。　我们承诺：(a) 不保留映射表、密钥或任何可用于还原原始内容的中间数据；(b) 不尝试对派生数据集进行重新识别；(c) 不将派生数据集与其他信息比对以识别特定个人（主协议第 4.4 条）；(d) 在向其他方（含子处理者）共享去标识化数据前，通过合同约定明确禁止该接收方尝试重新识别该等数据，并要求其遵守不低于本款 (a) 至 (c) 项的同等要求；(e) 就为训练目的而复制、接入或导出的原始内容副本及其中间数据，在派生转换完成后立即安全删除，该等删除不影响我们为向客户提供服务而保存的客户内容和备份内容；(f) 除仅为验证本款所述去标识化流程是否有效之目的外，我们以去标识化形式维持并使用去标识化数据，且不尝试重新识别该等数据；我们将以公开方式（包括在我们官方网站）作出同等承诺。

5.3　不用于决定。　去标识化数据不用于对客户、其最终用户或其终端客户作出任何决定（主协议第 4.6 条 (c) 款）。

5.4　法域扩展。　如我们扩大支持地区，且该法域的法律就模型训练要求额外保障（包括向数据主体提供选择或退出机制、公开告知、或就正当利益进行评估并留存记录），我们将在向该法域客户提供服务前补充适用该等保障，并以书面或线上公告方式通知客户。

5.5　匿名化数据。　客户个人数据经处理后达到不可识别特定自然人且不能复原标准的，即构成匿名化数据，不再作为个人数据处理，本附录关于个人数据的规定不再适用于该等数据；该等数据亦不再属于客户内容或客户的保密信息（主协议第 1 条"匿名化数据"、第 4.8 条与第 8 条）。

5.6　合规声明。　我们声明：我们理解并将遵守本附录第 4.6 条与第 5 条就客户个人数据所设定的各项限制。

6. 我们的义务

我们就客户个人数据承诺：

(a) 仅在客户指示时、并按客户指示处理客户个人数据，且以为履行本服务所必需为限，法律另有强制性要求的除外；

(b) 确保所有经我们授权处理客户个人数据的人员均已承担保密义务，或受适当的法定保密义务约束；

(c) 实施并维持附表二所列的、符合行业标准的技术与组织安全措施；

(d) 履行本附录其他条款为我们设定的义务。

6.1　合规信息与审计。　在客户提出合理书面请求且符合数据保护法律要求的范围内，我们将：(i) 每年不超过一次，向客户提供我们的隐私与安全政策以及其他必要信息，以证明我们已履行本附录项下的义务；(ii) 在双方已签署适当保密协议的前提下，允许并配合由客户或其授权代表开展的审计或检查，相关费用由客户自行承担。该等审计或检查应满足下列要求：(A) 以对我们业务运营影响最小的方式进行；(B) 仅为确认我们处理客户个人数据的方式符合本附录的约定；(C) 每年开展次数不超过一次。在数据保护法律允许的情况下，我们可向客户提供与本附录合规相关的审计报告概要，以替代直接提供完整审计报告。该等结果及相关文件属于我们的保密信息。

6.2　政府与执法请求。　除法律、法规、法院或主管机关的强制性要求外，我们不向任何第三方披露客户个人数据。在法律允许的范围内，我们将在收到具有法律约束力的披露请求后及时通知客户，并在合理范围内协助客户寻求保护措施；涉及刑事调查或法律禁止通知的除外。

7. 数据主体请求

7.1　转交与协助。　在法律允许的范围内，我们收到与客户个人数据相关的数据主体权利请求后，将在【5】个工作日内通知客户；考虑到数据处理的性质，我们将在可行范围内通过实施适当的技术与组织措施协助客户回应，包括提供账户控制台中的导出与删除功能。

7.2　不直接回应。　未经客户事先书面授权，我们不直接回应数据主体请求；客户可授权我们将数据主体请求转介给客户，以便客户直接回应。如适用法律要求我们必须直接回应，我们将在回应前通知客户（法律禁止的除外）。

7.3　去标识化数据的限制。　客户个人数据已依第 5 条完成去标识化处理的，我们不保留可据以回溯至原始数据或特定个人的映射与中间数据，故可能无法就该等数据定位、检索或分离出与某一数据主体相关的信息；该等情形下，我们将在合理期限内通知客户并说明原因，并在技术上可行的范围内采取合理措施。

7.4　费用。　我们就上述协助不另行收费，但该项协助超出常规支持范围、需要额外技术投入的，我们可依《价格与订阅说明》收取合理费用；就明显无依据或过量的请求，双方可另行协商。

8. 跨境传输

8.1　概述。　我们可在附表三所列的国家或地区处理、存储或访问客户个人数据。我们仅在符合数据保护法律、且已落实相应保障措施的前提下进行跨境传输；主协议与本附录构成附表三所列接收方应遵守的、可强制执行义务的基础文件。

8.2　法域扩展。　我们将支持地区扩展至新法域的，在向该法域客户提供服务前，补充适用该法域所要求的传输机制与保障措施；补充机制达成前，我们采取加密、去标识化、访问控制等措施，以维持不低于本附录约定的保护水平。

8.3　机制失效。　如本附录或附表所列机制被废止、修订，或经有权机关认定不再有效，我们将尽合理努力采取替代或补充措施，以维持不低于本附录约定的保护水平；无法采取的，双方参照主协议第 5.3 条 (b) 款协商处理。

9. 个人数据泄露

9.1　通知客户。　我们在确认发生涉及客户个人数据的安全事件后，将在【72】小时内通知客户（主协议第 5.5 条），并提供已知的事件性质、影响范围、已采取与拟采取的措施。如客户所在法域的法律或我们与客户的约定要求更短的时限，以更短者为准。

9.2　级联通知。　子处理者就其处理的客户个人数据发生泄露并通知我们的，我们将在收到通知后无不当迟延地通知客户（新加坡 PDPA 第 26C 条项下数据中介的通知义务同旨）。

9.3　协助。　我们将尽合理努力配合客户履行其法定的告知与报告义务，包括协助客户履行向监管机构（如新加坡个人数据保护委员会 PDPC）及受影响个人的通知义务。客户对外发布涉及我们的事件信息前应与我们善意协商（主协议第 5.5 条）。

9.4　补救与复盘。　我们将及时采取补救措施，并在事件处置完成后向客户提供事件说明；涉及客户内容或客户使用的，我们同时依主协议第 3.5 条、第 7.3 条处理。

10. 技术与组织安全措施

10.1　我们将采取并维持附表二所列的措施，包括传输加密、基于角色的访问控制与最小权限原则、操作日志审计、备份与灾备、漏洞管理与安全事件响应机制（主协议第 5.4 条）。

10.2　我们可更新附表二以适应技术发展、威胁变化与服务演进，但不会实质降低对客户个人数据的整体保护水平；构成实质降低的，适用主协议第 2.8 条关于服务变更的通知与救济安排。

10.3　客户应依本附录第 12 条就其可配置的安全与数据保留事项作出配置，并自行承担配置后果（主协议第 2.3 条）。

11. 保留、副本与删除

11.1　副本、保留与删除。　客户个人数据的副本提供、保留与删除，依主协议第 5.6 条处理。为免疑义，该等删除请求不及于：依第 5 条已完成去标识化或匿名化处理的派生数据集，以及由该等数据集训练形成的模型权重、参数与算法改进成果；该等数据集与成果已不可识别特定自然人，且依第 5.2 条不保留可据以还原的中间数据。

11.2　费用。　就超出合理频次的副本提供请求，我们可依《价格与订阅说明》收取合理费用。

12. 客户的义务

12.1　合法基础与告知。　客户声明、保证并承诺：其已依据数据保护法律的要求提供所有必要的通知，并在整个协议期限内持续拥有且维持所有必要的权利、同意与授权（包括就敏感个人数据所需的同意与授权），以便向我们提供客户个人数据，并授权我们依主协议与本附录处理该等数据。

12.2　配置责任。　在不影响第 10 条项下我们安全义务的前提下，客户确认并同意：其负责本服务的部分配置与设计决策，并应按适用数据保护法律的要求实施该等配置与决策（如数据保留期限、数据删除、可见范围与导出策略）。

12.3　最小化与敏感数据。　客户应避免上传与提供服务目的无关的个人数据，并避免上传敏感个人数据；确需上传的，客户应事先取得适用法律要求的同意、采取额外保护措施，并以书面方式告知我们，以便我们采取相应的技术与管理措施。若个人数据在非结构化内容（如图纸、影像、说明文字）中被意外包含，我们将在知悉后按客户指示处理，并可依主协议第 3.5 条采取措施。

12.4　最终用户。　客户应确保其最终用户遵守本协议及我方政策（主协议第 3.2 条）。

12.5　联系人。　客户应始终向我们提供准确的联系方式，以便我们通知其数据保护负责人或指定联系人；因客户提供的联系方式不准确或未及时更新致使通知未能送达的，我们不就此承担责任。

13. 变更与终止

13.1　变更。　我们可修订本附录以反映法律变化、监管要求、服务变更或子处理者变更，但不会实质降低对客户个人数据的保护水平。构成重大变更的，我们将至少提前【30】日通知客户；客户在收到通知后【10】日内提出合理书面异议的，参照主协议第 5.3 条 (b) 款处理。

13.2　终止与存续。　本附录随主协议终止而终止；本附录中关于数据处理、保密、责任限制与争议解决的条款，在主协议终止后继续有效（主协议第 7.7 条）。

14. 联系方式

14.1　LayraxAI。　数据保护负责人（DPO）／隐私事务联系邮箱：【隐私联系邮箱】；收件地址：【新加坡注册地址】。

14.2　客户。　客户指定联系人及联系方式以账户控制台登记信息为准，客户应确保其准确并保持更新。

14.3　通知语言为【中文／英文】；以电子邮件发出的通知，在成功发送后【24】小时视为送达。

15. 签署

如双方选择单独签署本附录，请填写下列信息；未单独签署的，客户接受主协议即构成本附录的签署。

附表一　处理详情

附表二　技术与组织安全措施

附表三　处理、存储与访问地点

下列信息为当前情况，如有变更，我们依第 8.3 条与主协议第 5.3 条 (b) 款处理并以线上公布版本为准。

当前子处理者清单（含其名称、用途、类型与处理地）以我们产品内或官网公布的版本为准，我们会持续更新；新增或更换子处理者的，适用主协议第 5.3 条 (b) 款的通知与异议机制。

版本记录：版本【1.0】，发布日期【年】年【月】月【日】日。

Annex 1　Data Processing Addendum (DPA)

LayraxAI Pte. Ltd. (Singapore)　Version: 【1.0】　Effective Date: 【Year】 Year 【Month】 Month 【Day】 Day

This Data Processing Addendum (this "Addendum" or the "DPA") is Annex 1 to the LayraxAI Enterprise Service Agreement and the LayraxAI Professional Service Agreement (whichever one applies according to the Customer's customer type, collectively the "Principal Agreement") and forms an integral part of the Principal Agreement, governing the processing of Customer Personal Data carried out by LayraxAI. This Addendum takes effect on its effective date and is entered into by and between the Customer and LayraxAI Pte. Ltd., a company incorporated under the laws of Singapore ("LayraxAI", "we", "us").

Order of Precedence (Important).　With respect to the processing of Customer Personal Data, in the event of any inconsistency between this Addendum and the Principal Agreement, this Addendum prevails (Section 5.1 of the Principal Agreement); where this Addendum, the Principal Agreement, and the Service Module Description otherwise agree on a specific Service Module, such special agreement prevails for that module. The cross-border transfer mechanisms listed in the schedules to this Addendum are supplementary arrangements and do not derogate from the safeguards required by the mandatory laws of any applicable jurisdiction.

1. Definitions

1.1　"Personal Data"　means any information relating to an identified or identifiable natural person, excluding data that has been anonymized such that a specific natural person can no longer be identified. Depending on the applicable jurisdiction, this term corresponds respectively to "personal data" under the Personal Data Protection Act 2012 (PDPA) of Singapore, and to "personal information" under applicable U.S. privacy laws.

1.2　"Sensitive Personal Data"　means categories of personal data afforded special protection under the laws of the applicable jurisdiction, including without limitation sensitive personal information or special categories of personal data as defined by applicable law (such as precise geolocation, certain health information, and biometric information, subject to the definitions under applicable law).

1.3　"Processing"　means any operation performed on personal data, including collection, recording, storage, organization, retrieval, use, disclosure, transmission, erasure, and destruction.

1.4　"Controller" and "Processor"　"Controller" means the entity that determines the purposes and means of processing, i.e., an "organisation" under the Singapore PDPA; "Processor" means an entity that processes personal data on behalf of, and in accordance with the instructions of, a controller, corresponding, under the applicable jurisdictions, respectively to a "data intermediary" under the Singapore PDPA, a "service provider" under applicable U.S. privacy laws, and other equivalent roles.

1.5　"Customer Personal Data" means personal data contained in Customer Content that we process on behalf of the Customer in order to provide the Service, as well as account registration, identity verification, login, and usage information of End Users for whom the Customer opens accounts and that the Customer provides in respect of such End Users.

1.6　"Data Subject"　means the natural person to whom personal data relates.

1.7　"Data Protection Laws"　means the data protection, privacy, and cybersecurity laws of each jurisdiction applicable to our processing of Customer Personal Data, together with their subsidiary provisions, including the Singapore PDPA and its subsidiary legislation (including the Personal Data Protection (Data Breach Notification) Regulations 2021 and the Personal Data Protection Regulations 2021), as well as other applicable data protection and privacy laws of the Customer's jurisdiction.

1.8　"Personal Data Breach"　means an incident that, due to a breach of security measures, leads to the accidental or unlawful destruction, loss, or alteration of, or unauthorized disclosure of or access to, Customer Personal Data stored, transmitted, or otherwise processed by us.

1.9　"Sub-processor"　means any affiliate or third-party service provider engaged by us to process Customer Personal Data in order to provide the Service.

1.10　"De-identified Data"　means the dataset obtained after Customer Personal Data has been de-identified under Section 5 of this Addendum. De-identified Data remains personal data, and the provisions of this Addendum concerning personal data apply to it in full.

1.11　"Security Incident"　has the same meaning as used in Sections 3.5 and 5.5 of the Principal Agreement.

1.12　"Anonymized Data"　means data processed from Customer Personal Data such that a specific natural person can no longer be identified and the data cannot be restored. Anonymized Data does not constitute personal data; its processing is addressed in Section 5.5.

2. Scope of Application and Roles

2.1　Scope of Application.

(a) This Addendum applies to Customer Personal Data that we process on behalf of the Customer in order to provide the Service, i.e., personal data contained in Customer Content (including Business Data) under the Customer's Business Account; this Addendum applies uniformly to enterprise, institutional, and other organizational customers under the LayraxAI Enterprise Service Agreement, as well as natural-person customers under the LayraxAI Professional Service Agreement.

(b) This Addendum does not apply to:

(i) personal data formed where end customers such as project owners or contracting parties register accounts in their own names and upload or generate content on their own initiative — such processing is carried out by us as a controller in accordance with the Privacy Policy (this does not include cases where an end customer activates an account through the Customer's invitation link and views or comments within the Customer's Business Account, which remain Customer Personal Data and are processed under this Addendum);

(ii) data that we process in our own name as a controller (such as website visitor data, marketing and sales lead data, and necessary data regarding billing and contract contacts), the processing of which is governed by our privacy policy;

(iii) works and content that the Customer makes public on its own initiative under Section 4.10 of the Principal Agreement (to which the display license arrangements under that Section apply).

This Addendum applies only to Customer Personal Data under the Business Account described in Section 2.1(a).

(c) Personal data processing arising from the Customer's enablement of third-party services or third-party integrations is borne by the Customer and the third party under their respective terms and applicable law; we bear no responsibility as a processor for such processing (Section 2.10 of the Principal Agreement).

2.2　Roles.　With respect to Customer Personal Data, the Customer is the controller (an "organisation" under the Singapore PDPA), and we are the processor (a "data intermediary" under the PDPA), processing such data solely in accordance with the Customer's instructions and the terms of this Addendum and the Principal Agreement (Section 5.2 of the Principal Agreement). De-identification does not change the roles described in this Section; the arrangements in Section 2.2(e) of the Principal Agreement regarding attribution of content by account and account isolation likewise do not affect the determination of the roles under this Chapter.

2.3　Special Agreements for Service Modules.　Where the Service Module Description otherwise provides for data processing, copy provision, or retention arrangements for a specific Service Module, such special agreement prevails for that module; matters not covered by such special agreement are governed by this Addendum.

2.4　No Expansion of Liability.　This Addendum does not expand any obligations or liabilities of either party under the Principal Agreement; Section 10 (Indemnification) and Section 11 (Limitation of Liability) of the Principal Agreement apply to processing under this Addendum.

3. Details of Processing

The nature and purposes of our processing of Customer Personal Data, the term of processing, the categories of data, the categories of data subjects, the processing of sensitive personal data, the frequency of processing, and transfers to Sub-processors are set out in Schedule 1 of this Addendum.

4. The Customer's Instructions

4.1　Composition of Instructions.　The following together constitute the Customer's written instructions regarding the processing of Customer Personal Data (the "Customer Instructions"):

(a) this Addendum;

(b) the Principal Agreement and its order forms;

(c) configurations and directives made by the Customer (including its administrators) through the Account Console, in-product configuration tools, or other tools provided by us;

(d) separate written authorizations given by the Customer for specific processing matters.

4.2　Processing Solely per Instructions.　We process Customer Personal Data only in accordance with the Customer Instructions in order to provide and maintain the Service and to ensure its security, except where mandatory requirements of law provide otherwise (in which case we will notify the Customer before processing, unless the law prohibits notification). De-identification of Customer Personal Data and the use of de-identified data for model training, improvement, and quality assurance are handled in accordance with Section 4.4 and Section 5.

4.3　Notification of Unlawful Instructions.　If we consider that a Customer Instruction infringes Data Protection Laws, we will notify the Customer promptly in writing.

4.4　Special Instructions for Training and Model Improvement.　The instructions given by the Customer under Section 4.4 of the Principal Agreement form part of the Customer Instructions: we de-identify Customer Content and use the de-identified data for the training, improvement, and quality assurance of our artificial intelligence models and algorithms; we further process such data so that it reaches the anonymization standard (Section 4.4(d) of the Principal Agreement). The standards and limitations for such processing are set out in Section 5 of this Addendum.

4.5　Subsequent Instructions.　The Customer may adjust its instructions at any time through the tools listed in Section 4.1(c), but only to the extent supported by the tools and configuration options offered by the Service; processing that exceeds the existing functionality of the Service, or that requires additional cost and technical investment, requires separate written agreement between the parties.

4.6　Additional Commitments of the Processor.　With respect to Customer Personal Data, we undertake that:

(a) we will not sell, share, or exchange Customer Personal Data to any third party in any form, nor acquire such data in exchange for consideration; the parties confirm that the Customer has not sold or shared Customer Personal Data to us. The concepts of "sale" and "sharing" referred to in this paragraph are determined in accordance with the definitions in the laws of the applicable jurisdiction;

(b) we will not use Customer Personal Data for cross-context behavioral advertising or similar purposes (Section 13.3 of the Principal Agreement);

(c) we will retain, use, and disclose Customer Personal Data only within the scope of the business purposes necessary to provide the Service, will not use such data outside our direct business relationship with the Customer, and will not combine such data with personal data we obtain from other sources (except as instructed by the Customer or permitted by law);

(d) if we determine that we can no longer fulfill our obligations under this Addendum, we will notify the Customer promptly; where the Customer reasonably believes that our processing does not comply with the terms of this Addendum or applicable Data Protection Laws and gives us reasonable notice, the parties will cooperate in good faith to resolve the matter; if, after such cooperation, the Customer still reasonably believes the issue cannot be resolved, we will stop processing the affected Customer Personal Data upon the Customer's written instructions.

5. De-identification and Model Training

5.1　De-identification.　Our processing of Customer Personal Data for training purposes must meet the de-identification standard, i.e., the removal or transformation of direct identifiers and other elements that could be used to identify a specific natural person. The technical and administrative measures we adopt include without limitation:

(a) removing direct identifiers, including names, contact information, precise addresses, account identifiers, and persistent device identifiers;

(b) performing derivative transformation of Customer Content (including drawings, images, and free text), converting it into our own geometric or structured representations, without retaining original files, layers, document properties, dependency paths, timestamps, or other metadata;

(c) severing the links between derivative data and original data, without retaining identifiers that could be used to trace back to the original data or the same source;

(d) storing the derivative dataset separately from the Customer's original content and restricting access to that dataset.

5.2　No Re-identification Commitment.　We undertake that: (a) we will not retain mapping tables, keys, or any intermediate data that could be used to restore the original content; (b) we will not attempt to re-identify the derivative datasets; (c) we will not compare the derivative datasets with other information in order to identify a specific individual (Section 4.4 of the Principal Agreement); (d) before sharing de-identified data with other parties (including Sub-processors), we will, through contractual agreement, expressly prohibit the recipient from attempting to re-identify such data and require it to comply with requirements equivalent to, and no less than, items (a) through (c) of this Section; (e) with respect to copies of original content, and the intermediate data thereof, copied, accessed, or exported for training purposes, we will securely delete them immediately upon completion of the derivative transformation, and such deletion does not affect the Customer Content and backed-up content that we retain in order to provide the Service to the Customer; (f) except solely for the purpose of verifying whether the de-identification process described in this Section is effective, we will maintain and use de-identified data in de-identified form and will not attempt to re-identify such data; we will make an equivalent commitment publicly (including on our official website).

5.3　No Use for Decisions.　De-identified Data will not be used to make any decisions about the Customer, its End Users, or its end customers (Section 4.6(c) of the Principal Agreement).

5.4　Jurisdiction Expansion.　If we expand our supported regions and the laws of that jurisdiction require additional safeguards for model training (including providing data subjects with an opt-in or opt-out mechanism, public disclosure, or conducting legitimate-interest assessments and retaining records), we will apply such supplemental safeguards before providing services to customers in that jurisdiction and will notify the Customer in writing or by way of online announcement.

5.5　Anonymized Data.　Where Customer Personal Data, after processing, reaches the standard that a specific natural person can no longer be identified and the data cannot be restored, it constitutes Anonymized Data, is no longer processed as personal data, and the provisions of this Addendum concerning personal data no longer apply to such data; such data likewise ceases to constitute Customer Content or the Customer's Confidential Information (Section 1 "Anonymized Data", Section 4.8, and Section 8 of the Principal Agreement).

5.6　Compliance Statement.　We declare that: we understand and will abide by the restrictions imposed on Customer Personal Data by Section 4.6 and Section 5 of this Addendum.

6. Our Obligations

With respect to Customer Personal Data, we undertake that:

(a) we will process Customer Personal Data only upon, and in accordance with, the Customer's instructions, and only to the extent necessary for the performance of the Service, except where mandatory requirements of law provide otherwise;

(b) we will ensure that all personnel authorized by us to process Customer Personal Data are subject to confidentiality undertakings or appropriate statutory confidentiality obligations;

(c) we will implement and maintain the technical and organizational security measures set out in Schedule 2 that meet industry standards;

(d) we will fulfill the other obligations imposed on us by the other provisions of this Addendum.

6.1　Compliance Information and Audits.　Where the Customer makes a reasonable written request and to the extent required by Data Protection Laws, we will: (i) no more than once per year, provide the Customer with our privacy and security policies and other necessary information in order to demonstrate that we have fulfilled our obligations under this Addendum; (ii) provided the parties have executed an appropriate confidentiality agreement, permit and cooperate with audits or inspections carried out by the Customer or its authorized representatives, with the relevant costs borne by the Customer itself. Such audits or inspections must satisfy the following requirements: (A) they are conducted in the manner least disruptive to our business operations; (B) they are solely for confirming that the manner in which we process Customer Personal Data complies with the terms of this Addendum; (C) they are conducted no more than once per year. To the extent permitted by Data Protection Laws, we may provide the Customer with a summary of audit reports relating to compliance with this Addendum in lieu of directly providing complete audit reports. Such results and related documents constitute our Confidential Information.

6.2　Government and Law Enforcement Requests.　Except where required compulsorily by laws, regulations, courts, or competent authorities, we will not disclose Customer Personal Data to any third party. To the extent permitted by law, we will notify the Customer promptly upon receipt of a legally binding disclosure request and, within a reasonable scope, assist the Customer in seeking protective measures; except in criminal investigations or where the law prohibits notification.

7. Data Subject Requests

7.1　Forwarding and Assistance.　To the extent permitted by law, after receiving a data subject rights request relating to Customer Personal Data, we will notify the Customer within 【5】 business days; given the nature of the data processing, we will, to the extent feasible, assist the Customer in responding by implementing appropriate technical and organizational measures, including providing export and deletion functions in the Account Console.

7.2　No Direct Response.　Without the Customer's prior written authorization, we will not directly respond to data subject requests; the Customer may authorize us to refer data subject requests to the Customer so that the Customer can respond directly. Where applicable law requires us to respond directly, we will notify the Customer before responding (unless prohibited by law).

7.3　Limitations Regarding De-identified Data.　Where Customer Personal Data has completed de-identification under Section 5, we do not retain mappings or intermediate data that could be used to trace back to the original data or a specific individual, and we may therefore be unable to locate, retrieve, or separate information relating to a particular data subject from such data; in such circumstances, we will notify the Customer within a reasonable period and explain the reasons, and will take reasonable measures to the extent technically feasible.

7.4　Fees.　We will not charge separate fees for the foregoing assistance; however, where such assistance exceeds the scope of routine support and requires additional technical investment, we may charge reasonable fees in accordance with the Pricing and Subscription Description; for requests that are manifestly unfounded or excessive, the parties may negotiate separately.

8. Cross-Border Transfers

8.1　Overview.　We may process, store, or access Customer Personal Data in the countries or regions listed in Schedule 3. We carry out cross-border transfers only on the premise of compliance with Data Protection Laws and with the corresponding safeguards in place; the Principal Agreement and this Addendum constitute the underlying documents establishing the enforceable obligations to be observed by the recipients listed in Schedule 3.

8.2　Jurisdiction Expansion.　Where we expand our supported regions to a new jurisdiction, before providing services to customers in that jurisdiction we will additionally apply the transfer mechanisms and safeguards required by that jurisdiction; before such supplemental mechanisms are in place, we will adopt measures such as encryption, de-identification, and access controls in order to maintain a level of protection no lower than that agreed in this Addendum.

8.3　Mechanism Invalidation.　If the mechanisms listed in this Addendum or its schedules are repealed or amended, or are determined by a competent authority to be no longer valid, we will make reasonable efforts to adopt alternative or supplementary measures in order to maintain a level of protection no lower than that agreed in this Addendum; where such measures cannot be adopted, the parties will negotiate the handling with reference to Section 5.3(b) of the Principal Agreement.

9. Personal Data Breach

9.1　Notifying the Customer.　After confirming the occurrence of a Security Incident involving Customer Personal Data, we will notify the Customer within 【72】 hours (Section 5.5 of the Principal Agreement) and provide the known nature of the incident, the scope of impact, and the measures already taken and to be taken. Where the laws of the Customer's jurisdiction or our agreement with the Customer require a shorter time limit, the shorter one prevails.

9.2　Cascading Notification.　Where a Sub-processor experiences a breach of the Customer Personal Data it processes and notifies us, we will notify the Customer without undue delay after receiving such notification (to the same effect as the notification obligation of a data intermediary under Section 26C of the Singapore PDPA).

9.3　Assistance.　We will make reasonable efforts to cooperate with the Customer in fulfilling its statutory notification and reporting obligations, including assisting the Customer in performing its notification obligations to regulators (such as the Personal Data Protection Commission (PDPC) of Singapore) and to affected individuals. Before publicly releasing information regarding an incident involving us, the Customer should consult with us in good faith (Section 5.5 of the Principal Agreement).

9.4　Remediation and Review.　We will take remedial measures promptly and provide the Customer with an account of the incident after the incident has been handled; where Customer Content or the Customer's use is involved, we will also handle it in accordance with Sections 3.5 and 7.3 of the Principal Agreement.

10. Technical and Organizational Security Measures

10.1　We will adopt and maintain the measures set out in Schedule 2, including encryption in transit, role-based access control and the principle of least privilege, operational log audits, backup and disaster recovery, vulnerability management, and Security Incident response mechanisms (Section 5.4 of the Principal Agreement).

10.2　We may update Schedule 2 to adapt to technological developments, changing threats, and the evolution of the Service, but will not materially reduce the overall level of protection for Customer Personal Data; where a material reduction is constituted, the notification and remedy arrangements for service changes under Section 2.8 of the Principal Agreement apply.

10.3　The Customer should configure the security and data retention matters that are configurable by it in accordance with Section 12 of this Addendum, and bear the consequences of such configuration itself (Section 2.3 of the Principal Agreement).

11. Retention, Copies, and Deletion

11.1　Copies, Retention, and Deletion.　The provision of copies, retention, and deletion of Customer Personal Data is handled in accordance with Section 5.6 of the Principal Agreement. For the avoidance of doubt, such deletion requests do not extend to: derivative datasets that have completed de-identification or anonymization under Section 5, or the model weights, parameters, and algorithmic improvements resulting from training on such datasets; such datasets and results can no longer identify a specific natural person, and, in accordance with Section 5.2, no intermediate data enabling restoration is retained.

11.2　Fees.　For copy provision requests exceeding a reasonable frequency, we may charge reasonable fees in accordance with the Pricing and Subscription Description.

12. The Customer's Obligations

12.1　Lawful Basis and Notices.　The Customer represents, warrants, and undertakes that: it has provided all necessary notices as required by Data Protection Laws, and continuously possesses and maintains, throughout the term of the agreement, all necessary rights, consents, and authorizations (including the consents and authorizations required for sensitive personal data) in order to provide Customer Personal Data to us and to authorize us to process such data in accordance with the Principal Agreement and this Addendum.

12.2　Configuration Responsibility.　Without prejudice to our security obligations under Section 10, the Customer acknowledges and agrees that: it is responsible for certain configuration and design decisions of the Service, and should implement such configurations and decisions in accordance with the requirements of applicable Data Protection Laws (such as data retention periods, data deletion, visibility scope, and export policies).

12.3　Minimization and Sensitive Data.　The Customer should avoid uploading personal data unrelated to the purposes of providing the Service, and avoid uploading sensitive personal data; where uploading is genuinely necessary, the Customer should obtain in advance the consents required by applicable law, adopt additional protective measures, and inform us in writing so that we can take corresponding technical and administrative measures. If personal data is accidentally included in unstructured content (such as drawings, images, or captions), we will process it in accordance with the Customer's instructions after becoming aware, and may take measures under Section 3.5 of the Principal Agreement.

12.4　End Users.　The Customer should ensure that its End Users comply with this Agreement and our policies (Section 3.2 of the Principal Agreement).

12.5　Contacts.　The Customer should at all times provide us with accurate contact information so that we can notify its Data Protection Officer or designated contact; where a notice fails to be delivered due to inaccurate contact information provided by the Customer or due to failure to update it in a timely manner, we bear no liability in this regard.

13. Changes and Termination

13.1　Changes.　We may revise this Addendum to reflect changes in the law, regulatory requirements, changes to the Service, or changes to Sub-processors, but will not materially reduce the level of protection for Customer Personal Data. Where a material change is constituted, we will notify the Customer at least 【30】 days in advance; where the Customer raises a reasonable written objection within 【10】 days after receiving the notice, it will be handled with reference to Section 5.3(b) of the Principal Agreement.

13.2　Termination and Survival.　This Addendum terminates upon termination of the Principal Agreement; the provisions of this Addendum concerning data processing, confidentiality, limitation of liability, and dispute resolution continue in effect after the termination of the Principal Agreement (Section 7.7 of the Principal Agreement).

14. Contact Information

14.1　LayraxAI.　Data Protection Officer (DPO) / privacy contact email: 【privacy contact email】; mailing address: 【Singapore registered address】.

14.2　Customer.　The Customer's designated contacts and contact information are subject to the information registered in the Account Console, and the Customer should ensure their accuracy and keep them up to date.

14.3　The language of notices is 【Chinese/English】; notices sent by email are deemed delivered 【24】 hours after successful sending.

15. Execution

If the parties choose to execute this Addendum separately, please fill in the following information; where it is not executed separately, the Customer's acceptance of the Principal Agreement constitutes execution of this Addendum.

Schedule 1　Details of Processing

Schedule 2　Technical and Organizational Security Measures

Schedule 3　Locations of Processing, Storage, and Access

The following information reflects the current situation; in the event of any change, we will handle it in accordance with Section 8.3 and Section 5.3(b) of the Principal Agreement, and the version published online prevails.

The current list of Sub-processors (including their names, purposes, types, and processing locations) is subject to the version published in our product or on our official website, and we will update it on an ongoing basis; where Sub-processors are added or replaced, the notification and objection mechanism in Section 5.3(b) of the Principal Agreement applies.

Version record: Version 【1.0】, release date 【Year】 Year 【Month】 Month 【Day】 Day.