Personal Data Processing Agreement

【Controller’s business name】 (the “Controller”) and AlienPeoples (the “Processor”) enter into this agreement under Article 26 of Korea’s Personal Information Protection Act for the entrustment of the Controller’s personal data processing operations to the Processor.

Article 1Purpose

This agreement defines both parties’ rights and obligations when the Controller entrusts the Processor with personal data processing necessary for the SiCusto AI Customer Support service and the Processor diligently performs that work under this agreement and applicable laws.

Article 2Definitions

• End customer — A data subject using the Controller’s support page (https://sicusto.com/chat/{controller-id}).
• Subprocessor — A party to whom the Processor further entrusts part of the operations. Listed in Annex 1.
• Management page — The Processor-provided interface where the Controller’s staff view conversation records, usage, and settings (/portal/).
• Other terms follow the Personal Information Protection Act and the service terms of use.

Article 3Scope of operations and data processed

① The Processor performs only the following operations.

② The Processor does not expand the data processed without the Controller’s instructions. The Controller cooperates in maintaining notices on the support page telling end customers not to enter resident registration numbers, card numbers, bank account numbers, or passwords (the Processor masks these on the server, but the regular expression-based method may miss some).

Article 4Processing term

The processing term equals the effective term of the service agreement (【Start date】 to the service agreement’s end date). Confidentiality, destruction, and damages provisions remain effective after termination until their purposes are fulfilled.

Article 5Subprocessing restrictions 【Legal review】 Method of consent to subprocessing

1. The Processor does not further entrust operations to third parties without the Controller’s prior consent. By signing, the Controller consents to subprocessing by the subprocessors in Annex 1.
2. In phase 1, the AI providers are the same 3 providers for all clients (Annex 1); providers are not fixed separately for each Controller.
3. To add or change a subprocessor, the Processor gives written notice (including email) 【N】 days before implementation. If the Controller objects within that period, the Processor either does not apply the change to that Controller, or the Controller may terminate the service agreement without penalty.
4. The Processor imposes equivalent protection obligations on subprocessors and is responsible to the Controller for their processing.

Article 6Security safeguards

The Processor takes these measures under Article 29 of the Personal Information Protection Act and relevant public notices.

• Storage location and separation — Stored in Korea’s Seoul region (Google Cloud asia-northeast3), with data separated by Controller-specific paths. Storage is server-only; browsers cannot directly read or write it.
• Access control — Processor-side access is limited to the operations lead. Controller-side access is limited to management page members (owner/member roles); owner actions such as applying knowledge, changing members, and exporting require a renewed check of recent login (within 12 hours).
• Data minimization — Only copies with sensitive information (resident/alien registration numbers, card numbers, bank account numbers, passwords), phone numbers, and email addresses masked are stored and sent to AI providers. Handoff contact details are retained in original form for replies (Annex 2 periods).
• Access logs — Full-conversation viewing, exports, setting changes, deletion, and member changes on the management page are audited (Annex 2 periods).
• Transmission — The support page, management page, and AI provider API calls use HTTPS (TLS).
• Backup and recovery — Point-in-time recovery and daily backups (7-day retention) are operated; recovery follows a separate procedure (operations document D-5).

Article 7Prohibition of use beyond the stated purpose

1. The Processor does not use personal data or provide it to third parties for purposes outside the entrusted operations.
2. The Processor does not use personal data for AI model training or improving its services and uses AI subprocessors only under terms excluding training use (Annex 3).
3. The Processor does not disclose personal data learned through the entrusted operations, during or after this agreement.

Article 8Management and supervision

1. The Controller may request processing status, safeguard implementation, and subprocessing information; the Processor provides it without delay. Basic materials are Annex 1 (subprocessor list), Annex 2 (retention/deletion table), operations document D-5, and management page activity logs.
2. The Controller may conduct 【1】 written inspection per year. The Processor implements requested corrections within a reasonable period and reports the result.

Article 9Training

The Processor trains personnel handling personal data (including the operations lead) on personal data protection at least annually and supplies training records on request. The Controller may specify training content if needed.

Article 10Data subjects’ rights

1. The Controller receives and handles end customers’ requests for access, correction, deletion, or suspension of processing; the Processor assists on request. Requests received directly by the Processor are forwarded to the Controller without delay.
2. The Controller may delete one conversation directly using the management page’s session deletion tool, or request the Processor’s help locating a particular end customer’s records. Deletion scope and deadlines follow Annex 2.

Article 11Personal data incident notification 【Legal review】 Deadlines and allocation of reporting duties

1. Upon learning of loss, theft, or leakage of personal data in the entrusted operations (an “Incident”), the Processor notifies the Controller without delay. The initial notification target is within 24 hours of awareness; unconfirmed details are marked “under investigation” and reported first.
2. The notice includes circumstances, affected data/counts (including estimates), measures taken, measures required of the Controller, and a contact point. Follow-up reports are made as facts are confirmed.
3. Data-subject notification and reports to the Personal Information Protection Commission/specialized agencies (Article 34 of the Act) are the Controller’s obligations as personal data controller; the Processor provides required materials and assistance. This contractual notification commitment is separate from statutory reporting obligations.
4. Procedural details (reporting channels · evidence preservation · alternatives when the representative is absent) follow “Incident response and notification” in operations document D-5.

Article 12Return and destruction on termination

1. On termination, the Processor gives the Controller conversation records, handoff requests, and usage ledgers as export files (JSON · CSV) within the requested period. The Controller may also download full conversations from the management page during the agreement.
2. After return (or within 【30】 days of termination if return is not wanted), the Processor deletes production originals and reports the result. Backups expire after their 7-day retention; subprocessor copies and already-sent emails are handled under Annex 2.
3. Legally required transaction records (such as tax invoices) are retained separately for the required period, then destroyed. Usage aggregates without personal data may remain for accounting for the Annex 2 periods.

Article 13Processing abroad 【Legal review】 Overseas transfer basis (Article 28-8 of the Act)

1. Masked support messages and knowledge materials are sent to the Annex 1 AI providers (United States and other countries) to generate replies; email may traverse overseas infrastructure. Storage is in Korea’s Seoul region.
2. This agreement sets processing terms between the parties and does not itself establish a lawful basis for transferring end customer data abroad. The Controller discloses in its privacy policy the data, countries, timing, methods, recipients/contact details, purpose, retention periods, and refusal methods/effects, or obtains necessary consent. The Processor supplies wording (AI disclosure set D-3).
3. The Controller determines the basis through legal review (consent · disclosure of entrusted processing/storage necessary for contract performance, etc.).

Article 14Damages 【Legal review】 Limits and exclusions of liability

1. The Processor compensates damage to the Controller or data subjects resulting from its own or a subprocessor’s breach of this agreement.
2. The cap is 【Choose: fees for the 12 months preceding the month of damage / a fixed ○○ KRW】, excluding damage due to the Processor’s intent/gross negligence and liability that cannot legally be limited.
3. If the Controller compensates a data subject for a cause attributable to the Processor, the Controller may seek recourse from the Processor.

Article 15Precedence and other matters

• For personal data processing, this agreement prevails over service terms and quotations.
• Unspecified matters follow applicable laws including the Personal Information Protection Act; dispute jurisdiction follows the terms of use.

Execution date 【YYYY-MM-DD】

Annex 1Subprocessor (processor) list

Attach the signing-date version of the Processor/Subprocessor Register (D-2) to this annex.

Annex 2Retention and deletion table

Confirm retention/deletion periods against this table and the privacy policy at signing.

Individual end customer deletion (Controller request)

Annex 3Commitments on no training use and data retention