Legal
Version: 1.0 (Beta)
Effective: incorporated into and effective with the Fidalab Terms and Conditions ("Terms").
Parties: the Customer identified in the account registration ("Customer") and Mentalok (Hong Kong) Limited, trading as "Fidalab", of DW 543-18, Unit 501-518, 5/F, Building 19W, No. 19 Science Park West Avenue, Hong Kong Science Park, Pak Shek Kok, New Territories, Hong Kong ("Fidalab").
1.1 This DPA governs Fidalab's processing of personal data contained in documents and related content uploaded or submitted by the Customer ("Customer Personal Data"). For such data, the Customer is the controller (or, under the PDPO, the data user) and Fidalab is the processor.
1.2 This DPA does not apply to account data that Fidalab processes as controller (see the Privacy Policy).
1.3 Definitions: "Data Protection Law" means all laws applicable to the processing of Customer Personal Data, including the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") and, where applicable, the EU/UK General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act ("CCPA"). "Data Subject", "processing", "personal data breach" have the meanings in applicable Data Protection Law.
2.1 Fidalab will process Customer Personal Data only: (a) to provide the Service as described in the Terms and Annex I; (b) on the Customer's documented instructions, which the Customer gives by using the Service — uploading a document is an instruction to analyse it and, for as long as it remains stored in the Customer's account, to re-analyse it when Fidalab's analysis capability is updated or at the Customer's request; submitting a prompt to the askAI feature is an instruction to generate a draft from it; or (c) as required by law, in which case Fidalab will inform the Customer unless legally prohibited.
2.2 Fidalab will not sell Customer Personal Data, retain, use, or disclose it for any purpose other than performing the Service, or use it to train machine-learning models, and will not disclose it to any third party for that third party's sales, marketing, or advertising purposes. For clarity, storage of uploaded documents under Annex I is solely to enable re-analysis for the Customer and does not permit any use for Fidalab's own purposes.
2.3 Fidalab will inform the Customer if, in its opinion, an instruction infringes Data Protection Law.
Fidalab ensures that all personnel authorised to process Customer Personal Data are bound by confidentiality obligations and access data strictly on a need-to-know basis.
Fidalab implements and maintains the technical and organisational measures in Annex II, and will not materially degrade them during the term. The Customer is responsible for securing its own account credentials and for the lawfulness of the data it uploads.
5.1 The Customer authorises the sub-processors listed in Annex I. Fidalab will impose on each sub-processor, by written contract, data protection obligations no less protective than this DPA (back-to-back terms), including confidentiality, purpose limitation, security, and — for the AI sub-processor — a prohibition on model training and a restriction of retention to a limited period for trust-and-safety (abuse) monitoring, with deletion at the end of that period in accordance with the provider's data-processing terms.
5.2 Fidalab will give 14 days' notice (via the sub-processor page at https://www.fidalab.io/legal/sub-processors and by email to account holders) before adding or replacing a sub-processor. The Customer may object on reasonable data-protection grounds; if the objection cannot be resolved, the Customer may terminate the affected Service and Fidalab will delete the Customer Personal Data.
5.3 Fidalab remains liable for its sub-processors' performance under this DPA.
Taking into account the nature of the processing, Fidalab will assist the Customer, by appropriate technical and organisational measures, in responding to requests from data subjects (access, correction, erasure, portability, restriction, objection), given that such requests should be directed to and handled by the Customer as controller. If a data subject contacts Fidalab directly, Fidalab will promptly forward the request to the Customer and not respond substantively unless legally required.
Fidalab will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, providing information reasonably required for the Customer to meet its own notification obligations, and will cooperate in investigation and remediation.
Fidalab will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, to the extent required of the Customer by Data Protection Law and limited to information available to Fidalab.
9.1 Uploaded documents are retained and deleted in accordance with Annex I (processing description). The Customer may delete any uploaded document at any time via the Service; deletion extends to data derived from the deleted document.
9.2 On termination of the account, or on the Customer's request at any time, Fidalab will delete all Customer Personal Data, including derived data attributable to the Customer, from its live systems within 30 days, except where retention is required by law, in which case the data remains protected by this DPA and is deleted when the legal requirement ends. Data deleted from live systems may persist in encrypted backups until those backups expire in the ordinary course; backup copies are not accessed or restored except for disaster recovery, and remain protected by this DPA until they expire. On request, Fidalab will confirm deletion in writing.
9.3 Before deletion, the Customer may export extracted results in a machine-readable format via the Service.
10.1 Fidalab will make available information reasonably necessary to demonstrate compliance with this DPA, including summaries of third-party certifications or audit reports when obtained.
10.2 Where Data Protection Law grants the Customer a mandatory audit right, Fidalab will allow audits by the Customer or its independent auditor, no more than once per year, on 30 days' notice, during business hours, under confidentiality, at the Customer's cost, and without access to other customers' data.
Customer Personal Data may be processed in the locations listed in Annex I. Fidalab will ensure all transfers comply with applicable Data Protection Law through contractual safeguards with sub-processors. Where the GDPR applies to a transfer outside the EEA/UK, the parties incorporate the Standard Contractual Clauses per Annex III.
Liability under this DPA is subject to the limitations and exclusions in the Terms, except where Data Protection Law does not permit such limitation. In case of conflict regarding personal data processing, this DPA prevails over the Terms.
Changes to the named list are governed by Clause 5.2.
Fidalab does not process EEA or UK personal data under this DPA unless and until this Annex is activated. Before any EEA or UK personal data is processed, the EU Standard Contractual Clauses (Module 2: controller-to-processor, Commission Decision 2021/914) and, for transfers subject to UK data protection law, the UK International Data Transfer Addendum, will be completed and attached, incorporating the processing details in Annex I and the measures in Annex II, and will then form part of this DPA.
Fidalab acts as a "service provider" under the CCPA: it will not sell or share Customer Personal Data, will not retain, use, or disclose it outside the direct business relationship or for any purpose other than performing the Service, and certifies that it understands and will comply with these restrictions.