Legal

Data Processing Agreement

Last updated: 25 July 2026

This Data Processing Agreement ("DPA") forms part of the agreement between you ("you", "the Seller", the data controller) and Hoseh Technology ("Hoseh Seller", "we", "us", the data processor), and governs how Hoseh Seller processes personal data on your behalf when you connect a marketplace shop and use the Hoseh Seller application ("the Service"). It supplements our End User Licence Agreement, Terms of Service, and Privacy Policy. Where this DPA conflicts with those documents on the subject of data processing, this DPA prevails.

By accepting this DPA at signup and by connecting a shop, you instruct and authorise Hoseh Seller to process the personal data described below as your processor.

1. Roles of the Parties

You are the data controller of your store's data, including the buyer personal data and order/financial data made available through the marketplaces you connect (Shopee, Lazada, TikTok Shop — "the Platforms"). Hoseh Seller acts solely as your data processor (and, in respect of Platform-derived data, as a data intermediary acting on the relevant Platform's terms). The Platforms are not parties to this DPA but are intended third-party beneficiaries with respect to their data, and their developer terms flow down to and bind this processing.

For your own account-registration data (such as your name and email address), Hoseh Seller acts as an independent data controller, as described in our Privacy Policy. This DPA governs only the store data Hoseh Seller processes on your behalf as your processor.

2. Subject-Matter, Duration, Nature & Purpose

3. Processing Only on Your Instructions

Hoseh Seller processes personal data only on your documented instructions. Your acceptance of this DPA, your connection of a shop, and your use of the Service constitute your complete instructions. We will not process the data for any other purpose unless required by law, in which case we will inform you first unless that law prohibits it. We process only the connecting Seller's own data, never another seller's, and we never combine the Platforms' data into a single blended cross-platform figure.

4. Confidentiality

Hoseh Seller ensures that personnel authorised to process the data are bound by confidentiality obligations, are granted least-privilege access on a need-to-know basis, and are appropriately trained.

5. Security Measures

Hoseh Seller maintains a written information-security program with administrative, technical, and physical safeguards appropriate to the risk, including: encryption of data in transit using TLS 1.2 or higher; encryption of stored OAuth tokens; access controls with individual named accounts and least-privilege permissions; prompt revocation of departed personnel's access; and logging and monitoring to detect unauthorised access.

6. Sub-Processors

You authorise Hoseh Seller to engage sub-processors to provide the Service. Each sub-processor is engaged under written terms at least as protective as this DPA, processes data only on Hoseh Seller's instructions, and Hoseh Seller remains fully liable for their performance.

Hoseh Seller engages sub-processors in the following categories: database, authentication and server hosting; AI text generation — Google (Gemini API), which we name specifically because it is the provider that receives your figures to generate text; error and performance monitoring; transactional email; and public website hosting. The current list of named providers, and each one's processing location, is available to you on request — email hello@hoseh.app. We will give you notice of any intended addition or replacement of a sub-processor, giving you the opportunity to object on reasonable data-protection grounds.

Automated processing by an AI sub-processor. Where you use Hoseh Seller's AI features, we send the Google Gemini API your own PII-free summary figures and, for the in-app assistant, the names of your own products and the text of any question you type. Buyer personal data, order IDs, SKU codes, and raw records are never sent, and an automated allowlist check blocks any request in which personal data is detected. The AI narrates figures Hoseh Seller has already computed; it is not the source of truth and performs no automated decision-making with legal or similarly significant effects. During pre-launch testing these features run on the provider's standard tier, under which submitted text may also be used to improve the provider's own services. Hoseh Seller will move to the provider's paid tier — under which submitted content is not used for model training — before any real marketplace data is processed.

7. Cross-Border Transfers

Where personal data is processed or stored outside your country by a sub-processor, we take steps to ensure it remains protected to a standard consistent with Malaysia's PDPA 2010, including contractual safeguards. Where a Platform's terms require its prior written consent for a restricted cross-border transfer of its data, we will obtain that consent before transferring.

8. Assistance & Third-Party Demands

Taking into account the nature of the processing, Hoseh Seller will assist you, by appropriate technical and organisational measures and so far as reasonably possible, in responding to data-subject requests and in meeting your security, breach-notification, and impact-assessment obligations. If we receive a data-subject request directly, we will refer it to you. Before disclosing personal data in response to any third-party or legal demand, we will, where lawful, give the relevant Platform advance notice as that Platform's developer terms require, and notify you.

9. Personal-Data Breach Notification

If Hoseh Seller becomes aware of a personal-data breach affecting data processed under this DPA, we will notify you without undue delay and provide the information you reasonably need to meet your own notification obligations.

Where Platform data is affected, we will also notify the relevant Platform within the time that Platform's developer terms require. Where the law requires it, we will notify the relevant data-protection authority (in Malaysia, the Personal Data Protection Commissioner) and affected individuals within the time the law requires. In every case we will cooperate in containment and remediation.

10. Retention

Hoseh Seller removes buyer personal data before storage and does not retain it. The raw payload received from a Platform is deleted after 90 days. The Seller's own derived order and financial figures, with buyer personal data removed, are retained for as long as the relevant shop remains connected and the account is active, to provide the Service — subject to the Platforms' developer terms and applicable law, and to deletion on the Seller's request.

Tax-turnover records (monthly regional aggregates containing no buyer or order-level detail) are retained until the Seller deletes their account, so that rolling 12-month threshold tracking remains accurate.

11. Return & Deletion

On disconnection of a shop or termination of your account, Hoseh Seller stops accessing that shop's data and deletes the synced marketplace data within 14 days, except where retention is required by law. We will certify deletion on your reasonable request. You may request an export of your data before deletion.

12. Audit & Demonstrating Compliance

Hoseh Seller will make available the information reasonably necessary to demonstrate compliance with this DPA. You acknowledge that the Platforms retain their own audit, inspection, security-assessment, suspension, and termination rights over Hoseh Seller's processing of their data under their developer terms, and that Hoseh Seller must cooperate with those rights.

13. Liability

Each party's liability under this DPA is subject to the limitations and exclusions set out in the Terms of Service and EULA, to the maximum extent permitted by applicable law.

14. Governing Law

This DPA is governed by the laws of Malaysia, and disputes are subject to the courts of Malaysia. Nothing in this DPA limits any mandatory data-protection rights available to you under Malaysian law, which apply regardless of this clause. Where we make the Service available in another country in future, mandatory rights available to you under that country's law are likewise not affected.

15. Acceptance & Changes

You accept this DPA when you tick the acceptance box at signup. We may update this DPA from time to time; we will notify registered users of material changes by email and update the "Last updated" date. Continued use of the Service after changes constitutes acceptance of the revised DPA.

16. Contact Us