Data Processing Addendum
1. Scope and roles
This Data Processing Addendum ("DPA") forms part of the Terms & Conditions or other agreement (the "Agreement") between MetaEdge and the customer ("Customer"). It applies where MetaEdge processes personal data on behalf of the Customer in connection with the Services. For such processing, the Customer is the controller and MetaEdge is the processor. Where MetaEdge determines the purposes and means of processing (for example, its own account, billing, and security data), MetaEdge acts as an independent controller under its Privacy Policy.
2. Definitions
"Data Protection Law" means all laws applicable to the processing of personal data, including the EU GDPR, the UK GDPR, and the Taiwan Personal Data Protection Act. "Personal data", "processing", "controller", "processor", "sub-processor", and "data subject" have the meanings given in the applicable Data Protection Law.
3. Processing on documented instructions
MetaEdge will process personal data only on the Customer's documented instructions (including as set out in the Agreement and Annex I), unless required by law, in which case MetaEdge will inform the Customer unless legally prohibited. MetaEdge will notify the Customer if, in its opinion, an instruction infringes Data Protection Law.
4. Confidentiality
MetaEdge ensures that personnel authorised to process personal data are bound by appropriate confidentiality obligations.
5. Security
MetaEdge implements appropriate technical and organisational measures to protect personal data, as described in Annex II, taking into account the state of the art, costs, and the risk to data subjects.
6. Sub-processors
The Customer provides general authorisation for MetaEdge to engage sub-processors to support the Services. The current sub-processors are listed in the MetaEdge Sub-processors List. MetaEdge will impose data-protection obligations on each sub-processor no less protective than this DPA and remains responsible for their performance. MetaEdge will give the Customer prior notice of any intended addition or replacement of a sub-processor and a reasonable opportunity to object on reasonable data-protection grounds.
7. Data subject rights
Taking into account the nature of the processing, MetaEdge will assist the Customer by appropriate measures, insofar as possible, to respond to requests from data subjects exercising their rights under Data Protection Law.
8. Assistance to the Customer
MetaEdge will assist the Customer in ensuring compliance with obligations relating to security, breach notification, data protection impact assessments, and prior consultation, taking into account the nature of processing and the information available to MetaEdge.
9. Personal data breach
MetaEdge will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's personal data, and will provide information reasonably available to help the Customer meet its notification obligations.
10. Deletion or return
On termination of the Services, MetaEdge will, at the Customer's choice, delete or return the personal data and delete existing copies, unless retention is required by law.
11. Audits
MetaEdge will make available information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates, subject to reasonable notice, confidentiality, and frequency limits.
12. International transfers
Where personal data is transferred outside the EEA, the UK, or another jurisdiction requiring safeguards, the parties will rely on an appropriate transfer mechanism, including the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), which are incorporated by reference.
13. Liability, term, and governing law
This DPA is subject to the liability provisions of the Agreement. It takes effect on the effective date and continues while MetaEdge processes personal data for the Customer. This DPA is governed by the laws of Taiwan (R.O.C.), and any dispute is subject to the exclusive jurisdiction of the Taiwan Taipei District Court, except that where the Standard Contractual Clauses apply, their mandatory governing-law and forum terms prevail to the extent required for their validity, and mandatory data-protection rights of the data subject's jurisdiction continue to apply.
14. Contact
Data-protection matters: legal@metaedge.xyz. EEA/UK representative: wesley@metaedge.xyz. Data Protection Officer: thomas@metaedge.xyz.
Annex I — Details of processing
| Item | Detail |
| Subject matter | Provision of MetaEdge governed web-data and edge-network Services to the Customer. |
| Duration | For the term of the Agreement plus any legally required retention. |
| Nature & purpose | Processing necessary to deliver, secure, and support the Services as instructed by the Customer. |
| Types of personal data | [As determined by Customer's use — e.g. identifiers, contact data, technical/usage data. Customer must not submit special-category data unless agreed.] |
| Categories of data subjects | [As determined by Customer — e.g. Customer's own users/end-customers.] |
Annex II — Technical and organisational measures
Access control and least-privilege permissions; multi-factor authentication for administrative access.
Encryption of data in transit and, where appropriate, at rest.
Network security, logging, and monitoring.
Secure development and change-management practices.
Personnel confidentiality obligations and security training.
Backup, resilience, and incident-response procedures.
Annex III — Sub-processors
See the separate MetaEdge Sub-processors List, which forms part of this DPA.