Data Processing Agreement

XINCA (the “Site”) is operated by XASER Green Technology Company Limited (“we”, “us”, “our”), based in Hong Kong.

Last updated: 2026-11-06

1. Who we are and the roles we take

XASER Green Technology Company Limited (“we”, “us”) acts as:

• controller of the personal data we collect to operate the Site — account data, billing data, usage logs and analytics; and
• processor of personal data you submit to us for processing, where applicable.

Where we act as processor, this Data Processing Agreement (the “DPA”) governs that processing.

2. What we process

Personal data you submit to the Site for processing (for example, order, account and support data) — names, email addresses, postal addresses, order details and payment metadata.

3. Our obligations

We will:

• process personal data only on your documented instructions, unless required by law;
• ensure that people authorised to process the data are bound by confidentiality;
• implement appropriate technical and organisational measures, including TLS 1.2 or higher in transit, access controls, and monitoring;
• not engage another processor (sub-processor) without informing you and giving you a reasonable opportunity to object;
• assist you in responding to data subject rights requests;
• notify you without undue delay, and in any event within 72 hours, of a personal data breach;
• delete or return personal data within 30 days of termination, unless the law requires us to keep it.

4. Sub-processors

Our current sub-processors are listed on our Sub-processors page. We notify you of material changes at least 30 days in advance.

5. International transfers

We are established in Hong Kong. Where personal data is transferred to a jurisdiction without an adequacy decision, we use the European Commission’s Standard Contractual Clauses and, for UK transfers, the UK ICO’s International Data Transfer Addendum.

6. Your obligations

You will: provide accurate and lawful instructions; ensure you have a lawful basis for the processing you ask us to carry out; and comply with data protection and anti-spam law, including the Unsolicited Electronic Messages Ordinance (Cap. 593) of Hong Kong and applicable overseas equivalents.

7. Governing law

This DPA is governed by the laws of the Hong Kong Special Administrative Region. Disputes are resolved by HKIAC arbitration in Hong Kong, conducted in English by a single arbitrator, except where applicable data protection law requires a different forum.

8. Contact

[email protected] · Security incidents: [email protected] · Data Protection Officer: [email protected]

Registered office: Unit 809, Kingsford Industrial Centre, 13 Wang Hoi Road, Kowloon Bay, Hong Kong