Data Processing Addendum (DPA)

Version 1 · Effective 2 November 2026

This DPA forms part of the Oho Chat Terms of Service between the Customer (“Controller”) and Oho Experience Co., Ltd., company registration no. 0105565184605, of 1 Patpong, Suriyawong, Bangrak, Bangkok 10500, Thailand (“Oho Chat” or “Processor”), under the Personal Data Protection Act B.E. 2562 (“PDPA”).

1. Scope

This DPA covers the personal data within Customer Data that Oho Chat processes on Customer's behalf, as described in Schedule 1. It does not cover data for which Oho Chat is itself the controller (for example account and billing data). That data is covered by Oho Chat's Privacy Policy.

2. Controller duties

Customer must (a) have a lawful basis for the processing it instructs Oho Chat to carry out, (b) give End Customers the notice the law requires, and (c) handle data subject requests.

3. Processor duties

3.1 Oho Chat will process personal data only on Customer's instructions, unless the law requires otherwise. Those instructions are the Terms, any Order Form, and the settings Customer chooses in the Service.

3.2 Oho Chat will limit access to staff who need it and who are bound by confidentiality.

3.3 Oho Chat will maintain appropriate security measures as described in Schedule 2.

3.4 Oho Chat will give Customer reasonable help with data subject requests. If an End Customer sends a request directly to Oho Chat, Oho Chat will pass it to Customer without delay.

4. Sub-processors and recipients Customer instructs

4.1 Customer authorises Oho Chat to use sub-processors in these categories: cloud and database providers, email delivery providers, system and error monitoring providers, and AI model providers for AI features in the Service. Oho Chat will have a contract with each sub-processor that protects data at least as well as this DPA, and remains responsible for their acts. The full named list is confidential. A business owner who is a Customer may request it at dpo@oho.chat.

4.2 Oho Chat will give the business owner at least 30 days' notice by email before adding a new category of sub-processor or replacing a main provider. Customer may object on reasonable grounds. If the parties can't resolve the objection, Customer may terminate and keep using the Service until the end of the period already paid for, in line with clause 4.5 of the Terms.

4.3 Third-Party Platforms that Customer connects itself (for example Meta, LINE, TikTok, ad platforms, and Customer's own systems or AI services) receive data on Customer's instructions. They are not Oho Chat's sub-processors.

5. Cross-border transfers

Customer acknowledges that data may be stored or processed outside Thailand, including in Singapore and the United States, depending on where sub-processors are located. Oho Chat will meet the requirements of the PDPA and the Personal Data Protection Committee's notifications for cross-border transfers.

6. Personal data breach

6.1 Oho Chat will notify Customer without undue delay after becoming aware of a breach affecting Customer Data, aiming to do so within 48 hours, so that Customer can notify the PDPC within the 72-hour deadline.

6.2 The notice will include what is known at the time: the nature of the incident, the categories of data affected, measures taken, and a contact person. Oho Chat will send updates as more becomes known.

7. Audit

Oho Chat will answer reasonable questions and provide the information needed to show compliance with this DPA, once a year, or after a breach or a regulator request.

8. Deletion

When the contract ends, Customer may export its data within 60 days. Oho Chat will then permanently delete the personal data under clause 10 of the Terms, unless the law requires it to be kept.

Schedule 1 — Processing details

Schedule 2 — Security measures

Oho Chat maintains appropriate organisational, technical and physical measures as required by the PDPA, including:

• encryption in transit (HTTPS/TLS);
• role-based access for Users, and staff access limited to what is necessary;
• backups and a system restore procedure;
• logging and monitoring of system operation and errors;
• confidentiality obligations for staff;
• automatic deletion of data 60 days after the contract ends.

Oho Chat reviews and improves these measures periodically as technology and risks change.