PDPA / DPA

Data Processing Agreement (DPA) – Dragon Hispeed Co., Ltd.

Version 1.1, effective 2 October 2026

This English version is a translation provided for convenience. If it differs from the Thai version, the Thai version prevails (clause 14.5).

Clause 1 Acceptance and Effect

1.1 This Data Processing Agreement (the "Agreement") forms part of the Terms of Service of Dragon Hispeed Co., Ltd. (the "Provider") and applies to the web hosting, email hosting, email server, VPS, server, domain registration and related services (the "Services").

1.2 The Customer accepts this Agreement by clicking to accept it during ordering or in the Provider's member system. The Provider keeps a record of each acceptance, namely the user account, the version of the Agreement, the date and time, and the IP address, as evidence.

1.3 The Provider does not sign data processing contracts, agreements or forms prepared by the Customer, unless separately agreed in writing for an enterprise service. Any term in the Customer's purchase order or documents that conflicts with or adds to this Agreement does not bind the Provider.

1.4 If this Agreement conflicts with the Terms of Service on matters of personal data processing, this Agreement prevails.

Clause 2 Definitions

• "Data Protection Law" means the Personal Data Protection Act B.E. 2562 (2019) and its subordinate legislation, as amended.
• "Personal Data", "Data Controller", "Data Processor" and "Data Subject" have the meanings given in the Data Protection Law.
• "Customer Data" means personal data that the Customer or the Customer's users upload, store, transmit or process on the Services, such as website files, databases and email.
• "Breach" means a breach of the Provider's security measures that results in Customer Data being lost, or unlawfully accessed, used, altered or disclosed.
• "Control Panel" means the systems the Provider makes available for the Customer to manage the Services, such as the member system, control panel, webmail, SSH, FTP or API.
• "Administrator Password" means the password or key of the root account, or of the account with the highest privileges, on a VPS or server.

Clause 3 Roles of the Parties and Scope of Processing

3.1 For Customer Data, the Customer is the Data Controller (or a Data Processor acting on behalf of another controller) and the Provider is the Data Processor.

3.2 The Provider processes Customer Data only as necessary to provide the Services and to keep its systems secure, as described in Annex A, and will not use Customer Data for any other purpose.

3.3 The Customer represents that it has a lawful basis for collecting, using and disclosing Customer Data and has informed Data Subjects as required by law.

3.4 The Provider does not inspect the content of the data the Customer stores, except for automated security checks described in Annex A or to fix a problem at the Customer's request. The Customer alone decides what types of personal data to store on the Services.

3.5 The standard Services are not designed to store sensitive personal data under section 26 of the Data Protection Law (such as health data, biometric data or criminal records) or payment card data. If the Customer stores such data without a separate enterprise agreement, the Customer must put appropriate additional safeguards in place itself, such as application-level encryption, and is solely responsible for complying with the relevant laws and standards.

3.6 For user account data, contact data, payment and tax invoice data, and usage data of the Provider's website and member system, the Provider is itself the Data Controller, and such data is governed by the Provider's privacy policy (https://accounts.dragonhispeed.com/legal/privacy) and not by this Agreement.

Clause 4 Customer Instructions

4.1 This Agreement, the Terms of Service, and the settings and actions the Customer makes through the Control Panel constitute the Customer's written instructions for processing data.

4.2 Any further instructions must be sent in writing through the Provider's contact channels. If an instruction goes beyond the standard Services, the Provider may decline it or offer to carry it out for an additional fee.

4.3 If the Provider considers that an instruction infringes the Data Protection Law, the Provider will inform the Customer and may decline to follow it.

Clause 5 Division of Security Responsibilities

5.1 The Provider is responsible for the security of the infrastructure, and the Customer is responsible for the security of everything the Customer installs or controls, as follows:

The Provider is not responsible for incidents caused by vulnerabilities, configurations or actions in areas that are the Customer's responsibility, including passwords set by the Customer that are weak or disclosed to others.

5.2 VPS and email server: No VPS or email server package includes system administration, unless the Customer has purchased a system administration service separately in writing.

(a) While the Customer has not requested the Administrator Password, the Provider holds that password and may log in to inspect, update or fix problems as it sees fit, with access being logged. This assistance is not a system administration service and does not create any duty or liability of the Provider to administer that system.

(b) Once the Customer has requested the Administrator Password, the Customer is solely responsible for the server's operating system, software, configuration, updates and security, and the Provider will log in only when the Customer requests or permits it on a case-by-case basis.

5.3 Backups: Data is an important asset of the Customer. The Provider's automatic backups (daily, with 7 days of history, for packages that include them) are only a supplementary measure to help reduce damage. The Provider does not guarantee that backed-up data will be complete, correct or fully recoverable in every case. The Customer has a duty to keep regular backups of its own data outside the Provider's systems, and before every significant change. Services whose package does not state that backups are included are treated as having no backups by the Provider.

Clause 6 The Provider's Security Measures

6.1 The Provider uses technical and organizational measures appropriate to the nature and price of the Services, including at least the following:

• Access to systems is limited to personnel who need it, using secure authentication.
• Personnel access the Customer's systems or data only at the Customer's request, or when necessary to resolve a fault or security incident, and such access is logged.
• The network is protected by firewalls and monitored for anomalies.
• Security patches are applied to the systems the Provider manages.
• Personnel with system access are bound by a duty of confidentiality.

6.2 The Provider may change these measures as appropriate, provided that the overall level of protection is not reduced.

6.3 If the Customer requires measures beyond the standard Services, the Customer bears the cost.

6.4 The Provider prepares and maintains a record of processing activities as a Data Processor under the Data Protection Law, and will provide the part relating to the Customer on request by the Customer or a competent authority.

Clause 7 Breaches and Suspension of Service

7.1 When the Provider becomes aware of a Breach, the Provider will notify the Customer without undue delay, giving an initial notice within 48 hours of becoming aware of it, even if not all details are yet known, and further details once the Breach is confirmed, so that the Customer can meet its legal obligations as Data Controller.

7.2 The notice will contain the details the Provider knows at that time, such as the nature of the Breach, the systems affected and the measures taken, and further information will be provided as it becomes known.

7.3 Notices are sent to the primary contact email address on the Customer's account. The Customer must keep its contact details up to date.

7.4 A Breach notice is not an admission of fault or liability by the Provider.

7.5 If the Customer's Service is compromised, used to attack other systems, sends spam or distributes malware, or if there is an event that may affect the security of the systems, data or other customers, the Provider may immediately suspend all or part of the affected Services, or delete harmful files, to the extent necessary to contain the incident, and will notify the Customer promptly. Such action is not a breach of this Agreement or of the Terms of Service.

Clause 8 Sub-processors and Infrastructure Providers

8.1 The Customer authorizes the Provider to use the sub-processors and infrastructure providers listed in Annex B.

8.2 Data center and network providers that supply only space, power, air conditioning or connectivity, and do not access Customer Data, are not sub-processors.

8.3 Before adding or replacing a sub-processor, the Provider will update Annex B on the website at least 30 days in advance. If the Customer objects on data protection grounds, the Customer may stop using the affected Services and receive a pro rata refund of the unused fees.

8.4 The Provider remains responsible to the Customer for the performance of the sub-processors it engages, subject to clause 13.

Clause 9 Data Location and Transfers Abroad

9.1 The Provider stores Customer Data, including backups, in data centers located in Thailand.

9.2 The Provider will not move the storage of Customer Data abroad unless the Customer chooses or instructs it, or the Provider has given the Customer advance notice under clause 8.3 and complies with the conditions for cross-border transfers under the Data Protection Law.

9.3 The following are not transfers abroad by the Provider under clause 9.2:

• Data transmitted over the public Internet in the normal course of the Services, including email sent to recipients abroad on the Customer's instruction.
• Access to the Customer's websites or systems by users located abroad.
• Third-party services the Customer chooses to use, such as a CDN or an external email service.

9.4 Registering, renewing and transferring domains requires sending registrant data to registrars and top-level domain registries, which may be located abroad, under the rules of ICANN and of the registry for each extension. Ordering a domain service constitutes the Customer's instruction to send that data.

Clause 10 Data Subject Requests and Assistance

10.1 If a Data Subject sends a request to exercise their rights to the Provider, the Provider will forward it to the Customer without undue delay and will not respond to the request itself, unless required by law.

10.2 The Customer can access, correct, export and delete Customer Data itself through the Control Panel, which is the Provider's main assistance in responding to Data Subject requests.

10.3 The Provider will give the Customer reasonable cooperation when a government authority investigates, or when the Customer must meet its obligations under the Data Protection Law. Assistance beyond the standard Services may be charged as agreed case by case.

10.4 If the Provider receives a lawful order or request from a court, competent official or government authority to disclose or hand over Customer Data, the Provider will comply to the extent required by law and will notify the Customer before doing so, so that the Customer has an opportunity to object, unless the law or the order prohibits such notice.

Clause 11 Audits

11.1 On the Customer's written request, no more than once a year, the Provider will provide the information necessary to demonstrate compliance with this Agreement, such as a description of its security measures, the list of sub-processors, the part of the record of processing activities relating to the Customer, and data center certifications (if any).

11.2 On-site audits may take place only when ordered by a government authority, or after a Breach that affects Customer Data. At least 10 business days' notice must be given, the audit must take place during business hours without disturbing other customers, and the Customer bears all costs. Access to data center premises is subject to the data center operator's rules, and the Provider may arrange for the audit to be conducted through documents or online instead, with the approval of the government authority where the audit is ordered by a government authority.

11.3 Auditors must be bound by confidentiality and will not be given access to other customers' data or the Provider's trade secrets.

Clause 12 Return and Deletion of Data at the End of Service

12.1 Before a Service ends, the Customer is responsible for exporting or downloading its data through the Control Panel.

12.2 After a Service ends, the Provider may keep the data for no more than 30 days so that the Customer can renew or request its return, and will then delete Customer Data from its service systems. Data in backups will be deleted according to the backup rotation cycle. The Provider has no duty to keep data beyond that period, unless required by law.

12.3 Computer traffic data is retained for the period required by the law on computer-related offences.

12.4 On the Customer's request, the Provider will confirm the deletion in writing.

Clause 13 Liability and Limitation of Liability

13.1 The Provider is liable only for actual direct damage that results directly from a failure by the Provider, its personnel or its sub-processors to comply with this Agreement or the Data Protection Law.

13.2 The Provider is not liable for indirect or consequential damage, loss of profit, revenue, reputation or business opportunity, nor for damage caused by the Customer, the Customer's users, or matters that are the Customer's responsibility under clause 5.

13.3 If data is lost or damaged, the Provider will help restore it from the latest available backup (if any). If the data cannot be restored due to the Provider's fault, the Provider will refund the fees for that Service pro rata for the remaining period, which is the sole remedy in that matter, subject to clause 5.3.

13.4 Administrative fines imposed on the Customer by a government authority because the Customer failed to meet its own obligations as Data Controller are the Customer's responsibility.

13.5 The Provider's total aggregate liability arising from or in connection with this Agreement and the Terms of Service, however many incidents occur, will not exceed the fees paid by the Customer to the Provider for the Service concerned in the 12 months before the incident, or THB 50,000, whichever is less.

13.6 Clauses 13.2 to 13.5 do not apply to damage caused by the Provider's wilful misconduct or gross negligence, and do not limit the rights that Data Subjects have under the law.

13.7 If a third party makes a claim, the Customer must notify the Provider in writing without undue delay, give the Provider the opportunity to take part in the defence or negotiations, and must not agree to any settlement that imposes an obligation on the Provider without the Provider's written consent.

Clause 14 Amendments and Governing Law

14.1 The Provider may amend this Agreement by publishing the new version on the website and notifying the Customer by email at least 30 days in advance. If the Customer does not agree, the Customer may stop using the Services and receive a pro rata refund of the unused fees. Amendments made to comply with the law, or that do not reduce the Customer's rights, take effect as soon as they are published.

14.2 This Agreement remains in effect for as long as the Provider processes Customer Data.

14.3 This Agreement is governed by Thai law.

14.4 The Customer may contact the Provider on matters relating to personal data at admin@dragonhispeed.com

14.5 If this Agreement exists in another language and the versions differ, the Thai version prevails.

14.6 If any provision of this Agreement is invalid or unenforceable, the remaining provisions continue in full force.

14.7 Continued use of the Services after a new version of this Agreement takes effect, or clicking to accept the new version in the member system, constitutes the Customer's acceptance of that version.

Annex A Details of Processing

Annex B Infrastructure Providers and Sub-processors

Domain registrant data is passed on to the registry of each domain type in accordance with that registry's policies, as a necessary condition of registering the domain.

Last updated: 2 October 2026