Data Processing Agreement (DPA)

This agreement is part of the Checkslip terms of use, between บริษัท โฮโลแกรม จำกัด (the "processor" or the "Company") and the user of the service (the "controller" or "you").

1. Roles

2. Processing details

• Purpose: fetch whether the bank holds the transfer on a slip, detect duplicate slips, and return the result through the API
• Data processed: the sender's and recipient's names, bank, part of the account number as shown on the slip, amount, time and reference number
• Slip images: used only during the check, never stored
• Period: as section 8 of the Privacy Policy states

3. The Company's duties

3.1 Process data only on your lawful instructions, and tell you at once if an instruction seems unlawful
3.2 Team members with access to the data are bound to keep it confidential
3.3 Security: connections over HTTPS (TLS) · access limited to what is needed
3.4 Help you answer data subjects' requests as far as is technically possible
3.5 Sub-processors: the Company uses cloud providers and transfer-checking systems, bound by confidentiality and security duties no weaker than this agreement
3.6 Report a data breach that affects your data without delay, within 48 hours of learning of it, with the details, the fix and the steps taken to prevent it happening again
3.7 When you stop using the service, delete your data unless the law requires the Company to keep it; the bank's answers kept for a while, which are not tied to an account, stay for no more than 90 days

4. Your duties

• Obtain the data you send lawfully, and have a lawful basis to send it to the Company for processing
• Tell your customers in your own privacy notice that slips are sent to an outside provider to be checked
• Keep your API keys safe

5. Limitation of liability

The Company is not liable for claims by data subjects that arise from following your instructions, or from your failure to comply with personal data protection law. Other liability follows the terms of use, section 1.7.