Data Processing Addendum (HK)

DATA PROCESSING ADDENDUM (HK)
This Data Processing Addendum (“DPA”) forms part of the agreement between the customer (“Customer”) and UDB Logistics Limited (“UDB”) and applies where UDB processes personal data on behalf of, or on documented instructions from, the Customer in connection with the Services.

For Hong Kong privacy purposes, UDB may act as a “data user” where it controls the collection, holding, processing or use of personal data. In commercial processing contexts, the parties may also use “Controller” and “Processor” terminology to describe their respective roles, where applicable.

1. Definitions

• Personal Data, Processing, Controller, Processor, Data User: as defined under applicable data protection laws, including the Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”) where applicable.
• Sub-processor / service provider: a third party appointed by UDB to process personal data in connection with the Services.

2. Scope and roles

2.1. Customer determines the shipment instructions, service requirements, and personal data provided to UDB for service execution.

2.2. UDB processes personal data only:

• to provide the Services;
• on documented instructions from the Customer, including booking instructions and shipment documentation, where UDB acts on Customer instructions; and/or
• where required or permitted by law, regulatory requirements, air cargo security / Regulated Agent requirements, customs/export control requirements, accounting, claims handling, or legitimate operational purposes.

2.3. Where UDB acts as a Processor / service provider, UDB will process personal data in accordance with this DPA and the Customer’s documented instructions, unless otherwise required by law.

3. Customer obligations

Customer is responsible for:

• ensuring it has a lawful basis / authority to provide personal data to UDB;
• ensuring instructions are lawful and do not violate applicable laws;
• ensuring shipment documents, declarations, party details, and cargo/security information are accurate and complete;
• providing any notices or consents required from its personnel, shippers, consignees, notify parties, or other data subjects where applicable.

4. Confidentiality

UDB ensures persons authorized to process personal data are bound by confidentiality obligations.

5. Security measures

UDB implements reasonable technical and organizational measures appropriate to the risk, designed to protect personal data. High-level measures may include, as appropriate:

• access controls and least-privilege;
• authentication and logging for key systems;
• secure storage and transmission practices;
• operational controls for document handling and retention;
• role-based access and document-handling controls for shipment, compliance, air cargo security, and Regulated Agent records.

(Additional details may be provided on request where appropriate for customer due diligence.)

6. Sub-processing

6.1. Customer authorizes UDB to use Sub-processors / service providers where reasonably necessary for the Services (e.g., carriers, airlines, ground handlers, trucking, warehousing, screening/security service providers, IT providers, professional advisors, and other operational partners).

6.2. Sub-processor list: due to frequent operational changes (routing, handling, trucking, security screening, warehousing), UDB provides the current list of relevant Sub-processors on request.

6.3. UDB remains responsible for Sub-processors’ performance of their processing obligations to the extent required by applicable law and relevant contracts.

7. Assistance to Customer

UDB will provide reasonable assistance to Customer (taking into account the nature of processing) with:

• responding to data access/correction requests, where UDB is acting as a Processor / service provider and the request relates to UDB’s processing;
• providing information reasonably needed for compliance assessments, security due diligence, regulatory inquiries, or air cargo security/RA-related reviews, subject to confidentiality and operational constraints.

8. Personal data breach

If UDB becomes aware of a personal data breach affecting Customer’s personal data, UDB will notify Customer without undue delay and provide available information reasonably required for Customer to assess and respond, subject to ongoing investigation and the information available at the time.

9. Audit and compliance information

Upon reasonable written request, UDB will provide information reasonably necessary to demonstrate compliance with this DPA. Where an on-site audit is requested:

• it must be agreed in advance (scope, timing, confidentiality);
• it must not unreasonably disrupt operations; and
• it may be subject to reasonable fees.

10. Return or deletion

Upon termination of the Services, UDB will, at Customer’s choice and where feasible:

• return personal data; or
• delete personal data,

unless retention is required by law or necessary for legitimate operational/legal purposes (e.g., accounting, dispute defense, claims handling, compliance recordkeeping, air cargo security / Regulated Agent records, or regulatory requirements).

11. Cross-border transfers

Customer acknowledges that logistics operations may involve cross-border processing depending on routing, carriers, authorities, security screening requirements, and operational partners. UDB applies reasonable safeguards and contractual or operational controls where applicable.

12. Liability

This DPA does not expand either party’s liability beyond what is set out in the governing commercial agreement and the applicable Terms & Conditions for the contracting entity.

Annex 1 — Processing details

Subject matter: logistics and related services (booking, documentation, coordination, air cargo security workflows, exception handling).
Duration: for the term of Services + applicable retention.
Nature of processing: collection, storage, access, use, disclosure to operational partners, regulatory/authority disclosure where required, and deletion/return where applicable.
Categories of data subjects: customer personnel, shipper/consignee contacts, notify parties, agents/intermediaries, drivers/authorized representatives, and operational/security contacts (as applicable).
Categories of personal data: business contact details, shipment documentation data, identifiers, communications, compliance-related records, air cargo security / Regulated Agent records, and operational records (as applicable).

Annex 2 — Security (summary)

• Access controls, role-based permissions
• Operational document-handling controls
• System monitoring/logging where applicable
• Staff confidentiality obligations
• Air cargo security / Regulated Agent document controls where applicable

Annex 3 — Sub-processors

Available on request (operationally dependent on routing, carriers, handlers, trucking, warehousing, screening/security service providers, IT providers, and other operational partners).