Oaksoft Trading Co., Ltd.

Data processing agreement

AI QA Manual — hosted ISO 9001 quality manual service

DRAFT — not yet reviewed by a lawyer. This sets out honestly how the service actually works, so that a solicitor has something concrete to work from and a client can see the substance early. It is not legal advice and it should not be signed by either party until a qualified adviser has checked it against the law that applies to you, your client, and where the data sits.

Written 12 September 2026.

1.The parties and their roles

The Customer (company name) is the controller: it decides what goes into its quality manual and who receives copies.

Oaksoft Trading Co., Ltd., registered in Thailand, is the processor: it hosts the service and processes data only on the Customer's instructions, which are this agreement and the Customer's use of the application.

2.What is processed

Category	What it is
Quality management records	The manual text, revisions, approvals, exclusions and their justifications.
Personal data — application users	Name, email address, role, password (stored only as a hash that cannot be reversed), sign-in times.
Personal data — controlled copy holders	Name, email address, job title, site, copy number, and the record of which revision was issued to them and when.
Operational records	Activity logs, including every access by Oaksoft support.

No special category data is required by the service. The Customer should not enter health, biometric or other sensitive personal data into free-text fields.

3.Purpose and duration

Data is processed only to provide, support, back up and secure the service, for as long as the Customer holds a licence, plus the return and deletion period in section 9.

4.Separation between customers

Each customer's data is held in its own separate database, reachable only through that customer's own address. No customer can access another's data through the application by any means.

5.Security

Access to the application requires an individual username and password; passwords are stored only as salted hashes.
All traffic is encrypted in transit (HTTPS).
Data is encrypted at rest, and backups are encrypted.
Administrative access to the servers is restricted to named Oaksoft personnel using key-based authentication.
Backups are taken daily and retained for 30 days.

6.Support access — stated plainly

Oaksoft can read a Customer's data. This is necessary to support the service, and no encryption arrangement would change it while Oaksoft also holds the keys. Rather than imply otherwise, Oaksoft commits that:

Support access happens only to operate, support or secure the service, or where the law requires it.
Every such access is recorded in the Customer's own activity log, naming the person and the time.
Personnel with access are bound by confidentiality.
Customer data is never used to train any model, sold, or shared for marketing.

7.Sub-processors

Oaksoft uses the following sub-processors. The Customer will be told before any is added or replaced, and may object.

Sub-processor	Purpose	Location
Hetzner Online GmbH	Server hosting	Germany
others as applicable	—	—

8.Where the data is held, and transfers

Data is stored on servers in Germany. Support is provided from Thailand, so support access constitutes a transfer outside the EEA; it is made under appropriate safeguards to be confirmed by the parties' advisers.

9.Return and deletion

The Customer may export its complete data at any time during the term. On termination, Oaksoft will provide a final export on request and delete the Customer's data, including from backups, within 90 days.

10.Assisting the Customer

Oaksoft will help the Customer, at reasonable cost for substantial work, to respond to requests from individuals (access, correction, erasure), and to carry out impact assessments and audits relating to the service.

11.Personal data breaches

Oaksoft will notify the Customer without undue delay, and in any event within 72 hours of becoming aware of a breach affecting the Customer's data, with what is known about the cause, the data involved, and the remedy.

12.What this service does not do

AI QA Manual supports certification readiness and the maintenance of a management system. It does not grant, guarantee or substitute for certification, which only an accredited certification body can issue following its own audit.

13.Law and signature

This agreement is governed by to be agreed.

For the Customer	For Oaksoft Trading Co., Ltd.
Name: Position: Date: Signature:	Name: Position: Date: Signature: