Data processing agreement

This agreement is between the business that uses GORINY Business Suite (the "Business", as personal data controller) and Mr. Nattanon Srimongkol, the provider of GORINY Business Suite (187/2 Krungthep Kreetha 7 Road, Hua Mak, Bang Kapi, Bangkok) ("GORINY", as personal data processor).

This agreement forms part of the Terms of Service and applies to all personal data the Business records in or sends to the app, namely data about customers, suppliers, contacts, employees and prospects who contact the Business through channels connected to the app.

Data that GORINY collects as a controller in its own right (user accounts, service fee payments, prospects who contact GORINY through goriny.com) is covered by the Privacy Policy, not by this agreement.

The Business's instructions are its use of functions in the app, such as recording customers, issuing tax invoices, calculating payroll and exporting reports, and the requests for help the Business sends in.

GORINY will not use the Business's data for any other purpose. It will not use it for advertising, will not sell it, will not disclose it to other businesses, and will not use it to train its own or anyone else's AI systems.

If the law requires GORINY to disclose data, GORINY will tell the Business first, as far as the law allows.

GORINY staff or assistants access the Business's data only when the Business asks for help, and that access is logged.

GORINY maintains measures meeting the minimum standards announced by the Personal Data Protection Committee, including at least the following.

• Data is separated between businesses at database level. Users of one business cannot read another business's data, even if the app has a bug.
• Per-person, per-role permissions, as set by the Business.
• Every connection is encrypted, and data at rest is encrypted on the database provider's machines.
• Activity logs record who did what and when for important documents.
• Daily backups, with restores rehearsed from time to time.
• GORINY system administrators must use two-step verification.
• Measures are reviewed at least once a year.

Details you can verify are on the data security page.

GORINY uses the following providers to deliver the Service. Each is bound by a data processing agreement with duties no lower than this agreement.

• Supabase, Inc.

  What it does

  Database, authentication and backup files

  Country

  Australia (AWS data centre, Sydney)

  Safeguard

  The provider's data processing agreement, with standard contractual clauses

• Vercel, Inc.

  What it does

  Servers that run the app and website, system logs, anonymous website statistics

  Country

  United States, with a point of presence in Singapore

  Safeguard

  The provider's data processing agreement

• Stripe, Inc.

  What it does

  Collects service fees (business owner data only, not the business's customer data)

  Country

  United States

  Safeguard

  The provider's data processing agreement, PCI DSS standard

• Anthropic, PBC

  What it does

  AI assistant that answers questions from the business's figures when a user asks, and the summary card on the app's home page, which sends the business's summary figures once a day

  Country

  United States

  Safeguard

  The provider's data processing agreement, data is not used to train models

• LINE Corporation

  What it does

  Receives messages from the business's LINE Official Account (only for businesses that choose to connect)

  Country

  Japan and Thailand

  Safeguard

  LINE's developer terms, the business connects it themselves

• Google LLC

  What it does

  Reads Google Ads cost reports (only for businesses that choose to connect)

  Country

  United States

  Safeguard

  Google API user data policy, the business consents on Google's own screen

• Resend, Inc.

  What it does

  Sends system emails, such as file delivery emails to a business's customers and emails to business owners

  Country

  United States, sending from a data centre in Japan

  Safeguard

  The provider's data processing agreement, with standard contractual clauses

• Cloudflare, Inc.

  What it does

  Bot check (Turnstile) on the sign-in page, trial sign-up page, forgot-password page, demo button, contact form and partner form, seeing the IP address and the browser and device signals needed only to check that the user is a real person

  Country

  United States, checked at the data centre nearest the user in its global network

  Safeguard

  The provider's data processing agreement

If GORINY adds or changes a sub-processor, it will tell the Business at least 30 days in advance by email to the business owner and update this page. A Business that does not accept the change can cancel the Service with no charge for the period not yet used.

The app's database is in a data centre in Australia, and some sub-processors process data in the United States, as listed in section 4. Thailand has not yet announced a list of countries with adequate data protection standards under section 28.

GORINY therefore uses appropriate safeguards under section 29, namely standard contractual clauses in the data processing agreement with each sub-processor, which require the sub-processor to protect data to a standard no lower than Thai law and to notify GORINY of any breach.

The Business acknowledges and agrees to data being sent to the sub-processors in section 4 in order to provide the Service. The Business is responsible for informing its own data subjects (customers, employees) about transfers abroad in its own privacy policy. GORINY provides template wording in its guide.

When the Business's customers or employees exercise their legal rights, the Business can act in the app itself as follows.

• Access or a copy: download a backup file of the whole business, or export the relevant reports.
• Correction: edit on the customer, supplier or employee page.
• Deletion of an individual customer: delete on the customer page, except where there are tax documents the law requires to be kept for 5 years, in which case the system keeps only what the law requires.
• Deletion or masking of the name of a former employee: contact GORINY at hello@goriny.com and we will do it within 30 days (a button in the app is being developed).

For other requests the Business cannot handle itself, contact GORINY. We reply within 7 business days and complete the request within the time the law requires (30 days).

When GORINY becomes aware that the Business's personal data has been accessed, disclosed, altered or lost without authorisation, GORINY will notify the business owner by email at the registered address within 24 hours of becoming aware, even if the details are not yet complete, and will send further information as it learns more.

The notice will state the nature of the incident, the types and amount of data that may be affected, what GORINY has already done, and the information the Business needs to notify the Office of the Personal Data Protection Committee within 72 hours as the controller is required to.

GORINY has a written incident response procedure. The procedure has not yet had its first rehearsal. After it is rehearsed, this section will be updated with the date of the latest rehearsal.

GORINY keeps the Business's data for as long as the Business uses the Service. When the Business cancels the Service or the trial ends, the Business can export all its data within 30 days, and GORINY will delete the Business's data from its live systems within 90 days after cancellation. Older backup files that still contain it rotate out within 6 months after that.

The exception is data the law requires GORINY itself to keep, such as records of service fee payments, which are kept for the accounting retention period.

The Business may request documents describing the security measures, the list of sub-processors and GORINY's record of processing activities at any time. GORINY will provide them within 15 business days.

If the Business wants an external auditor to carry out an audit, GORINY will cooperate within an agreed scope, with the Business paying the auditor's costs.

The Business confirms that it has a lawful basis for collecting the data recorded in the app, informs its customers and employees as required by section 23, sets user permissions in the business appropriately, and does not record sensitive data (religion, health, biometric data, criminal records) in the app's free text fields.

This agreement is in effect for as long as the Business uses the Service, and continues until GORINY deletes the Business's data under section 8.

Each party's liability follows section 8 of the Terms of Service, unless personal data protection law provides otherwise.

GORINY may update this agreement to comply with new laws or announcements, showing the update date at the top, and will give the Business 30 days' notice of any change that reduces the Business's rights.

For questions about this agreement or personal data, contact hello@goriny.com, phone 083-927-2676.