Data Processing Agreement

Version 1.0, 4 November 2026

1. Parties and Purpose

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between:

Barokat Halal Food Co., Ltd.
Registration No. 0845568011608
55/4 Moo 4, Kanjanavithi Road, Ban Tai, Koh Phangan District, Surat Thani, Thailand.
Operating the FreshOS platform (“FreshOS”, “we”, “us” or “Processor”).

And:

The individual or business operating a store through FreshOS (“the Merchant” or “Controller”).

This DPA governs how FreshOS processes personal data on behalf of the Merchant when the Merchant uses FreshOS to manage its business and customer information.

It applies in addition to the FreshOS Terms of Service and Privacy Policy.

2. Roles and Responsibilities

For personal data relating to the Merchant’s customers:

The Merchant acts as the Data Controller.

The Merchant determines:

• What customer information is collected.
• Why that information is collected.
• How the information is used.
• How long the information should be retained.
• Who is authorised to access the information.

FreshOS acts as the Data Processor.

FreshOS processes customer personal data only to provide the services requested by the Merchant and in accordance with the Merchant’s documented instructions.

FreshOS does not determine the independent commercial purposes for which the Merchant uses its customer data.

For personal data relating to the Merchant’s own account, authentication, billing and administration of FreshOS, Barokat Halal Food Co., Ltd. may act as an independent Data Controller. Such processing is governed by the FreshOS Privacy Policy.

3. Categories of Personal Data

Depending on how the Merchant uses FreshOS, the platform may process the following categories of personal data:

• Customer names.
• Telephone numbers.
• Delivery addresses.
• Order and purchase information.
• Customer account information.
• Other information voluntarily entered by customers or Merchants.

The Merchant must not use FreshOS to collect sensitive personal data unless the collection and processing are lawful and the relevant functionality is appropriate for that purpose.

FreshOS is primarily designed to process ordinary customer and business transaction information.

4. Purpose and Duration of Processing

FreshOS processes personal data only as necessary to:

• Operate the Merchant’s online storefront.
• Receive and manage customer orders.
• Store customer contact information.
• Manage order and delivery information.
• Provide customer account functionality.
• Display customer and transaction information to authorised Merchant staff.
• Provide technical support and maintain the Service.
• Protect the security and integrity of the platform.

Processing continues while the Merchant uses the relevant FreshOS services and for any additional period required by applicable law or the terms of this DPA.

5. Merchant Obligations

The Merchant agrees to:

• Collect personal data lawfully.
• Provide customers with appropriate privacy information.
• Establish a valid legal basis for processing customer personal data.
• Collect only information reasonably necessary for its business.
• Ensure that staff members accessing customer information are authorised.
• Keep account credentials secure.
• Respect applicable data protection rights.
• Inform FreshOS of relevant customer requests or legal requirements affecting the processing of personal data.

The Merchant remains responsible for its own compliance with applicable data protection laws, including Thailand’s Personal Data Protection Act B.E. 2562 (2019).

6. FreshOS Obligations

FreshOS agrees to:

• Process customer personal data only according to the Merchant’s documented instructions, unless processing is required by applicable law.
• Use personal data only to provide, maintain, secure and support the FreshOS Service.
• Ensure that persons authorised to process personal data are subject to appropriate confidentiality obligations.
• Apply reasonable technical and organisational security measures.
• Restrict internal access to personal data to authorised personnel who need access for legitimate operational purposes.
• Assist the Merchant, where reasonably possible, with requests from customers exercising their data protection rights.
• Assist the Merchant with security incidents and applicable data protection obligations.
• Delete or return personal data following termination, subject to legal retention requirements and technical backup procedures.

FreshOS will not sell the Merchant’s customer personal data or use it for independent advertising or unrelated commercial purposes.

7. Confidentiality

FreshOS will treat all personal data processed on behalf of the Merchant as confidential.

We will not disclose such information to third parties except:

• Where necessary to provide the FreshOS Service.
• Where authorised by the Merchant.
• Where required by applicable law or a competent authority.

Any personnel with access to customer personal data will be subject to appropriate confidentiality obligations.

8. Security Measures

FreshOS will maintain reasonable technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures may include:

• HTTPS encryption for data transmitted between users and FreshOS.
• Database access controls.
• Separation of Merchant data through database-level security policies.
• Restricted access to internal systems.
• Authentication and account security measures.
• Technical monitoring and maintenance.
• Reasonable backup and recovery procedures.

FreshOS will review and improve its security measures as the platform develops.

No security system can guarantee absolute protection against every possible threat.

9. Subprocessors and Third-Party Providers

FreshOS may use third-party infrastructure and service providers to operate the platform.

These providers may process personal data on behalf of FreshOS where necessary to deliver the Service.

Current infrastructure includes:

• Supabase for database and backend services.
• Amazon Web Services (AWS) for cloud infrastructure.
• Vercel for application hosting and delivery.
• Google for account authentication.

FreshOS will take reasonable steps to ensure that relevant providers are subject to appropriate contractual data protection and confidentiality obligations.

FreshOS remains responsible for the performance of its subprocessors to the extent required by applicable law.

Where required by law, FreshOS will inform the Merchant of material changes to its subprocessors and provide an opportunity to raise reasonable data protection objections.

10. International Data Transfers

The Merchant acknowledges that providing FreshOS may involve processing or storing personal data outside Thailand.

The primary database is currently configured in the Mumbai region of AWS infrastructure.

Other service providers may process technical information in additional locations.

FreshOS will take appropriate steps to ensure that international transfers comply with applicable Thai data protection requirements, including relevant PDPA provisions and regulations concerning transfers of personal data outside Thailand.

Where required by law, appropriate safeguards will be implemented.

11. Assistance with Customer Rights

If a customer exercises a data protection right concerning information processed through FreshOS, the Merchant remains responsible for responding to that customer.

FreshOS will provide reasonable technical assistance where necessary, including assistance with:

• Access requests.
• Correction of inaccurate information.
• Deletion requests.
• Export of available customer information.
• Other legally applicable requests.

The Merchant should contact FreshOS through the in-app Support chat when technical assistance is required.

FreshOS will not independently respond to a Merchant’s customers concerning the Merchant’s customer data unless authorised by the Merchant or required by law.

12. Personal Data Breaches

If FreshOS becomes aware of a personal data breach affecting customer information processed on behalf of the Merchant, FreshOS will:

• Investigate the incident.
• Take reasonable steps to contain and mitigate its effects.
• Inform the affected Merchant without undue delay.
• Provide relevant information reasonably available to assist the Merchant in meeting its legal obligations.

The Merchant remains responsible for notifying the relevant authority and affected individuals where required by applicable law.

Nothing in this section prevents FreshOS from making a notification directly to a competent authority where legally required.

13. Retention, Return and Deletion

The Merchant remains responsible for determining appropriate retention periods for its customer information, subject to applicable legal requirements.

When a Merchant closes its FreshOS account or terminates the Service, FreshOS will:

• Stop processing customer data for ordinary Service purposes.
• Provide a reasonable opportunity for the Merchant to request an export of available data.
• Delete or anonymise personal data after the applicable operational wind-down period.

FreshOS may retain information where required by law or where necessary to establish, exercise or defend legal claims.

Data contained in technical backups may remain temporarily available until those backups are overwritten or deleted according to the applicable backup procedures.

14. Audits and Compliance Information

Upon reasonable written request, FreshOS will provide information reasonably necessary to demonstrate compliance with the obligations set out in this DPA.

Where legally required, and subject to reasonable confidentiality, security and operational conditions, FreshOS will cooperate with proportionate audits relating to the processing of the Merchant’s personal data.

Any audit must:

• Be arranged in advance.
• Take place during reasonable business hours.
• Avoid unnecessary disruption to FreshOS operations.
• Respect the confidentiality and security of other Merchants’ information.

15. Duration and Termination

This DPA remains effective for as long as FreshOS processes personal data on behalf of the Merchant.

It automatically ends when the relevant FreshOS services are terminated and all applicable processing obligations have been completed, subject to legal retention requirements.

Termination of this DPA does not remove any obligations that must continue under applicable law.

16. Governing Law

This DPA is governed by the laws of the Kingdom of Thailand.

Any dispute arising from this DPA shall be submitted to the competent courts of Thailand, subject to mandatory legal provisions.

17. Contact

For questions, requests or assistance relating to the processing of personal data, please contact FreshOS through the in-app Support chat.

Barokat Halal Food Co., Ltd.
FreshOS
freshos.app
55/4 Moo 4, Kanjanavithi Road,
Ban Tai, Koh Phangan District,
Surat Thani, Thailand.
Registration No. 0845568011608

See also our Terms of Service, Privacy Policy and Legal Notice.