Alibaba Mail Privacy Policy
Alibaba Mail隐私政策
Introduction
引言
⠀
Welcome to Alibaba Mail products and services! Alibaba Cloud (Singapore) Private Limited and its affiliates (hereinafter referred to as "we" or "us") fully understand the importance of personal data to you. We are committed to complying with the Personal Data Protection Act 2012 of Singapore ("PDPA") and other applicable data protection laws and regulations, and to adopting appropriate security measures to safeguard your personal data.
欢迎您使用Alibaba Mail产品和服务！Alibaba Cloud (Singapore) Private Limited及其关联公司（以下简称"我们"）深知个人数据对您的重要性。我们致力于遵守新加坡Personal Data Protection Act 2012(简称"PDPA"）及其他适用的数据保护法律法规，并采取适当的安全保护措施，保障您的个人数据安全。
⠀
This Alibaba Mail Privacy Policy (hereinafter referred to as "this Policy") is intended to help you understand how we collect, use, disclose, transfer across borders, and protect your personal data in the course of providing Alibaba Mail services, as well as the rights you are entitled to under applicable laws.
本《Alibaba Mail隐私政策》（以下简称"本政策"）旨在帮助您了解我们在提供Alibaba Mail服务过程中如何收集、使用、披露、跨境传输和保护您的个人数据，以及您依据适用法律享有的权利。
⠀
Please read and understand this Policy carefully before using our products and services. We draw your particular attention to the provisions highlighted in bold. If you have any questions about this Policy, you may contact us through the contact details set out at the end of this Policy.
请您在使用我们的产品和服务前仔细阅读并理解本政策。我们以粗体标示的条款，请您重点关注。如对本政策有任何疑问，您可通过本政策末尾所载的联系方式与我们联系。
Alibaba Mail primarily provides services to enterprise customers. In the enterprise customer use scenario, the enterprise customer, as the Data Controller, determines the purposes for the collection and use of its end users' personal data, and we, as the Data Processor, process the relevant personal data in accordance with the enterprise customer's instructions. The rights and obligations between the Data Controller and the Data Processor in such scenarios are governed by the Data Processing Agreement annexed to this Policy.
Alibaba Mail主要面向企业客户提供服务。在企业客户使用场景下，企业客户作为数据控制者（Data Controller）决定其最终用户个人数据的收集和使用目的，我们作为数据处理者（Data Processor）按照企业客户的指示处理相关个人数据。该等场景下数据控制者与数据处理者之间的权利义务，由本政策附件《数据委托处理协议》予以规定。
⠀
This Policy will help you understand the following:
本政策将帮助您了解以下内容：
⠀
I. Definitions
一、定义
II. Scope of Application
二、适用范围
⠀
III. Personal Data We Collect and Purposes of Collection
三、我们收集的个人数据及收集目的
⠀
IV. Use of Personal Data
四、个人数据的使用
⠀
V. Disclosure and Cross-Border Transfer of Personal Data
五、个人数据的披露与跨境传输
⠀
VI. Retention of Personal Data
六、个人数据的保留
⠀
VII. Protection of Personal Data
七、个人数据的保护
⠀
VIII. Your Rights
八、您的权利
⠀
IX. Use of Cookies and Similar Technologies
九、Cookie及类似技术的使用
X. Protection of Minors
十、未成年人保护
⠀
XI. Changes to This Policy
十一、本政策的变更
⠀
XII. Contact Us
十二、联系我们
⠀
Annex: Data Processing Agreement
附件：数据委托处理协议
⠀
I. Definitions
一、定义
Unless the context otherwise requires, the following terms used in this Policy shall have the meanings set out below:
除非上下文另有要求，本政策下列用语具有如下含义：
⠀
"Personal Data" means data about an individual who can be identified from that data, whether or not the data is true and whether or not the data is recorded in electronic or other form, including but not limited to the individual's name, email address, telephone number, IP address, device identifiers, etc.
"个人数据"（Personal Data）：指关于可据以识别某一自然人身份的数据，无论该数据是否真实，亦无论该数据是以电子形式还是其他形式记录的，包括但不限于该自然人的姓名、电子邮件地址、电话号码、IP地址、设备标识符等。
⠀
"Enterprise Customer" means a legal entity or organization that registers for and purchases the Alibaba Mail service.
"企业客户"：指注册并购买Alibaba Mail服务的法人实体或组织。
⠀
"End User" means an individual user authorized by the Enterprise Customer to use the Alibaba Mail service.
"最终用户"：指由企业客户授权使用Alibaba Mail服务的个人用户。
⠀
"Data Controller" means an organization that, alone or jointly with others, determines the purposes and means of the collection, use, or disclosure of personal data.
"数据控制者"（Data Controller）：指单独或与他人共同决定个人数据的收集、使用或披露目的和方式的组织。
⠀
"Data Processor" means an organization that processes personal data on behalf of a Data Controller.
"数据处理者"（Data Processor）：指代表数据控制者处理个人数据的组织。
⠀
"Processing" means any operation performed on personal data, including collection, recording, holding, storage, adaptation, use, disclosure, deletion, or destruction.
"处理"（Processing）：指对个人数据执行的任何操作，包括收集、记录、持有、存储、改编、使用、披露、删除或销毁。
⠀
II. Scope of Application
二、适用范围
2.1 This Policy applies to the Alibaba Mail products and services provided to you by Alibaba Cloud (Singapore) Private Limited and its affiliates through the web client (Webmail), desktop applications, mobile applications, APIs, and other means.
2.1 本政策适用于Alibaba Cloud (Singapore) Private Limited及其关联公司通过网页端（Webmail）、客户端应用程序、移动应用程序及API等方式向您提供的Alibaba Mail产品和服务。
⠀
2.2 In the enterprise customer use scenario: The enterprise customer, as the Data Controller, is responsible for formulating its own privacy policy and informing its end users of personal data processing matters; we, as the Data Processor, process the end users' personal data in accordance with the enterprise customer's instructions. The provisions of this Policy concerning the end users' personal data processed by us as the Data Processor shall apply only to the extent that the Data Controller (enterprise customer) has not otherwise provided a separate privacy policy.
2.2 在企业客户使用场景下： 企业客户作为数据控制者，负责制定其自身的隐私政策并向其最终用户告知个人数据处理事宜；我们作为数据处理者，依据企业客户的指示处理最终用户的个人数据。本政策中关于我们作为数据处理者所处理的最终用户个人数据的条款，仅在数据控制者（企业客户）未另行提供隐私政策的范围内适用。
⠀
2.3 This Policy does not apply to services provided to you by third parties through the Alibaba Mail platform. Third-party services are subject to the respective privacy policies of such third parties.
2.3 本政策不适用于第三方通过Alibaba Mail平台向您提供的服务。第三方服务适用该第三方各自的隐私政策。
⠀
III. Personal Data We Collect and Purposes of Collection
三、我们收集的个人数据及收集目的
In the course of your use of Alibaba Mail services, we may collect the following categories of personal data as required by specific service functions:
在您使用Alibaba Mail服务的过程中，我们可能根据具体服务功能的需要，收集以下类别的个人数据：
⠀
(1) Account Registration and Management
（一）账户注册与管理
⠀
To create and manage your Alibaba Mail account, we need to collect the following information:
为创建和管理您的Alibaba Mail账户，我们需要收集以下信息：
⠀
Required information: Email address (assigned by the enterprise customer or set up by you), login password, and enterprise customer information associated with the account.
必要信息：电子邮件地址（由企业客户分配或由您设置）、登录密码、账户关联的企业客户信息。
⠀
Optional information: Profile information that you may set at your discretion, such as display name, avatar, and email signature. If you do not provide optional information, it will not affect your use of the basic functions of Alibaba Mail.
可选信息：您可自主设置的显示名称、头像、邮件签名等个人资料信息。如您不提供可选信息，不影响您使用Alibaba Mail的基本功能。
⠀
(2) Email Sending and Receiving Services
（二）邮件收发服务
To provide you with the email sending and receiving functions, we will process the following information:
为向您提供电子邮件的收发功能，我们会处理以下信息：
⠀
●
Email content data: including email body, attachments, recipient/sender/CC addresses, etc.;
●
Email metadata: including sending/receiving time, email size, email header information, etc.;
●
Contact data: contact information you create or import in Alibaba Mail.
●
邮件内容数据：包括邮件正文、附件、收件人/发件人/抄送地址等；
●
邮件元数据：包括发送/接收时间、邮件大小、邮件头信息等；
●
通讯录数据：您在Alibaba Mail中创建或导入的联系人信息。
⠀
Please note: We will not proactively access or review your email content, except for automated scanning for anti-spam and security protection purposes, or as required by applicable laws and regulations.
请注意：我们不会主动访问或审查您的邮件内容，除非为提供反垃圾邮件和安全防护功能而进行的自动化扫描处理，或基于适用法律法规的要求。
⠀
(3) Service Security and Operations
（三）服务安全与运维
To ensure service security and normal system operation, we may collect the following information:
为保障服务安全及系统正常运行，我们可能收集以下信息：
⠀
●
Device information: device model, operating system version, unique device identifiers, browser type and version;
●
Log information: IP address, access time, operation records, error logs;
●
Network information: network connection type.
●
设备信息：设备型号、操作系统版本、唯一设备标识符、浏览器类型及版本；
●
日志信息：IP地址、访问时间、操作记录、错误日志；
●
网络信息：网络连接类型。
⠀
The purposes of collection include: identity verification, abnormal login detection, defense against spam and malware, system troubleshooting, and service performance optimization.
收集目的包括：身份验证、异常登录检测、防御垃圾邮件和恶意软件、排查系统故障以及服务性能优化。
⠀
(4) Customer Service and Dispute Resolution
（四）客户服务与争议处理
When you contact our customer service team, we may collect the following to verify your identity and process your requests:
当您联系我们的客户服务团队时，为核验身份并处理您的请求，我们可能收集：
⠀
●
Account information for identity verification;
●
Contact information you voluntarily provide (such as telephone number);
●
Communication records and correspondence content.
●
用于核验身份的账户信息；
●
您主动提供的联系方式（如电话号码）；
●
沟通记录和通信内容。
⠀
(5) Exceptions Where Consent Is Not Required
（五）无需同意的例外情形
⠀
In the following circumstances, we may collect, use, or disclose your personal data without obtaining your consent:
在以下情形中，我们可以在无需征得您同意的情况下收集、使用或披露您的个人数据：
●
To comply with legal obligations or cooperate with requirements of law enforcement agencies;
●
Where necessary to protect the life safety of you or others in an emergency;
●
Where the data is publicly available information;
●
For reasonable business purposes with limited impact on the individual (Business Improvement Exception);
●
For research purposes where the data has been anonymized.
●
为履行法定义务或配合执法机构的要求；
●
在紧急情况下为保护您或他人的生命安全所必需；
●
数据为公开可获取的信息；
●
为合理的商业目的且对个人的影响有限（Business Improvement Exception）；
●
为研究目的且数据已采取匿名化措施的。
⠀
IV. Use of Personal Data
四、个人数据的使用
⠀
4.1 We use the personal data collected only for the purposes described in this Policy. The main purposes include:
4.1 我们仅在本政策所述之目的范围内使用所收集的个人数据，主要用途包括：
⠀
●
Providing, maintaining, and improving Alibaba Mail services;
●
Account management and identity verification;
●
Sending service-related notifications (such as system maintenance notices, security alerts);
●
Providing customer support and handling complaints;
●
Ensuring service security and preventing fraud and abuse;
●
Complying with requirements of applicable laws and regulations;
●
Generating anonymized statistical data for the purpose of improving service quality.
●
提供、维护和改进Alibaba Mail服务；
●
账户管理和身份验证；
●
发送与服务相关的通知（如系统维护通知、安全警告）；
●
提供客户支持和处理投诉；
●
保障服务安全，防范欺诈和滥用行为；
●
遵守适用法律法规的要求；
●
生成匿名化的统计数据，用于改进服务质量。
⠀
4.2 We will not use your email content for targeted advertising.
4.2 我们不会将您的邮件内容用于定向广告投放。
⠀
4.3 If we intend to use personal data for purposes not specified in this Policy, we will notify you and, where necessary, obtain your consent before such use.
4.3 如我们拟将个人数据用于本政策未载明的其他目的，我们将在使用前通知您并在需要时征得您的同意。
⠀
V. Disclosure and Cross-Border Transfer of Personal Data
五、个人数据的披露与跨境传输
⠀
(1) Disclosure
（一）披露
⠀
5.1 We will not sell your personal data to third parties.
5.1 我们不会向第三方出售您的个人数据。
⠀
5.2 We may disclose your personal data to third parties in the following circumstances:
5.2 在以下情形下，我们可能向第三方披露您的个人数据：
⠀
(a) Affiliates: To the extent necessary for the operation and provision of Alibaba Mail services, we may share necessary personal data with our affiliates. Our affiliates shall be bound by data protection obligations equally stringent as those set forth in this Policy.
（a）关联公司： 为运营和提供Alibaba Mail服务的需要，我们可能与我们的关联公司共享必要的个人数据。我们的关联公司将受到与本政策同等严格的数据保护义务约束。
⠀
(b) Service Providers: We may engage third-party service providers to assist with infrastructure hosting, data analytics, security monitoring, and other services. Such service providers process personal data only to the extent necessary for providing services to us and are bound by contractual obligations to protect your personal data.
（b）服务提供商： 我们可能聘请第三方服务提供商协助提供基础设施托管、数据分析、安全监测等服务。此等服务提供商仅在为我们提供服务所必需的范围内处理个人数据，并受到合同义务的约束以保护您的个人数据。
⠀
(c) Legal Requirements: We may disclose your personal data where required by applicable laws and regulations or where lawfully requested by law enforcement agencies.
（c）法律要求： 在适用法律法规要求或执法机构依法提出要求的情况下，我们可能披露您的个人数据。
⠀
(d) Protection of Rights: Where we reasonably believe disclosure is necessary to protect the legitimate rights, property, or safety of us or others.
（d）保护权利： 在我们合理认为有必要为保护我们或他人的合法权利、财产或安全而披露的情况下。
⠀
(2) Cross-Border Transfer
（二）跨境传输
⠀
5.3 The data storage location for Alibaba Mail is determined by the service region (Region) selected by the enterprise customer when activating the service. Your personal data will be primarily stored and processed in the data center region selected by the enterprise customer.
5.3 Alibaba Mail的数据存储位置由企业客户在开通服务时所选择的服务区域（Region）决定。您的个人数据将主要存储和处理于企业客户所选定的数据中心区域。
⠀
5.4 Your personal data may be transferred to other countries or regions in the following circumstances:
5.4 在以下情形下，您的个人数据可能被传输至其他国家或地区：
⠀
●
To provide global technical support and operations services;
●
Where our affiliates or service providers are located in other countries or regions.
●
为提供全球性的技术支持和运维服务；
●
我们的关联公司或服务提供商位于其他国家或地区。
⠀
5.5 When conducting cross-border transfers, we will take the following measures to ensure that your personal data receives a level of protection equivalent to that under the PDPA:
5.5 在进行跨境传输时，我们将采取以下措施以确保您的个人数据获得与PDPA同等程度的保护：
⠀
●
Entering into contractual agreements containing data protection clauses with data recipients;
●
Confirming that the country or region where the recipient is located has data protection standards equivalent to or comparable with the PDPA;
●
Adopting appropriate technical and organizational security measures.
●
与数据接收方签署包含数据保护条款的合同协议；
●
确认接收方所在国家或地区具有与PDPA同等或相当的数据保护标准；
●
采取适当的技术和组织安全措施。
⠀
VI. Retention of Personal Data
六、个人数据的保留
⠀
6.1 We will retain your personal data for the period necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by applicable law.
6.1 我们将在实现本政策所述目的所必需的期限内保留您的个人数据，除非适用法律要求或允许更长的保留期限。
⠀
6.2 In determining specific retention periods, we will consider the following factors:
6.2 在确定具体保留期限时，我们会考虑以下因素：
⠀
●
The time necessary for providing the services;
●
Whether there is a continuing contractual relationship between you and us;
●
Data retention requirements under applicable laws (such as accounting and tax record retention requirements);
●
The necessity of retaining data for the purpose of establishing, exercising, or defending legal claims.
●
提供服务所需的时间；
●
您与我们之间是否存在持续的合同关系；
●
适用法律对数据保留的要求（如会计和税务记录保留要求）；
●
为建立、行使或抗辩法律索赔而保留数据的必要性。
⠀
6.3 After your Alibaba Mail account is closed or deleted, we will delete or anonymize your personal data within a reasonable period, except for portions required to be retained by law.
6.3 当您的Alibaba Mail账户被关闭或删除后，我们将在合理期限内删除或匿名化处理您的个人数据，但法律要求保留的部分除外。
⠀
VII. Protection of Personal Data
七、个人数据的保护
⠀
7.1 We adopt appropriate technical and organizational security measures to protect your personal data from unauthorized access, collection, use, disclosure, copying, modification, disposal, or similar risks, including but not limited to:
7.1 我们采取适当的技术和组织安全措施来保护您的个人数据免遭未经授权的访问、收集、使用、披露、复制、修改、处置或类似风险，包括但不限于：
⠀
●
Implementing encryption for data in transit and data at rest;
●
Implementing access control mechanisms that allow only authorized personnel to access personal data within the necessary scope;
●
Conducting regular security assessments and audits;
●
Establishing and implementing data breach emergency response plans.
●
对传输中和静态存储的数据实施加密措施；
●
实施访问控制机制，仅允许经授权人员在必要范围内访问个人数据；
●
定期进行安全评估和审计；
●
制定并落实数据泄露应急响应计划。
⠀
7.2 Although we have adopted the aforementioned security measures, please understand that the internet is not an absolutely secure environment, and we cannot guarantee that information transmitted over the internet is one hundred percent secure.
7.2 尽管我们已采取上述安全措施，但请您理解互联网并非绝对安全的环境，我们无法保证通过互联网传输的信息百分之百安全。
⠀
7.3 Data Breach Notification: In the event of a data breach that may cause significant harm to you, we will, in accordance with the requirements of the PDPA, notify the regulatory authority and affected individuals as soon as practicable after becoming aware of the data breach.
7.3 数据泄露通知： 如发生数据泄露事件且可能对您造成重大损害，我们将根据PDPA的要求，在知悉数据泄露后尽快通知监管部门及受影响的个人。
⠀
VIII. Your Rights
八、您的权利
⠀
Under the PDPA and other applicable laws, you are entitled to the following rights:
根据PDPA及其他适用法律，您享有以下权利：
⠀
8.1 Right of Access: You have the right to request us to inform you of the personal data we hold about you and how such data has been used or disclosed in the past year.
8.1 访问权： 您有权要求我们告知您我们所持有的关于您的个人数据，以及该等数据在过去一年内被如何使用或披露的情况。
⠀
8.2 Right of Correction: You have the right to request us to correct any inaccurate or incomplete personal data we hold about you.
8.2 更正权： 您有权要求我们更正我们所持有的不准确或不完整的个人数据。
⠀
8.3 Right to Withdraw Consent: For data processing activities based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out based on consent prior to such withdrawal. Please note that after withdrawing consent, you may not be able to continue using certain service features.
8.3 撤回同意权： 对于基于同意而进行的数据处理活动，您有权随时撤回您的同意。撤回同意不影响撤回前基于同意所进行的处理活动的合法性。请注意，撤回同意后您可能无法继续使用某些服务功能。
⠀
8.4 Right to Data Portability: To the extent provided by applicable law, you have the right to request a copy of your personal data in a commonly used, machine-readable format, or to request that your personal data be transferred to another organization.
8.4 数据可携权： 在适用法律规定的范围内，您有权要求以常用的、机器可读的格式获取您的个人数据副本，或要求将您的个人数据传输给另一组织。
⠀
8.5 How to Exercise Your Rights: You may submit the above rights requests to us through the contact details set out in Section XII of this Policy. We will respond within thirty (30) days of receiving your request. We may need to verify your identity before processing your request. In certain circumstances, we may refuse your request on legitimate grounds under applicable law, in which case we will explain the reasons for the refusal.
8.5 行使权利的方式： 您可通过本政策第十二条所载联系方式向我们提出上述权利请求。我们将在收到您的请求后三十（30）天内予以回复。我们可能需要核验您的身份后方可处理您的请求。在某些情况下，我们可能基于适用法律规定的正当理由拒绝您的请求，届时我们将向您说明拒绝的理由。
⠀
8.6 Right to Complain: If you believe that our processing of your personal data violates the PDPA, you have the right to lodge a complaint with the regulatory authority.
8.6 投诉权： 如果您认为我们对您的个人数据的处理违反了PDPA的规定，您有权向监管部门提出投诉。
⠀
IX. Use of Cookies and Similar Technologies
九、Cookie及类似技术的使用
⠀
9.1 To ensure the normal operation of the Alibaba Mail web service and to enhance user experience, we may use cookies and similar technologies (such as web beacons, pixel tags).
9.1 为确保Alibaba Mail网页端服务的正常运行及提升用户体验，我们可能会使用Cookie和类似技术（如网络信标、像素标签）。
⠀
9.2 The types of cookies we use include:
9.2 我们使用的Cookie类型包括：
●
Essential Cookies: Used to maintain login sessions and ensure security; necessary for providing the service;
●
Functional Cookies: Used to remember your preference settings (such as language selection, display settings);
●
Analytics Cookies: Used to understand service usage in order to improve the service (such as page visit statistics).
●
必要Cookie：用于维持登录会话和保障安全性，为提供服务所必需；
●
功能Cookie：用于记住您的偏好设置（如语言选择、显示设置）；
●
分析Cookie：用于了解服务的使用情况以改进服务（如页面访问统计）。
⠀
9.3 You may manage or delete cookies through your browser settings. Please note that disabling certain cookies may affect some features of Alibaba Mail.
9.3 您可以通过浏览器设置管理或删除Cookie。请注意，禁用某些Cookie可能会影响Alibaba Mail的部分功能。
X. Protection of Minors
十、未成年人保护
⠀
Alibaba Mail provides services to enterprise customers and is not designed for minors. We will not knowingly collect personal data of minors under the age of eighteen (18). If we discover that personal data of a minor has been collected without the consent of a guardian, we will delete such data as soon as practicable. If you believe that we may hold personal data of a minor, please contact us through the contact details set out in Section XII of this Policy.
Alibaba Mail面向企业客户提供服务，并非针对未成年人设计。我们不会故意收集未满十八（18）周岁的未成年人的个人数据。如果我们发现在未经监护人同意的情况下收集了未成年人的个人数据，我们将尽快予以删除。如果您认为我们可能持有未成年人的个人数据，请通过本政策第十二条所载联系方式与我们联系。
⠀
XI. Changes to This Policy
十一、本政策的变更
⠀
11.1 We may revise this Policy from time to time. Changes to this Policy will take effect upon the publication of the revised version.
11.1 我们可能不时修订本政策。本政策的变更将在修订版本发布时生效。
⠀
11.2 For material changes, we will notify you prior to such changes taking effect by posting a notice on the Alibaba Mail service interface, sending you an email, or through other appropriate means.
11.2 对于重大变更，我们将通过在Alibaba Mail服务界面发布通知、向您发送电子邮件或其他适当方式，在变更生效前向您告知。
⠀
11.3 We recommend that you review this Policy periodically to stay informed of our latest arrangements for the protection of personal data. Your continued use of Alibaba Mail services after changes to this Policy shall be deemed acceptance of the revised Policy.
11.3 我们建议您定期查阅本政策，以了解我们对个人数据保护的最新安排。您在本政策变更后继续使用Alibaba Mail服务，即视为接受修订后的政策。
⠀
XII. Contact Us
十二、联系我们
⠀
If you have any questions, comments, or requests regarding this Policy (including the exercise of your data protection rights), please contact us through the following means:
如果您对本政策有任何疑问、意见或请求（包括行使您的数据保护权利），请通过以下方式联系我们：
⠀
Contact Person: Data Protection Officer
联系人：数据保护官
Contact Email:
We will endeavor to respond within thirty (30) days of receiving your request.
我们将尽力在收到您的请求后三十（30）天内予以回复。
⠀
Annex: Data Processing Agreement
附件：数据委托处理协议 / Data Processing Agreement
⠀
Article 1 Overview and Definitions
第一条 概述与定义
⠀
1.1 This Data Processing Agreement (hereinafter referred to as "this DPA") forms part of the Alibaba Mail Privacy Policy and sets out the rights and obligations between the Enterprise Customer ("Data Controller") and the Alibaba Mail service ("Data Processor") with respect to the Data Processor's processing of personal data on behalf of the Data Controller.
1.1 本数据委托处理协议（以下简称"本DPA"）是Alibaba Mail隐私政策的组成部分，规定了企业客户（"数据控制者"）与Alibaba Mail服务（"数据处理者"）之间就数据处理者代表数据控制者处理个人数据的权利和义务。
⠀
1.2 Terms used but not otherwise defined in this DPA shall have the same meanings as defined in the Alibaba Mail Privacy Policy and the Alibaba Mail Product Terms of Service.
1.2 本DPA中使用但未另行定义的术语，其含义与Alibaba Mail隐私政策和Alibaba Mail产品服务条款中的定义一致。
⠀
1.3 "Processing Instructions" means the written instructions issued by the Data Controller to the Data Processor regarding the processing of personal data, including the terms of this DPA, the Alibaba Mail Product Terms of Service, and the configurations and settings made by the Data Controller through the service management interface.
1.3 "处理指示"指数据控制者就个人数据的处理向数据处理者发出的书面指示，包括本DPA条款、Alibaba Mail产品服务条款以及数据控制者通过服务管理界面所作的配置和设置。
⠀
1.4 "Sub-processor" means a third party engaged by the Data Processor to carry out part of the data processing activities on behalf of the Data Processor.
1.4 "分处理者"（Sub-processor）指由数据处理者聘请的代表数据处理者执行部分数据处理活动的第三方。
⠀
Article 2 Scope and Purpose of Data Processing
第二条 数据处理的范围与目的
⠀
2.1 The Data Processor shall process personal data only in accordance with the Processing Instructions of the Data Controller, and the purpose of processing shall be limited to what is necessary for providing the Alibaba Mail service to the Data Controller.
2.1 数据处理者仅根据数据控制者的处理指示处理个人数据，处理目的限于为数据控制者提供Alibaba Mail服务所必需的范围。
⠀
2.2 The types of personal data processed by the Data Processor on behalf of the Data Controller may include:
2.2 数据处理者代表数据控制者处理的个人数据类型可能包括：
⠀
●
End users' account data (name, email address);
●
Email content data (email body, attachments);
●
Email metadata (sending/receiving time, sender/recipient addresses, email size);
●
Contact data;
●
End users' usage logs and access logs.
●
最终用户的账户数据（姓名、电子邮件地址）；
●
电子邮件内容数据（邮件正文、附件）；
●
电子邮件元数据（收发时间、收发件人地址、邮件大小）；
●
通讯录数据；
●
最终用户的使用日志和访问日志。
⠀
2.3 Categories of Data Subjects: End users of the Data Controller (i.e., employees or authorized personnel using Alibaba Mail accounts) and third parties who communicate with end users via email (limited to data involved in email metadata).
2.3 数据主体类别：数据控制者的最终用户（即使用Alibaba Mail账户的员工或授权人员）以及与最终用户进行邮件通信的第三方（仅限于邮件元数据中涉及的数据）。
⠀
Article 3 Obligations of the Data Controller
第三条 数据控制者的义务
⠀
3.1 The Data Controller shall ensure:
3.1 数据控制者应确保：
⠀
(a) Its collection and processing of personal data complies with the requirements of applicable laws and regulations, including but not limited to obtaining necessary consent from data subjects or having other lawful processing bases;
（a）其收集和处理个人数据的行为符合适用法律法规的要求，包括但不限于获得数据主体的必要同意或具备其他合法处理依据；
⠀
(b) The Processing Instructions it issues to the Data Processor are lawful, reasonable, and have a clear purpose;
（b）其向数据处理者发出的处理指示合法、合理且具有明确的目的；
⠀
(c) It has formulated and published to its end users a privacy policy that complies with applicable legal requirements;
（c）其已制定并向最终用户公布符合适用法律要求的隐私政策；
⠀
(d) It has the authority to issue Processing Instructions to the Data Processor in respect of its end users' personal data.
（d）其有权就最终用户的个人数据向数据处理者发出处理指示。
⠀
3.2 The Data Controller shall bear management responsibility for its end users' use of the Alibaba Mail service.
3.2 数据控制者应对其最终用户对Alibaba Mail服务的使用行为承担管理责任。
⠀
Article 4 Obligations of the Data Processor
第四条 数据处理者的义务
⠀
4.1 Processing in Accordance with Instructions: The Data Processor shall process personal data only in accordance with the Data Controller's written Processing Instructions, unless otherwise required by applicable law. If applicable law requires the Data Processor to carry out processing beyond the scope of the Data Controller's instructions, the Data Processor shall notify the Data Controller in advance to the extent permitted by law.
4.1 按指示处理： 数据处理者应仅根据数据控制者的书面处理指示处理个人数据，除非适用法律另有要求。如适用法律要求数据处理者进行超出数据控制者指示范围的处理，数据处理者应在法律允许的范围内提前通知数据控制者。
⠀
4.2 Confidentiality Obligation: The Data Processor shall ensure that persons authorized to access personal data have undertaken confidentiality obligations or are subject to statutory confidentiality obligations.
4.2 保密义务： 数据处理者应确保有权访问个人数据的人员已承担保密义务或负有法定保密义务。
⠀
4.3 Security Measures: The Data Processor shall adopt appropriate technical and organizational measures to protect the security of personal data, including but not limited to:
4.3 安全措施： 数据处理者应采取适当的技术和组织措施保护个人数据的安全，包括但不限于：
⠀
(a) Implementing encryption for personal data in transit and at rest;
（a）对传输中和静态存储的个人数据实施加密；
⠀
(b) Ensuring the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
（b）确保处理系统和服务的持续保密性、完整性、可用性和弹性；
⠀
(c) Implementing access control mechanisms to ensure that only authorized personnel access personal data within the necessary scope;
（c）实施访问控制机制，确保仅经授权人员在必要范围内访问个人数据；
⠀
(d) Regularly testing and evaluating the effectiveness of security measures.
（d）定期测试和评估安全措施的有效性。
⠀
4.4 Cooperation Obligation: The Data Processor shall, to the extent reasonable, assist the Data Controller in:
4.4 配合义务： 数据处理者应在合理范围内协助数据控制者：
⠀
(a) Responding to requests from data subjects to exercise their data protection rights;
（a）响应数据主体行使其数据保护权利的请求；
⠀
(b) Fulfilling data breach notification obligations;
（b）履行数据泄露通知义务；
⠀
(c) Conducting data protection impact assessments (where required by applicable law).
（c）进行数据保护影响评估（如适用法律要求）。
⠀
4.5 Deletion or Return: Upon termination of the Alibaba Mail service, the Data Processor shall delete all personal data in its possession (to the extent technically feasible), except for portions required to be retained by applicable law.
4.5 删除或归还： 在Alibaba Mail服务终止后，数据处理者应删除其所持有的全部个人数据（在技术上可行的范围内），但适用法律要求保留的部分除外。
⠀
Article 5 Sub-processors
第五条 分处理者
⠀
5.1 The Data Controller agrees that the Data Processor may engage sub-processors to carry out part of the data processing activities. The list of sub-processors currently used by the Data Processor may be provided upon the Data Controller's reasonable request.
5.1 数据控制者同意数据处理者可以聘请分处理者执行部分数据处理活动。数据处理者当前使用的分处理者清单，可应数据控制者的合理请求提供。
⠀
5.2 The Data Processor shall ensure by contract that sub-processors undertake data protection obligations equivalent to those under this DPA. The Data Processor shall be liable to the Data Controller for the data processing activities of its sub-processors.
5.2 数据处理者应通过合同确保分处理者承担与本DPA同等的数据保护义务。数据处理者对分处理者的数据处理行为向数据控制者承担责任。
⠀
Article 6 Data Breach
第六条 数据泄露
⠀
6.1 Upon becoming aware of a security incident affecting the Data Controller's personal data, the Data Processor shall notify the Data Controller as soon as reasonably practicable.
6.1 数据处理者在知悉影响数据控制者个人数据的安全事件后，应在合理可行的范围内尽快通知数据控制者。
⠀
6.2 The notification shall include (to the extent known):
6.2 通知内容应包括（在已知范围内）：
⠀
(a) A description of the nature of the security incident, including the categories and approximate number of data subjects affected;
（a）安全事件的性质描述，包括受影响的数据主体类别和大致数量；
⠀
(b) The likely consequences;
（b）可能产生的后果；
⠀
(c) The measures taken or proposed to be taken by the Data Processor in response.
（c）数据处理者已采取或拟采取的应对措施。
⠀
6.3 The Data Processor shall, to the extent reasonable, assist the Data Controller in fulfilling its obligations to notify regulatory authorities and data subjects pursuant to applicable law.
6.3 数据处理者应在合理范围内协助数据控制者履行其依据适用法律向监管机构和数据主体进行通知的义务。
⠀
Article 7 Cross-Border Transfer
第七条 跨境传输
⠀
7.1 The Data Processor shall store personal data in the data center within the service region selected by the Data Controller.
7.1 数据处理者应将个人数据存储于数据控制者所选定的服务区域的数据中心内。
⠀
7.2 If it is necessary to transfer personal data to a country or region outside the region selected by the Data Controller for the purpose of providing the service, the Data Processor shall:
7.2 如因提供服务所需而必须将个人数据传输至数据控制者所选定区域以外的国家或地区，数据处理者应：
⠀
(a) Ensure that the country or region where the recipient is located has data protection standards equivalent to the PDPA, or enter into contractual arrangements with the recipient containing adequate data protection clauses;
（a）确保接收方所在国家或地区具有与PDPA同等的数据保护标准，或与接收方签署包含充分数据保护条款的合同安排；
⠀
(b) Adopt appropriate technical measures (such as encryption) to protect the security of data in transit.
（b）采取适当的技术措施（如加密）保护传输中的数据安全。
⠀
Article 8 Limitation of Liability
第八条 责任限制
⠀
Unless otherwise mandated by applicable law or otherwise agreed in writing by the parties, the liability of either party under this DPA shall be subject to the limitation of liability provisions set out in the Alibaba Mail Product Terms of Service.
除非适用法律另有强制性规定或双方另有书面约定，本DPA项下的任何一方的责任应受Alibaba Mail产品服务条款中所约定的责任限制条款的约束。
⠀
Article 9 Term and Termination
第九条 期限与终止
⠀
9.1 This DPA shall become effective on the date the Data Controller commences use of the Alibaba Mail service and shall terminate on the date the Data Processor completes the deletion or return of all personal data.
9.1 本DPA自数据控制者开始使用Alibaba Mail服务之日起生效，并在数据处理者完成对全部个人数据的删除或归还之日终止。
⠀
9.2 Termination of the Alibaba Mail Product Terms of Service shall not affect the validity of the provisions of this DPA that are intended to survive termination (including but not limited to Article 4, Clause 4.5, Article 6, and Article 9).
9.2 Alibaba Mail产品服务条款的终止不影响本DPA中在终止后应继续适用的条款的效力（包括但不限于第四条第4.5款、第六条和第九条）。
⠀
Article 10 Governing Law and Dispute Resolution
第十条 适用法律与争议解决
⠀
10.1 The governing law and dispute resolution mechanism of this DPA shall be handled in accordance with the dispute resolution provisions agreed upon in the Alibaba Mail Product Terms of Service.
10.1 本DPA的适用法律与争议解决方式，应按照Alibaba Mail产品服务条款中约定的争议解决方式处理。