数据处理补充协议

Data Processing Addendum

请仔细阅读这些条款。如您单击“同意”或以其他方式接受这些条款，即表明您同意受这些条款的约束，这些条款可能会不时修订。

PLEASE READ THESE TERMS CAREFULLY. BY CLICKING “AGREE” OR OTHERWISE ACCEPTING THESE TERMS, YOU INDICATE YOUR AGREEMENT TO BE BOUND BY THESE TERMS AS MAY BE AMENDED FROM TIME TO TIME.

本数据处理补充协议（“DPA”）由阿里巴巴（中国）网络技术有限公司（“阿里巴巴”）代表其自身及其附属公司与Alibaba.com网站（网址：http://www.alibaba.com)上的供应商会员（“供应商”或“您”）签订。

This Data Processing Addendum ("DPA") is entered into between Alibaba (China) Technology Co., Ltd ("Alibaba") on behalf of itself and its affiliates and Alibaba.com International Website (URL :http://www.alibaba.com) Supplier Member ("Supplier" or “You”). 

序言

Recitals

(1)              阿里巴巴与供应商签订了一份或多份采购订单、合同和/或协议（“服务协议”），根据该协议，阿里巴巴同意向供应商提供服务协议（“服务”）中更详细描述的特定服务。服务协议包括但不限于《免费会员协议》和《阿里巴巴国际站中国商家会员服务合同》。在提供服务时，阿里巴巴可能会处理供应商或其客户控制的个人数据。

Alibaba has entered into one or more purchase orders, contracts and/or agreements with Supplier (the "Services Agreement") pursuant to which Alibaba has agreed to provide certain services to Supplier as more particularly described in the Services Agreement ("Services"). The Service Agreements include but are not limited to  Free Membership Agreement and Alibaba.com China Gold Supplier Membership Service Contract. In providing the Services, Alibaba may Process Personal Data controlled by Supplier or its customers.

(2)              本DPA是阿里巴巴根据可适用的隐私保护法代表供应商处理个人数据的依据。

This DPA sets out the basis upon which Alibaba will Process Personal Data on behalf of Supplier in accordance with the requirements of Applicable Privacy Laws.

双方同意：

IT IS AGREED:

1.    定义：以下术语应具有以下含义：

Definitions:  The following terms shall have the following meanings:

(a)               “可适用的隐私保护法”是指适用于本DPA中个人数据处理的任何国家、国际、联邦、州的隐私、数据保护法律以及其他隐私、数据保护法律.

"Applicable Privacy Laws" means any and all national, international, federal, state and other privacy and data protection laws that apply to the Processing of Personal Data that is the subject of this DPA;

(b)               “控制者”指决定个人数据处理目的和方式的主体；

"Controller" means an entity that determines the purposes and means of the Processing of Personal Data;

(c)                “数据主体”指已识别或可识别的个人；

"Data Subject" means an identified or identifiable individual;

(d)               “个人数据”指与已识别或可识别个人有关的任何信息（包括适用隐私保护法定义的“个人数据”、“个人信息”或“个人可识别信息”范围内的任何信息）；

"Personal Data" means any information relating to an identified or identifiable individual (including any information that falls within the scope of "Personal Data", "personal information", or "personally identifiable information", as defined under Applicable Privacy Laws);

(e)               “处理”（和“处理过程”）是指对个人数据执行的任何操作或一组操作；以及

"Processing" (and "Process") means any operation or set of operations performed on Personal Data; and

(f)                “处理者”指代表控制者处理个人数据的主体。

"Processor" means an entity that Processes Personal Data on behalf of a Controller.

2.     双方关系：供应商（作为控制者，或作为代表第三方控制者的处理者，如供应商的企业客户）授权阿里巴巴（作为处理者或分处理者，如适用）处理附录1所述的个人数据（“数据”），以便根据本协议提供服务。

Relationship of the parties:  Supplier (either as a Controller, or as a Processor acting on behalf of a third party Controller, such as an enterprise customer of Supplier) appoints Alibaba (as a Processor or sub-Processor, as applicable) to Process the Personal Data described in Appendix 1 ("the Data") in order to provide Services pursuant to the Services Agreement.   

3.     目的限制：阿里巴巴应作为处理者（或分处理者，如适用）处理数据，以履行其在《服务协议》项下的义务，并在附录1中进行更详细的描述。在此过程中，阿里巴巴应按照供应商的书面说明处理数据，但相关法律另有规定的情况除外。如果阿里巴巴认为供应商的指示违反了可适用的隐私保护法或任何其他可适用的法律，阿里巴巴应立即通知供应商。

Purpose limitation:  Alibaba shall Process the Data as a Processor (or sub-Processor, as applicable) as necessary to perform its obligations under the Services Agreement, and as more particularly described in Appendix 1.  In doing so, it shall Process the Data in accordance with the documented instructions of Supplier, except where and to the extent otherwise required by law(s) applicable to Alibaba.  Alibaba shall immediately inform Supplier if in its opinion, an instruction of Supplier infringes Applicable Privacy Laws or any other applicable laws.

4.     安全：阿里巴巴应采取适当的技术和组织措施，保护数据免受（a）意外或非法破坏，以及（ii）数据丢失、更改、未经授权披露或访问（“安全事件”）。

Security:  Alibaba shall implement appropriate technical and organisational measures to protect the Data from and against (a) accidental or unlawful destruction, and (ii) loss, alteration, unauthorised disclosure of, or access to the Data (a "Security Incident").    

5.     安全事故：阿里巴巴应及时向供应商报告任何安全事故，并应供应商的合理要求提供协助，以履行其与事件相关的法律义务。阿里巴巴应进一步采取一切必要的措施和行动，以补救或减轻安全事故的影响。

Security Incidents: Alibaba shall report any Security Incident without undue delay to Supplier and provide such assistance as Supplier may reasonably require for the purposes of complying with its obligations under applicable law relating to the incident.  Alibaba shall further take all such measures and actions as are necessary to remedy or mitigate the effects of the Security Incident. 

6.     分处理：阿里巴巴通常有权聘请第三方分包商处理服务协议项下的数据，前提是：（i）阿里巴巴至少提前7天通知任何分处理者的添加或移除（包括其执行或将执行的处理细节）；（ii）阿里巴巴与其指定的任何分处理者签订数据保护条款，要求其至少按照可适用隐私保护法的标准保护此类数据；以及（iii）阿里巴巴仍对分处理者导致的违反本DPA的行为负责。在阿里巴巴任命或更换分处理者之前，供应商可以基于合理的数据保护目的反对分处理者的任命与更换，这种情况下，阿里巴巴将不会任命或更换分处理者。若无法这样做，供应商可以终止相关服务以及适用于该服务的本DPA，但不影响供应商在该终止前承担该服务产生的任何费用或成本，也不影响服务协议、向供应商提供的任何其他服务，以及与这些其他服务有关的任何费用或成本；

Sub-Processing: Alibaba is generally authorised to engage third party subcontractors to process the Data for the purposes under the Services Agreement provided that: (i) Alibaba provides at least 7 days' prior notice of the addition or removal of any sub-Processor (including details of the Processing it performs or will perform); (ii) Alibaba imposes data protection terms on any sub-Processor it appoints to protect the Data, that require it to protect such data to at least the standard required by Applicable Privacy Laws; and (iii) Alibaba remains liable for any breach of this DPA that is caused by its sub-Processor. Supplier  may object to Alibaba's appointment or replacement of such a sub-Processor before its appointment or replacement, provided such objection is based on reasonable grounds relating to data protection. In such event, Alibaba will either not appoint or replace the relevant sub-Processor or, if this is not possible, Supplier may terminate the relevant Services and this DPA to the extent it applies to that Services, but without prejudice to any fees or costs incurred by Supplier for that Services before that termination and without prejudice to the Services Agreement, any other Services provided to Supplier, and any fees or costs in relation to those other Services;

7.     合作和数据主体权利：阿里巴巴应向供应商提供合理协助，使供应商能够响应：（i）数据主体根据可适用隐私保护法行使其数据保护权利的请求；以及（ii）从数据主体或监管机构收到的与数据处理有关的其他信函、询问或投诉。如果直接向阿里巴巴提出任何此类请求、信函、查询或投诉，阿里巴巴应通知供应商提供相关细节，而无需回复，但适用于阿里巴巴的法律要求的情况除外。

Cooperation and Data Subjects' rights:  Alibaba shall provide to Supplier reasonable assistance to enable Supplier to respond to: (i) request from a Data Subject to exercise its data protection rights in accordance with Applicable Privacy Laws; and (ii) other correspondence, enquiry or complaint received from a Data Subject or regulator in connection with the Processing of the Data.   In the event that any such request, correspondence, enquiry or complaint is made directly to Alibaba, Alibaba shall inform Supplier providing details of the same without responding, except where and to the extent require by law(s) applicable to Alibaba.

8.     处理的保密性：阿里巴巴应采取适当措施，要求其授权处理数据的任何人（“授权人”）承担保密义务（无论是合同义务还是法定义务）。

Confidentiality of Processing:  Alibaba shall take appropriate measures to require any person that it authorises to Process the Data (an "Authorised Person") to be subject to a duty of confidentiality (whether a contractual duty or a statutory duty).

9.    数据保护影响评估：阿里巴巴应向供应商提供必要的协助，以便供应商根据可适用的隐私保护法（如有要求）进行数据保护影响评估。

Data Protection Impact Assessment:  Alibaba shall provide Supplier with such assistance as is necessary for Supplier to conduct a data protection impact assessment in accordance with Applicable Privacy Laws (where required).

10.  数据的删除或返还：在服务协议终止或到期时，阿里巴巴应（由供应商选择）销毁或返还其处理的所有数据，除非：（i）阿里巴巴根据适用的法律要求保留数据副本；或（ii）删除保存在备份档案中，且不可能立即删除，即使在备份档案中，数据也应安全存储，并与任何进一步处理隔离，直到可以删除为止。

Deletion or return of the Data:  Upon termination or expiry of the Services Agreement, Alibaba shall (at Supplier's election) destroy or return to Supplier all the Data it Processes, except to the extent that: (i) Alibaba is required to maintain a copy of the Data in accordance with Applicable Laws; or (ii) deletion is held in backup archives and prompt deletion is not possible, in which even such the Data shall be stored securely and isolated from any further Processing until such time as deletion is possible. 

11.  审计：阿里巴巴应向供应商提供证明阿里巴巴遵守本DPA所需的所有信息，并允许供应商或供应商授权的其他审计师（前提是该审计师不是阿里巴巴的竞争对手）进行审计，包括检查。供应商同意阿里巴巴可通过提供其就相关服务创建的任何内部审计报告或其持有的第三方审计证书的副本来满足任何此类审计请求。

Audit:  Alibaba shall make available to Supplier all information necessary to demonstrate Alibaba's compliance with this DPA and allow for and contribute to audits, including inspections, conducted by the Supplier or another auditor mandated by Supplier (provided such auditor is not a competitor to Alibaba). Supplier agrees that Alibaba may satisfy any such audit requests by providing copies of any internal audit reports it has created or third party audit certifications it holds in respect of the relevant Services.   

12.  供应商责任

供应商同意：

Supplier responsibilities

Supplier agrees:

a.       遵守所有可适用的隐私保护法规定的义务。

To comply with its obligations under all Applicable Privacy Laws.

b.       本DPA、服务协议以及与阿里巴巴签订的其他适用协议将共同构成供应商向阿里巴巴提供的关于数据处理的完整且最终的书面说明。

That this DPA, the Services Agreement, other applicable agreements with Alibaba will together comprise Supplier’s complete and final documented instructions to Alibaba on the Processing of the Data.

c.        供应商向阿里巴巴发出的指示以及使用阿里巴巴服务的方式不得违反任何可适用的隐私保护法，也不得有导致阿里巴巴或其任何关联公司违反任何可适用的隐私保护法的可能性。

That Supplier shall not give Alibaba any instructions, nor shall Supplier use the Services in any way, that in any such case could infringe any Applicable Privacy Laws or could cause Alibaba or any of its affiliates to infringe any Applicable Privacy Laws.

13.  服务协议与本DPA之间的关系：双方打算并同意将本DPA纳入服务协议，并构成其不可分割的一部分。因此，自生效日期起，本DPA应在必要的范围内修订服务协议，以将本DPA纳入服务协议。除非本DPA中另有明确规定，否则本DPA应完全遵守服务协议的条款和条件（包括任何责任排除或限制）。如果本DPA与服务协议之间存在任何冲突或不一致，应以本DPA的条款为准。此外，如果本DPA正文和附录之间存在任何冲突或不一致，应以附录为准。

Relationship between the Services Agreement and this DPA: The parties intend and agree that this DPA shall be incorporated into, and form an integral part of, the Services Agreement.  Accordingly, with effect from the Effective Date, this DPA shall amend the Services Agreement to the extent necessary to incorporate this DPA into the Services Agreement.  Except where expressly stated otherwise in this DPA, this DPA shall be subject to the terms and conditions of the Services Agreement (including any exclusions or limitations of liability) in full.  To the extent there is any conflict or inconsistency between this DPA and the Services Agreement, the terms of this DPA shall prevail.  Further, to the extent there is any conflict or inconsistency between the body and appendices of this DPA, the appendices shall prevail.

14.  语言。如果本补充协议中英文两个版本意思出现分歧，以英文版本为准。

Language. If there is any inconsistency between the English version and the Chinese version of the Addendum, the English version shall prevail.

附录1

Appendix 1

数据处理说明

Data Processing Description

本附件1描述了阿里巴巴将代表供应商进行的处理。

This Appendix 1 describes the Processing that Alibaba will perform on behalf of Supplier.

附录3

Appendix 3
（特殊管辖权条款）

(Jurisdiction-Specific Terms)

本附录3规定了双方必须遵守的司法管辖区特定条款和条件。本附录3中使用的大写术语应具有本DPA正文中给出的含义，除非另有明确说明。

This Appendix 3 sets out jurisdiction-specific terms and conditions with which the parties must comply.  Capitalised terms used in this Appendix 3 shall have the meanings given to them in the main body of this DPA, except where expressly indicated otherwise.

第一部分

（欧盟/英国数据保护条款）

Section I
(EU/UK Data Protection Terms)

1.     范围和冲突：如果阿里巴巴根据服务协议处理的隔热数据受欧盟/英国数据保护法的约束，则适用本附录3第一部分的内容。

Scope and conflicts:  Where and to the extent that the Data Processed by Alibaba pursuant to the Services Agreement is subject to EU/UK Data Protection Law, this Appendix 3, Section I shall apply. 

2.     定义：以下术语应具有以下含义：

Definitions:  The following terms shall have the following meanings:

(a)          “控制者”、“处理者”、“数据主体”、“个人数据”和“处理”（和“过程”）应具有欧盟/英国数据保护法赋予的含义；

"Controller", "Processor", "Data Subject", "Personal Data" and "Processing" (and "Process") shall have the meanings given in EU/UK Data Protection Law;

(b)          “EEA”指欧洲经济区；

"EEA" means the European Economic Area;

(c)           “欧盟/英国数据保护法”是指：（i）欧洲议会和理事会关于保护自然人处理个人数据和此类数据自由流动的第2016/679号条例（“欧盟GDPR”）；（ii）根据英国《2018年欧盟（退出）法案》第3节保存在英国法律中的欧盟GDPR（“英国GDPR”）；（iii）欧盟电子隐私指令（指令2002/58/EC）；以及（iv）根据、依据或结合（i）、（ii）或（iii）中任何一项制定的一切可适用的国家数据保护法律；上述法律在任何情况下，可能被随时修订或取代；

"EU/UK Data Protection Law" means: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (the "EU GDPR"); (ii) the EU GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom's European Union (Withdrawal) Act 2018 (the "UK GDPR"); (iii) the EU e-Privacy Directive (Directive 2002/58/EC); and (iv) any and all applicable national data protection laws made under, pursuant to or that apply in conjunction with any of (i), (ii) or (iii); in each case as may be amended or superseded from time to time;

(d)          “限制性传输”是指：（i）在欧盟GDPR适用的情况下，将个人数据从欧洲经济区转移到欧洲经济区以外的国家，不受欧盟委员会充分性决定的约束；以及（ii）在英国GDPR适用的情况下，根据《2018年英国数据保护法》第17A节，个人数据从英国传输到任何其他国家，且不受充分性法规的约束；以及

"Restricted Transfer" means: (i) where the EU GDPR applies, a transfer of Personal Data from the EEA to a country outside of the EEA which is not subject to an adequacy determination by the European Commission; and (ii) where the UK GDPR applies, a transfer of Personal Data from the United Kingdom to any other country which is not subject based on adequacy regulations pursuant to Section 17A of the United Kingdom Data Protection Act 2018; and

(e)          “标准合同条款”是指：（i）在欧盟GDPR适用的情况下，根据欧洲议会和理事会（“欧盟SCCS”）的条例（欧盟）2016/679，2021年6月4日欧洲委员会执行《关于个人数据向第三个国家转移的标准合同条款》附件2021/914的合同条款；以及（ii）在英国GDPR适用的情况下，根据英国GDPR（“英国SCCs”）第46条通过或允许的标准数据保护条款。

"Standard Contractual Clauses" means: (i) where the EU GDPR applies, the contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council ("EU SCCs"); and (ii) where the UK GDPR applies, standard data protection clauses adopted pursuant to or permitted under Article 46 of the UK GDPR ("UK SCCs"). 

3.    受到限制的传输：双方同意，当供应商向阿里巴巴传输数据属于受到限制的转移时，应遵守以下适当的标准合同条款：

Restricted transfers:  The parties agree that when the transfer of the Data from the Supplier to Alibaba is a Restricted Transfer it shall be subject to the appropriate Standard Contractual Clauses as follows:

(a)          对于受欧盟GDPR保护的数据，欧盟SCCs将按以下方式适用：

in relation to data that is protected by the EU GDPR, the EU SCCs will apply completed as follows:

(i)      模块二将适用于（其中供应商是个人数据控制者）；

Module Two will apply (where Supplier is a Controller of the Data);

(ii)     模块三将适用于（其中供应商是代表第三方控制者的个人数据处理者）；

Module Three will apply (where Supplier is a Processor of the  Data on behalf of a third party Controller);

(iii)   在第7条中，可选对接条款将适用；

in Clause 7, the optional docking clause will apply;

(iv)   在第9条中，选项2将适用，分处理者变更事项的事先通知期限应符合本DPA第7条的规定；

in Clause 9, Option 2 will apply, and the time period for prior notice of sub- Processor changes shall be as set out in Clause 7 of this DPA;

(v)    在第11条中，可选语言不适用；

 in Clause 11, the optional language will not apply;

(vi)   在第17条中，选项1将适用，欧盟SCC将受荷兰法律管辖；

in Clause 17, Option 1 will apply, and the EU SCCs will be governed by the law of  The Netherlands;

(vii)  在第18（b）条中，争议应在荷兰法院解决；

in Clause 18(b), disputes shall be resolved before the courts of The Netherlands;

(viii) 欧盟SCCs的附件I应被视为已被本附录3和附件I中的信息所完成。

Annex I of the EU SCCs shall be deemed completed with the information set out      in Annex I to this Appendix 3.

(b)          关于受英国GDPR保护的个人数据，英国SCCs将按以下方式申请：

in relation to the Data that is protected by the UK GDPR, the UK SCCs will apply completed as follows:

(i)       只要欧盟委员会2010年2月5日第2010/87/EU号决定（“之前的C2P SCC”）中规定的个人数据传输至处理方的标准合同条款合法允许其从英国传输个人数据，之前的C2P SCC应在供应商（其中供应商是为相关第三方控制方的利益而进入的处理者）和阿里巴巴之间基于以下基础适用：

For so long as it is lawfully permitted to rely on standard contractual clauses for the transfer of personal data to processors set out in the European Commission’s Decision 2010/87/EU of 5 February 2010 (“Prior C2P SCCs”) for transfers of personal data from the United Kingdom, the Prior C2P SCCs shall apply between Supplier (which, where Supplier is a processor it enters for the benefit of the relevant third party controller)         and Alibaba on the following basis:

(A)              附录1应填写本附录3附件I中规定的相关信息；

Appendix 1 shall be completed with the relevant information set out in Annex I to this Appendix 3;

(B)              可选的说明性赔偿条款不适用。

the optional illustrative indemnification Clause will not apply.

(ii)    如果上述 (b)(i) 款不适用，但供应商和阿里巴巴根据欧盟 SCC 从英国传输个人数据被合法允许，则需签订信息专员办公室根据 2018 年数据保护法第 119A(1) 条发布的“英国对欧盟的补充协议标准合同条款”（“英国补充协议”）

Where sub-clause (b)(i) above does not apply, but Supplier and Alibaba are lawfully permitted to rely on the EU SCCs for transfers of personal data from the United Kingdom subject to completion of a “UK Addendum to the EU Standard Contractual Clauses” (“UK Addendum”) issued by the Information Commissioner’s Office under s.119A(1) of the Data Protection Act 2018, then:

(A)              按照本节第 3(a) 条的规定完成的欧盟 SCC 也应适用于此类个人数据的传输，但须符合以下 (B) 款的规定；

the EU SCCs, completed as set out above in clause 3(a) of this Section I shall also apply to transfers of such the Data, subject to sub-clause (B) below;

(B)              英国补充协议应被视为在传输的供应商和阿里巴巴之间履行，并且欧盟SCC应被视为按照英国补充协议就此类个人数据的转移进行了修改。the UK Addendum shall be deemed executed between the transferring Supplier and Alibaba, and the EU SCCs shall be deemed amended as specified by the UK Addendum in respect of the transfer of such the Data.

(iii)     如果第(b)(i)款或第(b)(ii)款均不适用，则供应商和阿里巴巴应真诚合作，对英国GDPR要求或允许的个人数据传输实施适当的保障措施，不得无故延迟；以及

If neither sub-clause (b)(i) or sub-clause (b)(ii) applies, then Supplier and Alibaba shall cooperate in good faith to implement appropriate safeguards for transfers of such the Data as required or permitted by the UK GDPR without undue delay; and

(c)                如果本DPA的任何条款直接或间接与标准合同条款相矛盾，则应以标准合同条款为准。

in the event that any provision of this DPA contradicts, directly or indirectly, the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.

Annex I

附件1

Data Processing Description

数据处理说明

本附件1构成DPA的一部分，并描述了阿里巴巴将代表供应商（作为控制者和/或处理者）执行的处理。

This Annex I forms part of the DPA and describes the Processing that Alibaba will perform on behalf of Supplier (as Controller and/or Processor).

A.            缔约方名单

       LIST OF PARTIES

控制者/数据输出者（们）：

Controller/Data exporter(s):

处理者（们）/数据接收者（们）：

Processor(s) / Data importer(s):

В.          转让说明

       DESCRIPTION OF TRANSFER

请参见本DPA附录1中的说明。

Please see the description provided in Appendix 1 of this DPA.

 C.           主管监督机构

       COMPETENT SUPERVISORY AUTHORITY