Data Processing Agreement

Updated 18 September 2026

Draft — pending owner/legal review before publication

Service operator

Loading operator details…

[Owner must provide: legal entity name in English]

[Owner must provide: tax identification number]

[Owner must provide: registered address in English]

[Owner must provide: public contact and privacy email]

Paddle — Merchant of Record

Paddle.com is the Merchant of Record for Paddle purchases in both Thailand and Global editions: Paddle is the seller to the buyer, processes payment and applicable taxes, and issues the buyer’s invoice/receipt and applicable tax documentation. XBalance supplies the software service, not a second invoice for the same Paddle purchase.

Instructions and scope

The customer business is the controller and the operator is the processor of names, addresses, contact details, accounting documents and employee data entered by the business. Processing consists of storage, computation and presentation on documented instructions during service and lawful retention.

Duties and assistance

The processor must ensure confidentiality, apply risk-appropriate security, assist with rights requests and impact assessments, and notify the controller of personal-data breaches without undue delay. Audit information may be provided within an agreed scope that protects other customers’ data.

Subprocessors and transfers

The subprocessor list and processing locations must be confirmed before this agreement is used. Appointments and changes require authorisation and applicable data-protection duties. International transfers require safeguards under applicable PDPA/GDPR provisions.

End of service

Return or handle data on the controller’s instructions subject to legal retention requirements. Cancellation does not trigger automatic deletion. Legally retained records must have restricted use. This agreement remains a draft pending owner and legal review.

Start free