處理者條款， 包含附件。

本數據處理附錄（"DPA"）構成 Digital Socket LLC，一家在美國德拉瓦州成立的有限責任公司，以 Transglot 名義經營 （"Transglot"，"處理者"）與客戶（"客戶"，"控制者"）之間的服务條款或其他書面協議（"協議"）的一部分，適用於我們在提供服務時代表客戶處理客戶個人資料的任何情況。它通過引用併入協議，並在協議生效時生效；無需簽名即可約束我們。如果客戶本身是代表第三方控制者行事的處理者，則客戶為出口方，本DPA視同其為控制者適用，且客戶確認其已從其自身的控制者處獲得授權，以按這些條款簽訂本DPA。

「資料保護法」指適用於一方的所有關於處理個人資料的法律，包括歐盟《一般資料保護規章》2016/679（「GDPR」）、英國 GDPR 及《2018 年資料保護法》、瑞士《聯邦資料保護法》、經修訂的《加州消費者隱私法案》（「CCPA」）以及美國各州類似的隱私法律。「客戶個人資料」指包含在客戶內容中或由我們代表客戶處理的個人資料。「標準合約條款」或「SCCs」指附錄於歐盟委員會執行決定 (EU) 2021/914 的條款。「英國增補文件」指英國資訊專員根據《2018 年資料保護法》第 119A 條發布的國際數據傳輸增補文件。「次級處理者」指由我們聘請以處理客戶個人資料的第三方。「控制者」、「處理者」、「資料主體」、「個人資料」、「處理」、「個人資料外洩」及「監管機構」具有 GDPR 賦予的含義，其他法律中的等效術語則具有其等效含義。

若發生衝突，優先順序如下：(a) 適用的標準合約條款及英國增補文件；(b) 本資料處理協議 (DPA)；(c) 訂單表格中的任何其他資料保護條款；(d) 協議的其餘部分。本 DPA 無意與任何一方根據資料保護法承擔的義務相衝突，任何可能導致此類衝突的條款應在消除衝突所需的最小範圍內進行解釋。

本 DPA 自協議生效日起適用，直至我們不再持有任何客戶個人資料為止，這可能在協議終止後因第 13 條規定的刪除時間表而發生。只要我們仍持有任何客戶個人資料，其義務在終止後仍然有效，且保密義務在資料保護法要求的範圍內無限期有效。

我們僅依據客戶的書面指示處理客戶個人資料，包括向第三國傳輸的情況，除非我們受法律要求必須如此行事，在這種情況下，我們將在使用前通知客戶該要求，除非法律基於重要的公共利益理由禁止此類通知。協議、本 DPA、文件說明以及客戶在產品中設定的配置（專案、語言環境、連接器、Webhook 訂閱、保留開關、翻譯記憶庫開關以及客戶可用的引擎和品質設定）共同構成客戶完整的書面指示。如果我們認為某項指示違反資料保護法，我們將通知客戶，並且我們可以暫停受影響的處理直到該指示被撤回或修改，而不是執行該指示。

我們僅為向客戶提供、保護、支援和維護服務而處理客戶個人資料，不用於我們自身的任何獨立目的。我們不出售客戶個人資料，不為了跨情境行為廣告而分享該資料，除資料保護法允許服務提供者進行的情況外，不將該資料與我們從其他來源收到的個人資料合併，也不使用該資料來訓練、微調或評估任何機器學習模型。我們的 AI 次級處理者僅將其用於推論，並受禁止对其进行訓練的商業條款約束。我們可以創建和使用既不識別客戶也不識別任何資料主體的匯總或去識別化統計數據，並且不會嘗試重新識別這些數據。

我們確保每位獲授權處理客戶個人資料的人員均受適當的保密義務約束，無論是合約性或法定性的，該義務在其參與結束後仍然有效。存取權限基於最小權限原則授予，僅限於個人履行職責所需的範圍，定期審查並在角色變更或離職時迅速撤銷。擁有存取權限的人員會接受與其角色相稱的資料保護和安全培訓。

我們實施並維持附件 II 中規定的技術和組織措施，同時考慮到技術發展水平、實施成本以及處理的性質、範圍、背景和目的，以及對資料主體的風險。我們可能會隨著時間更新這些措施，前提是付費訂閱期間整體保護水平不會大幅降低。附件 II 刻意列出了我們的差距以及我們的控制措施：僅列出優勢的措施附件並非審核員可以依賴的文件。

客戶給予我們一般性書面授權，允許我們聘請次級處理者，類別如次級處理者文件中所述，並特別授權截至生效日附件 III 中提供的次級處理者名單上的那些實體。我們透過書面合約對每個次級處理者施加不低於本 DPA 保護程度的資料保護義務，並且我們就次級處理者履行其義務的情況向客戶承擔全部責任。在新次級處理者開始處理客戶個人資料之前，我們將通過電子郵件向帳戶所有者發出至少三十天的通知。客戶可以在該期間內基於合理且有記錄的資料保護理由提出異議，在這種情況下，我們將誠信合作，提供更改配置或避免該處理的替代方案；如果我們在合理時間內無法做到，客戶可以終止受影響的訂閱而無需支付罰款，並獲得預付未使用費用的按比例退款。

考量處理性質，我們在可能範圍內，透過適當的技術與組織措施，協助客戶履行回應資料主體行使存取、更正、刪除、限制、可攜性或反對權利的義務。產品本身即是此類協助的第一線：帳戶擁有者和工作區管理員可以搜尋、編輯和刪除專案內容、管理成員與角色，並在付費方案中透過 API 拉取端點、命令列介面、交付套件或儲存連接器擷取專案內容；帳戶擁有者亦可刪除工作區。若產品無法直接回應請求，我們將應要求在合理期間內免費提供協助（限於合理數量的請求）。若資料主體直接聯絡我們關於客戶個人資料的事宜，我們不會自行實質回應；我們會告知其聯絡客戶，並在非屬禁止的情況下，及時通知客戶。

考量處理性質及我們所掌握的資訊，我們協助客戶履行 GDPR 第 32 至 36 條及其同等規定的義務，包括資料保護影響評估及事先諮詢監管機構。實務上，這意味著提供本 DPA、附件二、信任中心揭露資訊、隱私權政策中的保留時程表、我們的安全文件，以及對安全或隱私問卷的合理書面回覆。若協助範圍大幅超出合理數量，我們可能按當時的專業服務費率收費，並會在執行前告知，而非事後才說明。

我們在知悉影響客戶個人資料的個人資料外洩事件後，會毫不遲延地通知客戶，且無論如何均在七十二小時內進行。通知內容將依據當時所知資訊（並隨後續瞭解更新）描述：外洩性質，包括在可能情況下受影響的資料主體類別與大致數量、相關記錄數量；可能後果；已採取或擬採取的因應與減緩措施；以及進一步資訊的聯絡窗口。我們將配合客戶，並依客戶合理要求採取步驟，協助其進行調查與通知。該通知不構成、也不應被解釋為承認過失或責任。我們不會為了先完成調查而延遲發出通知。

由客戶選擇，我們將在服務提供結束時刪除或返還客戶個人資料，並刪除現有副本，除非適用法律要求儲存。在產品中，運作方式如下：取消訂閱會將帳戶轉為免費方案（含一個工作區），其他所有工作區將變更為唯讀，並於 30 天後刪除；若工作區近期已經歷相同程序（如服務條款第 13 條所述），則可能更早刪除，除非客戶在此之前升級或移動該工作區；刪除工作區會使其在 30 天內保持唯讀，期間帳戶擁有者可還原，過後該工作區將從即時資料庫中徹底清除，包括專案、翻譯、版本歷史、使用記錄、Webhook 傳遞記錄、螢幕截圖和稽核事件；關閉帳戶將以相同方式刪除其下所有工作區，並將帳戶發票保留 7 年；刪除使用者登入資料則立即生效且不可逆。客戶透過 API、命令列介面、交付套件或儲存連接器擷取的內容，自交付之時起即不在我們控制範圍內。加密備份不受清除作業影響，並依附件二的時程到期；在存在期間，這些備份處於隔離且加密狀態，僅用於災難復原，絕不用於恢復已清除的工作區。若在刪除前提出以結構化格式返還的書面請求，我們將在合理期間內免費處理一次。

我們向客戶提供合理必要的資訊，以證明符合本 DPA 及 GDPR 第 28 條的规定，並允許且配合由客戶或其委任的稽核員進行的稽核（包括檢查）。首要而言，此義務透過本 DPA、附件二、信任中心、安全頁面以及我們已完成的安全問卷回覆來履行。若上述資料確實不足以滿足客戶的法規義務，客戶可在任何十二個月期間內進行一次稽核，需提前至少三十天書面通知，於營業時間內進行，不得無理干擾我們的營運，並須遵守保密義務，僅限於與客戶自身資料相關的系統和記錄，費用由客戶承擔。行使法定權力的監管機構不受上述限制約束。稽核員不得為我們的競爭對手，且我們可要求其另行簽署保密承諾。

若我們對客戶個人資料的處理涉及從歐洲經濟區轉移到未獲充分性決定的國家，標準合約條款將併入本資料處理附錄（DPA）並構成其一部分，且按以下方式適用。當客戶為資料控制者時，適用模組二（控制者對處理者）。當客戶本身為處理者時，適用模組三（處理者對處理者）。第7條（接駁條款）適用。在第9條中，已選擇選項2（一般書面授權），通知期如上第09條所述。在第11條中，未選擇可選的獨立爭議解決語言。在第17條中，除非雙方在訂單表中同意另一歐盟成員國法律，否則條款受愛爾蘭共和國法律管轄。在第18(b)條中，爭議基於相同基礎由愛爾蘭共和國法院解決。附件I(A)為雙方，附件I(B)為轉移描述，附件I(C)為主管監管機構，附件II為技術和組織措施，附件III為子處理者清單，均如下所述。

對於受英國GDPR約束的轉移，英國附加條款併入並完成如下：表1由附件I(A)完成；表2和3由本DPA的第15條及附件I和II完成，並依賴經批准的歐盟SCCs版本；在表4中，當經批准的附加條款變更時，任何一方均不得終止該附加條款。對於受瑞士法律約束的轉移，SCCs中對GDPR的引用應解讀為對瑞士聯邦數據保護法的引用，主管機構為聯邦數據保護和信息專員，對成員國的引用不剝奪瑞士數據主體在其慣常居住地起訴的權利，且SCCs保護法人實體的數據，直到瑞士法律不再要求為止。

如果我們收到公共機構對客戶個人資料具有法律約束力的請求，我們將：審查其有效性和範圍，並在有合理理由認為其違法時提出質疑；僅披露請求所需的最少量資訊；除非法律禁止，否則及時通知客戶並提供足夠細節以便回應，在這種情況下，我們將盡合理努力獲得禁止令的豁免並尋求允許披露的臨時措施。我們會記錄收到的請求和給出的回應，并在法律允許的範圍內，根據要求向客戶和監管機構提供這些記錄。我們從未收到要求我們建立或保留對客戶個人資料的一般訪問機制的政府請求，我們也不會自願建立此類機制。

對於受CCPA約束的個人資訊，客戶為企業，我們為服務提供商。我們被禁止且不會出售或共享該個人資訊；不會出於協議中指定的業務目的或CCPA允許的其他目的以外的任何目的保留、使用或披露該資訊；不會在雙方直接業務關係之外保留、使用或披露該資訊；也不會將其與從其他來源收到的個人資訊合併，除非CCPA允許服務提供商這樣做。我們證明我們理解並將遵守這些限制。如果我們確定無法再滿足這些限制，我們將通知客戶。客戶可以利用第14條中的審計權，採取合理且適當的措施來停止和補救未經授權的使用。我們提供與CCPA對企業要求相同級別的隱私保護。

當適用的綜合州隱私法要求包含特定條款的處理者合約時，本DPA即為該合約：它規定了處理的性質和目的、數據類型、持續時間、雙方的權利和義務、我們的保密義務、我們在同等書面條款下聘請子處理者、我們對消費者權利請求和安全義務的協助、我們在服務結束時的刪除或返回義務，以及我們提供證明合規性所需資訊並允許進行合理評估的義務。在這些法律下，我們作為處理者或服務提供商行事，絕不作為客戶個人資料的控制者。

任何一方因本DPA產生或與其相關的責任，無論是基於合約、侵權還是任何其他理論，均受協議中責任限制和排除條款的約束，且這些限制中對一方責任的任何引用均指該方在協議和本DPA下的合計責任。本條款中的任何內容均不限制數據主體根據標準合約條款或數據保護法享有的權利，也不限制依法不能限制的責任。

我們可能會更新本DPA，以反映數據保護法的變更、新的或修訂的轉移機制、監管機構或法院的決定，或服務處理客戶個人資料方式的重大變更，前提是更新不會實質性降低對客戶個人資料的保護。對於重大更新，我們將通過電子郵件和本頁面提前至少三十天通知，並更改頂部的生效日期。我們會在要求時提供已被取代的版本。

本DPA無需簽名即可約束我們，因此客戶無需簽名即可受到保護。如果您的流程需要簽署的副本以作記錄，或者您希望提出修訂標記，請寫信至 privacy@transglot.ai，提供法人實體名稱、註冊地址、通知聯繫人和簽署人，我們將返回簽署副本。我們從同一地址回答安全和隱私問卷，信任中心攜帶大多數審核者在寫信給任何人之前所需的資料包。

Data exporter: the Customer, being the person or company that holds the Account, as named on the Account or on the Order Form, acting as controller (or as processor where clause 01 applies) in respect of Customer Personal Data processed through the Service. Contact details: the Account Owners' email addresses and the notice contact given on the Order Form. Activities relevant to the transfer: use of a cloud localization platform to store, translate, review, deliver and manage software and content strings. Signature and date: as recorded by acceptance of the Agreement, or as executed under clause 22. Data importer: Digital Socket LLC，一家在美國德拉瓦州成立的有限責任公司，以 Transglot 名義經營, acting as processor. Contact details: privacy@transglot.ai. Activities relevant to the transfer: provision of the Service described in the Agreement. Role: processor.

Categories of data subjects: the Customer’s personnel and contractors who hold a login (Account Owners and Billing Members, and workspace admins, developers, reviewers and translators); the Customer’s own end users, customers and other individuals to the extent their personal data appears inside source strings, translations, glossary entries, comments, screenshots or imported files; and the Customer’s billing and notice contacts. Categories of personal data: identity and contact data (name, email address, login identifier, Account, workspace and role); authentication data (hashed password, second factor enrolment, federated identity subject identifiers, API token digests); usage and technical data (IP address, user agent, pages and endpoints accessed, request and run identifiers, timings, outcomes, error traces, audit records); billing data (billing contact, billing address, tax identifiers, payment method token and card metadata held by the payment processor); content data (whatever personal data the Customer chooses to place in project content, which is under the Customer’s control and which the Acceptable Use Policy asks the Customer to keep free of payment card data, government identifiers, credentials and special category data). Sensitive data: none is requested or required, and none should be submitted; where the Customer nonetheless submits it, the restrictions and safeguards are those in Annex II applied to all Customer Content, and the Customer remains responsible for its lawful basis. Frequency: continuous, for the duration of the Agreement, on the Customer’s instruction. Nature and purpose: hosting, storage, indexing, machine translation, quality checking, translation memory matching, glossary enforcement, review workflow, delivery and transmission through the API, webhooks, connectors and the delivery bundle, together with support, security and billing. Duration of processing: the term of the Agreement plus the retention periods stated in the Privacy Policy and clause 13 of this DPA. Subprocessor processing: for the purposes, and for the durations, set out in Annex III and in the Trust Center.

Where the SCCs apply on the basis of Article 3(1) of the GDPR, the competent supervisory authority is the one in the member state in which the data exporter is established. Where they apply because the exporter is not established in the European Economic Area but is caught by Article 3(2), the competent authority is the one in the member state in which the exporter’s Article 27 representative is established. Where they apply on the basis of Article 3(2) and no representative is appointed, the competent authority is the one in the member state in which the data subjects whose personal data is transferred are located. For UK transfers the competent authority is the Information Commissioner’s Office; for Swiss transfers, the Federal Data Protection and Information Commissioner.

Data in transit is protected with TLS 1.2 or better at the edge, and connections below that are refused. Passwords are hashed with bcrypt at a cost factor of 12 and are never stored or logged in plaintext. API tokens and delivery keys are stored as SHA-256 digests, are displayed once at creation and cannot be recovered afterwards; publishable in-context keys are deliberately public identifiers bound to an origin allowlist rather than secrets, and are documented as such. Third party credentials, connector tokens, SSO configuration secrets and webhook signing secrets are held in encrypted columns using authenticated application-level encryption. Database backups are encrypted with AES-256 by the backup tool itself, independently of any provider-side encryption, and file backups are held in a password-encrypted repository. Two honest gaps: the live database and application volumes are not disk-encrypted, and server-side encryption of the object store is not asserted in our own configuration. We state both here rather than letting a reviewer discover them in diligence.

Every query in the application is scoped by Account, workspace and project, and a cross-tenant identifier answers 404 rather than 403 so that the existence of another tenant’s record never leaks. The two Account roles (Owner and Billing), the four workspace roles (admin, developer, reviewer and translator), eighteen project abilities and per-project and per-language grants are available on every plan including Free, so least privilege is never a paid upgrade. Two-factor authentication with time-based one-time codes and recovery codes, and passkeys, are available on every plan, and an Account Owner can require a second factor for an entire workspace, enforced at the workspace boundary so that federated and single sign-on doors cannot bypass it. SAML 2.0 single sign-on with just-in-time provisioning, generic OpenID Connect, SCIM 2.0 provisioning and de-provisioning, and the ability to switch off password login for a workspace are available on the Enterprise plan. API access uses scoped tokens with optional expiry. Internal administrative access is least privilege, and operator impersonation of a customer’s login is time-limited to thirty minutes and writes an audit record when it starts and when it ends.

Security-relevant events are written to an append-only audit trail: sign-in and single sign-on events, second factor and workspace MFA policy changes, member invitations, joins, role changes and removals, custom role changes, token and key creation and revocation, integration and connector connection and disconnection, review policy changes, branding changes, SCIM provisioning events, workspace rename and deletion requests. Plan, billing and spend cap changes, changes to the Account’s members and the closing of the Account are written to the Account’s own audit trail in the same way. Each record carries the workspace or the Account, the actor, the action, the target, structured metadata, the source IP address and the time, and the model layer refuses updates and deletes, so a record cannot be edited after the fact; on the Account’s trail the IP address is removed after 395 days. On the Enterprise plan the whole trail, the Account’s included, can be exported as CSV. Append-only is enforced in the application layer and there is no cryptographic hash chain or signature over the log, so we do not describe it as tamper-evident. Application errors are collected by an error tracker we host ourselves, configured not to send personally identifying information and not to capture request bodies, which is the setting that actually keeps customer strings out of a stack trace. Operational metrics are retained for thirty days.

Public endpoints are rate limited: the REST API at sixty requests a minute per token, the delivery endpoint at three hundred a minute per key and address, sign-in at five a minute per email and address, and registration at five a minute and twenty an hour per network block, with separate buckets for the other public doors. Outbound webhooks are signed HMAC-SHA256 over the timestamp and the raw body, sent as an explicit signature header and a timestamp header, and compared in constant time; the timestamp is published so the receiver can enforce its own replay window, and we are explicit that no server-side tolerance is enforced on our side. Inbound forge webhooks are verified by signature, with the delivery identifier as the replay guard. Cross site request forgery protection is applied to every state-changing browser request, sessions expire after 120 minutes of inactivity, sensitive actions require password re-confirmation within a 3 hour window, password reset links expire after 60 minutes, and destructive actions require typing the workspace name or re-entering a password. A frame-ancestors content security policy is applied; we do not claim a broad content security policy, because we do not yet ship one.

Usage metering records counts of words and tokens, never the body of a request. The shared exact-match translation memory pool stores the linguistic pair keyed by a hash of the source, together with plural forms and reuse counters, and stores no user column and no team column at all, so an entry cannot be traced to a person; the key name, file path, screenshots, comments and every other piece of surrounding context are stripped. Human-reviewed memory entries carry a workspace identifier, which functions as a hard tenant fence on the near-match query rather than as attribution, and that is why a reviewed entry is never returned to another workspace. Any project can leave the pool entirely with a per-project switch on every plan, which stops it both contributing and drawing. In-context screenshots are held on a private store with no public path and are served only through short-lived signed URLs.

The database is backed up continuously with write-ahead log archiving and periodic full and differential backups, retaining two full backups and seven differentials, encrypted with AES-256 by the backup tool. Application file storage is snapshotted nightly into a password-encrypted repository retaining thirty daily, twelve weekly and twelve monthly snapshots, with an integrity verification pass on each run. Restore procedures are documented and exercised. Backups are isolated from the production credentials that could delete them, and they are restored for disaster recovery only, never to return a purged workspace to service. Deployment images are retained for the last several releases so that a rollback is a minute rather than a rebuild.

Changes are made through version control with peer review, an automated test suite, static analysis and dependency scanning, and container image vulnerability scanning in the build pipeline, and a failing gate blocks the release rather than warning about it. Test environments do not use production customer data. Secrets are held encrypted at rest in the deployment repository and injected at runtime rather than committed. Several product claims are themselves enforced by tests: a translation engine that becomes reachable without a subprocessor disclosure row fails the build, and the advertised overage rate is pinned to the rate the system charges. Third party components are tracked and patched, and a build is refused when a scanner reports a vulnerability above threshold.

Access to production is limited to the personnel who need it, granted individually, and removed on role change or departure. Personnel are bound by confidentiality obligations that survive their engagement, and receive security and data protection guidance appropriate to their role. We operate a documented incident response process with defined severities, an on-call rotation, alerting on service health and background job health, and post-incident review. We publish a vulnerability disclosure policy with a safe harbour for good faith research and a security address that is monitored. We hold no third party security certification today: a SOC 2 Type II audit is in progress and an AI management system standard is being pursued, and the compliance status published on our site is rendered from a configuration value that cannot show a certificate we do not hold.

Scheduled jobs enforce the retention windows published in the Privacy Policy rather than leaving them as intentions: translation version history at 180 days with a floor of the newest 20 per string, notifications at 90 days, resolved comment threads at 365 days from resolution, the activity feed at 180 days, assistant conversations at 90 days, in-context screenshots at 90 days with the stored object deleted alongside the record, connector sync records at 90 days keeping the latest per connection, referral click records at 90 days, unreviewed and unused translation memory entries at 90 days, failed background jobs at 7 days, expired API tokens 24 hours after they lapse, federated login correlation records at their own expiry, signup integrity signals 90 days after the Account was created or the pair was last seen, sign-up refusal records at 90 days, welcome words velocity records at 30 days for a domain and 24 hours for a network, sign-up allowlist entries at the expiry an operator set, never more than 365 days, Accounts never verified and holding no workspace at 30 days, welcome words, trial and card fingerprint records at 1,095 days, and the IP address on an Account’s audit trail at 395 days. Deletion runs in bounded batches rather than as one unbounded operation. Workspace deletion is a 30 day reversible grace period followed by a cascading purge of the live database. Webhook delivery records have no time-based prune today and are removed with their endpoint or their workspace.

For transfers to subprocessors we rely on the contractual measures in clause 15 together with these supplementary measures: transport encryption on every hop; contractual prohibitions on training, on onward transfer without equivalent protection, and on processing outside our instructions; a published and code-enforced disclosure list so that no undisclosed vendor can be routed customer text; the ability for a customer to disable the optional features that engage a conditional subprocessor, including the semantic translation memory feature and the per-project translation memory switch; retention windows enforced by scheduled jobs so that transferred data does not accumulate indefinitely; and the government access commitments in clause 17, including challenge, minimisation, notification and record keeping.

最新且具權威性的次處理者清單由我們維護，並可應客戶要求，在簽署保密協議後透過寫信至 privacy@transglot.ai 提供。各次處理者的類別、目的、地區及參與條件均公佈於信任中心，並摘要載於《次處理者文件》中，該文件以引用方式併入本附件。我們刻意將清單集中於一處，而非複製到本頁：因為重新輸入法律文件的清單會在供應商變更當天即過時，而過時的附件比連結更糟。截至生效日，各類別如下：AI 翻譯、自動品質檢查、術語提取及情境視覺建議，於美國處理，並在使用 AI 功能時啟用；用於語意翻譯記憶的文字嵌入，於美國處理，僅在專案開啟此功能時啟用（預設為關閉）；透過美國 API 路由器存取並託管於新加坡的選用替代翻譯引擎，僅在營運人員將層級路由至該引擎時啟用（預設為關閉）；雲端託管、資料庫及物件儲存，位於部署時固定的地區，並始終啟用；付款處理，於美國及歐盟進行，僅針對付費方案啟用；交易電子郵件傳送，始終啟用；以及產品內支援訊息，僅在啟用支援通訊工具時啟用。若客戶為選用的機器翻譯備援提供自有憑證，則客戶為該傳輸的控制者，而該供應商並非我們的次處理者。