1. SCOPE AND APPLICATION
This PIPL Supplement to Aryaka Data Protection Addendum (“Supplement”) applies to the processing of Personal Information of individuals located in mainland China (“China Personal Information”) in connection with Aryaka’s Services. This Supplement addresses the PIPL-specific obligations and should be read in conjunction with the DPA that reflects the international data protection principles consistent with the PIPL framework for complete information regarding Aryaka’s data processing practices. This Supplement supplements and forms part of the Data Protection Addendum (“DPA”). In the event of any conflict between this Supplement and the DPA with respect to China Personal Information, this Supplement prevails.
Capitalized terms not defined herein have the meanings given in the DPA.
2. DEFINITIONS
For purposes of this Supplement, the following terms have the meanings set forth below:
(a) “China Personal Information” means any information relating to an identified or identifiable natural person located in mainland China, excluding anonymized information, as defined under Article 4 of PIPL.
(b) “PIPL” means the Personal Information Protection Law of the People’s Republic of China (effective November 1, 2021), as amended from time to time.
(c) “PRC” means the People’s Republic of China.
(d) “Sensitive Personal Information” has the meaning given under Article 28 of PIPL.
(e) “Entrusted Party” means an entity that processes Personal Information on behalf of and as directed by a Personal Information Processor, as contemplated under Article 21 of PIPL.
(f) “Personal Information Processor” means an organization or individual that autonomously determines the purposes and means of Personal Information processing, as defined under Article 73 of PIPL.
3. ROLE AND PROCESSING PURPOSE
3.1 When Aryaka processes China Personal Information in connection with the provision of services to its customers, Aryaka acts as an Entrusted Party (as defined in Section 2) on behalf of the customer, who is the Personal Information Processor. Aryaka processes China Personal Information solely for the purpose of providing, monitoring, and supporting the contracted services, and as directed by the Customer in accordance with the Agreement and in accordance with documented instruction under the DPA. Aryaka will not process China Personal Information beyond the purposes, methods, or scope agreed upon in the Agreement and the DPA.
3.2 The Customer, as Personal Information Processor, shall ensure that a valid legal basis is established for the processing of China Personal Information, including obtaining of any consent required under PIPL. Where PIPL requires separate consent for specific processing activities (such as cross-border transfers or the processing of Sensitive Personal Information), such consent shall be obtained by the Customer prior to providing the relevant China Personal Information to Aryaka.
4. CRITICAL INFORMATION INFRASTRUCTURE
Aryaka provides global network and security services that enable enterprise connectivity across regions, including mainland China. Under the PRC Cybersecurity Law, Critical Information Infrastructure Operator (“CIIO”) status applies to operators in specifically designated sectors. Aryaka’s Services fall outside of the specified designated sectors and Aryaka does not process Sensitive Personal Information as defined under PIPL. Accordingly, Aryaka is not subject to the CIIO-specific data localization requirements under PIPL or Cybersecurity Law of the PRC.
5. CROSS-BORDER TRANSFERS
5.1 In the course of providing its Services, Aryaka may process China Personal Information that is transferred outside mainland China for purposes of service delivery, monitoring, and support.
5.2 As of the effective date of this Supplement, the volume of China Personal Information processed by Aryaka in connection with its Services does not meet the thresholds requiring a formal cross-border data transfer mechanism under the Provisions on Promoting and Regulating Cross-Border Data Flows (effective March 22, 2024). Therefore, Aryaka’s current processing activities, as stipulated under the DPA, meet the requirements of streamlined cross-border transfer permitted under PRC law.
5.3 Aryaka will monitor applicable data volumes on an ongoing basis and will use commercially reasonable efforts to implement a formal cross-border data transfer mechanism as required under applicable PRC law if and when the relevant thresholds are met.
6. PERSONAL INFORMATION PROTECTION IMPACT ASSESSMENT
Upon Customer’s reasonable request, Aryaka will provide information reasonably necessary to support the Customer’s obligation to conduct a Personal Information Protection Impact Assessment under Article 55 of PIPL in connection with the entrusted processing of China Personal Information.