Data Processing Agreement

1. Introduction

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between you (the “Data Subject” or “Client”) and 86Connect (“we”, “us”, “our”, or the “Data Processor”) and is incorporated by reference. It describes how we collect, process, store, and protect personal data in the course of delivering our Study in China and Product Sourcing services.

This DPA applies to the extent that 86Connect acts as a processor or controller of personal data as defined under applicable data protection laws, including the GDPR, CCPA, and the Personal Information Protection Law (PIPL) of the People’s Republic of China.

2. Definitions

• Personal Data: Any information relating to an identified or identifiable natural person.
• Processing: Any operation performed on Personal Data, such as collection, storage, use, disclosure, or deletion.
• Data Subject: The individual to whom the Personal Data relates.
• Sub-processor: A third party engaged by 86Connect to assist in processing Personal Data on our behalf.
• Personal Data Breach: A breach of security leading to accidental or unlawful destruction, loss, alteration, or disclosure of Personal Data.

3. Roles and Scope of Processing

86Connect acts as a data controller for personal data collected directly through our website (e.g., inquiry forms, account registration). We act as a data processor when handling personal data shared by a Client for the purpose of delivering a specific contracted service.

We process Personal Data only for the following purposes:

• Facilitating study abroad and university applications
• Processing product sourcing and supplier inquiries
• Communicating regarding your inquiry or service status
• Complying with legal and regulatory obligations

4. Categories of Data and Data Subjects

Categories of Personal Data:

• Identity data (name, date of birth, nationality)
• Contact data (email, phone, address)
• Education and professional data
• Company and business data (for sourcing clients)
• Technical data (IP address, browser, usage logs)

Categories of Data Subjects:

• Prospective and current students
• Business clients seeking sourcing services
• Website visitors and inquiry submitters

5. Data Subject Rights

We support the rights of data subjects under applicable law. You may exercise any of the following rights by contacting us at beijingbridgepath@gmail.com:

• Access, rectify, or erase your Personal Data
• Restrict or object to processing
• Request data portability
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

We respond to valid requests within 30 days, extending where necessary for complex requests.

6. Confidentiality and Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit (HTTPS/TLS) and at rest
• Role-based access controls and least-privilege principles
• Secure password hashing and multi-factor authentication for admin systems
• Regular security reviews and vulnerability assessments
• Staff confidentiality obligations and data protection training
• Encrypted, automated database backups

Further details are available in our Security Policy.

7. Sub-Processors

We engage trusted third-party service providers (e.g., hosting, analytics, email delivery) to assist in processing Personal Data. All sub-processors are bound by written agreements requiring confidentiality and a level of data protection consistent with this DPA.

We notify Clients of any intended changes concerning the addition or replacement of sub-processors, giving you the opportunity to object.

8. International Data Transfers

Personal Data may be transferred to, stored in, or processed in countries other than your country of residence, including China and the United States. Where such transfers occur, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by relevant authorities
• Binding corporate rules where applicable
• Adequacy decisions or other lawful transfer mechanisms

9. Personal Data Breach Notification

In the event of a Personal Data Breach, we will:

• Take reasonable steps to contain and remediate the breach
• Assess the risk to affected data subjects
• Notify affected Clients without undue delay (and in any case within 72 hours of becoming aware of a notifiable breach)
• Cooperate with authorities and data subjects as required by law

10. Data Return and Deletion

Upon termination of services or at your request, and subject to applicable law, we will return or delete all Personal Data in our possession, except where retention is required by law, regulation, or legitimate business records. Retained data will remain subject to the confidentiality and security protections of this DPA.

11. Audit Rights

Upon reasonable notice and no more than once per calendar year, a Client may request information to verify our compliance with this DPA. We will provide reasonable cooperation and, where available, third-party audit reports or certifications demonstrating our security controls.

12. Liability and Indemnification

Our liability under this DPA is subject to the limitations set out in our Terms of Service. Each party is responsible for its own compliance with applicable data protection laws.

13. Term and Termination

This DPA remains in effect for the duration of our processing of Personal Data on your behalf and survives termination of the underlying services until all Personal Data is returned or deleted in accordance with Section 10.

14. Governing Law

This DPA is governed by and construed in accordance with the laws of the People’s Republic of China. Disputes shall first be resolved through good-faith negotiation and, if unresolved, submitted to arbitration in Beijing, China under CIETAC rules.

15. Changes to This DPA

We may update this DPA from time to time. Material changes will be posted on this page with an updated “Last updated” date. We encourage you to review this DPA periodically.

16. Contact Us

If you have questions about this DPA or our data processing practices, please contact us:

• Email: beijingbridgepath@gmail.com
• Phone: +86 176 1153 3296