Version : 1.0, Last Updated on : 14 OCT 2026
Terms used in this Addendum shall have the meaning as defined herein. Capitalised terms not otherwise defined shall have the meaning given to them in the Agreement. Except as amended below, the terms of the Agreement shall remain in full force and effect. In the event of any conflict or inconsistency between the terms of the Agreement and this Addendum, this Addendum will prevail.
1. Definitions
1.1. In this Addendum, the following terms shall have the meanings set out below:
1.1.1. “Contracted Processor” means GSBN or a Subprocessor;
1.1.2. “China Data Protection Laws” means the PRC Personal Information Protection Law;
1.1.3. “Data Protection Laws” means to the extent applicable: EU Data Protection Laws, UK Data Protection Laws, Hong Kong Data Protection Laws, Singapore Data Protection Laws and China Data Protection Laws;
1.1.4. “EU Data Protection Laws” means Directive 2002/58/EC and the EU General Data Protection Regulation 2016/679 (“GDPR”) (and its derivatives), in each case as transposed into domestic legislation of each European Union Member State or Member State of the European Economic Area, and any other data protection laws issued by any relevant Supervisory Authority (or applicable laws amending, replacing or superseding any of the foregoing);
1.1.5. “Hong Kong Data Protection Laws” means the Personal Data (Privacy) Ordinance (Cap 486);
1.1.6. “International Transfer” means a transfer of Personal Data which results in that Personal Data becoming Posted Personal Data and where that transfer is from a data exporter in one jurisdiction to GSBN as data importer in another jurisdiction;
1.1.7. “Personal Data Breach” means any actual or suspected accidental, unlawful or unauthorised destruction, loss, alteration, erasure, disclosure of, or access to Posted Personal Data;
1.1.8. “Posted Personal Data” means Personal Data Posted by or on behalf of Customer on the GSBN Platform or to GSBN in connection with the Agreement (including Customer’s use and receipt of the Services), where “Post” means with respect to any Personal Data, the act of uploading, downloading, posting, exchanging, transmitting, transferring, generating, or communicating, whether via the GSBN Platform or any application, email, application programming interface, electronic data interchange, short messaging, or any other interface or means, electronic and non-electric, and “Posted” shall be construed accordingly;
1.1.9. “Services” means (a) the provision of access to the GSBN Platform and the Documentation; and (b) the Membership Services, under the terms of the Agreement;
1.1.10. “Singapore Data Protection Laws” means the Personal Data Protection Act 2012 (as amended);
1.1.11. “Subprocessor” means any person (including any third party and excluding an employee of GSBN) appointed by or on behalf of GSBN to Process Posted Personal Data on behalf of Customer in connection with the Agreement;
1.1.12. “Supervisory Authority” means: (a) an independent public authority which is established by a European Union Member State or member of the EEA pursuant to Article 51 GDPR; and (b) any similar regulatory authority (whether at local or national level) responsible for the enforcement of Data Protection Laws in the relevant jurisdiction;
1.1.13. “Standard Contractual Clauses” means the Standard Contractual Clauses as set out in Annex 3 to this Addendum (“SCCs”), as amended or replaced from time to time by a competent authority under the relevant Data Protection Laws, to the extent that they relate to an International Transfer;
1.1.14. “UK Data Protection Laws” means the GDPR as transposed into United Kingdom national law by operation of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (“UK GDPR”), together with the Data Protection Act 2018, the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 and other data protection or privacy legislation in force from time to time in the United Kingdom; and
1.1.15. “UK SCCs” means the standard contractual clauses for the transfer of personal data established in third countries which do not ensure an adequate level of protection as set out in Commission Decision 2010/87/EU, as updated, amended, replaced or superseded from time to time by a competent authority under the UK Data Protection Laws.
1.2. The terms “Controller”, “Data Subject”, “Processing or Process” and “Processor” (or such similar terms) have the same meanings as defined in applicable Data Protection Laws.
2. Processing of Posted Personal Data
2.1. Customer agrees that it is the independent Controller of the Posted Personal Data or has obtained authorisation from the relevant Controller(s) to involve GSBN in the Processing of the Posted Personal Data in connection with the Agreement. If Customer is not the independent Controller of the Posted Personal Data, it undertakes to (a) inform GSBN of the identify and contact details of the relevant Controller(s) prior to Posting the Posted Personal Data; and (b) act for and on behalf of the relevant Controller(s) as the single point of contact under this Addendum and in respect of their rights and obligations under data protection laws. Customer appoints GSBN to Process the Posted Personal Data in connection with the provision of the Services. Details of the types of Posted Personal Data, the categories of Data Subjects and the nature, purpose, subject matter and duration of the Processing of the Posted Personal Data in connection with the Services are set out in Annex 1.
2.2. GSBN shall:
2.2.1. Process Posted Personal Data only pursuant to Customer’s documented instructions set out in the Agreement or as otherwise agreed in writing between the Parties, unless Processing is required by applicable laws to which GSBN is subject (in which case GSBN shall inform Customer of that legal requirement, unless the relevant law prohibits this); and
2.2.2. not retain, use or disclose Posted Personal Data: (a) for any purpose (including any commercial purpose) other than to perform the Services (as more fully described in Annex 1 to this Addendum); or (b) outside of the direct business relationship between Customer and GSBN.
3. Customer Responsibilities
3.1. Subject to, and in accordance with the terms of this Addendum, Customer instructs GSBN (and authorizes GSBN to instruct each Subprocessor) to Process Posted Personal Data, including without limitation to, transfer Posted Personal Data to any country or jurisdiction, as reasonably necessary in connection with the provision of the Services .
3.2. Customer agrees that:
3.2.1. it is and will at all relevant times remain duly and effectively authorised to provide the instructions and permissions as set out in Section a;
3.2.2. all Posted Personal Data has been and will be collected in accordance with applicable Data Protection Laws;
3.2.3. it will comply with applicable Data Protection Laws and its obligations in this Addendum in connection with the Agreement and its use of the Services;
3.2.4. the Posted Personal Data and any other Personal Data provided or made available to GSBN shall not contain or comprise state secrets, national core data or important data (each as defined under applicable Mainland China laws) or any other data which is otherwise prohibited under applicable laws from being accessed or transferred outside of Mainland China;
3.2.5. it shall ensure that all Posted Personal Data is only Personal Data of the types set out in Annex 1 (or as otherwise agreed in writing by the Parties);
3.2.6. it shall promptly inform GSBN if at any time it suspects that any Processing of Platform Personal Data under the Agreement would violate applicable Data Protection Laws; and
3.2.7. nothing in the Agreement relieves it (or the relevant Controller(s)) of any responsibilities or liabilities that it or they have under applicable Data Protection Laws.
3.3. Customer shall indemnify and keep indemnified each Contracted Processor against any and all losses, damages, fines and sanctions howsoever arising from any breach of Section b.
4. GSBN Personnel
4.1. GSBN shall ensure that any person acting under its authority who has access to Posted Personal Data is subject to an appropriate contractual or statutory obligation of confidentiality in respect of the Posted Personal Data and that such access is limited to those persons who need to know/ access the Posted Personal Data for the purposes of the Agreement.
5. Security
5.1. GSBN shall implement and maintain appropriate technical and organisational measures (including physical measures) to ensure a level of security appropriate to the risks in connection with the Processing of Posted Personal Data to prevent unauthorised or accidental access, collection, use, disclosure, copying, modification, disposal or destruction of Posted Personal Data.
5.2. In assessing the appropriate level of security, GSBN shall take account of the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risks that are presented by Processing, in particular from a Personal Data Breach.
5.3. Customer agrees that the technical and organizational measures set out in Annex 2 to this Addendum provide an appropriate level of security with regard to the Processing of Posted Personal Data. GSBN is responsible for implementing and maintaining the measures set out in Annex 2 within the blockchain and related platform components it operates as a Processor. The Controller remains responsible for implementing any additional safeguards required for its own Processing activities and for assessing residual linkability risks arising from its specific use of the Platform.
6. Personal Data Breach
6.1. GSBN shall inform Customer without undue delay upon becoming aware of a Personal Data Breach, and shall provide such reasonable information as it has to allow Customer to meet its obligations to report such Personal Data Breach under applicable Data Protection Laws.
6.2. GSBN shall co-operate with Customer and take, in a timely manner, such reasonable commercial steps as directed by Customer to assist in the investigation, mitigation and remediation of each Personal Data Breach, taking into account the nature of the Processing and information available to GSBN.
7. Data Subject Rights; Response to Enquiries; Accuracy
7.1. GSBN shall as soon as practicable notify Customer if it receives a request from a Data Subject under applicable Data Protection Laws in respect of Posted Personal Data. Unless directed by Customer or where required by applicable Data Protection Laws, GSBN shall not respond to a request from a Data Subject exercising her/his rights under such Data Protection Laws.
7.2. Responsibility for responding to and complying with data subject rights requests under applicable Data Protection Laws rests solely with the Customer. Taking into account the nature of the Processing and subject to Section 7.4, GSBN shall, by implementing appropriate technical and organizational measures as per Annex 2, provide at the reasonable request of Customer reasonable assistance and information reasonably required in a timely manner to Customer to enable Customer to: (a) respond to any requests by Data Subjects exercising their rights under applicable Data Protection Laws relating to Posted Personal Data; and/or (b) otherwise comply with any assessment, enquiry, notice or investigation under applicable Data Protection Laws relating to Posted Personal Data.
7.3. Subject to Section 7.4, GSBN shall if instructed by Customer update Posted Personal Data as soon as practicable if Customer indicates that Posted Personal Data is no longer accurate or correct or consent to Processing has been withdrawn.
7.4. The Customer acknowledges that GSBN cannot delete, modify or otherwise alter cryptographic hashes or transactional references recorded on the blockchain ledger due to the immutable nature of distributed ledger technology as further described in Annex 1. GSBN does not determine the retention period or persistence of such ledger records.
8. Audit Rights
8.1. Subject to Sections 8.2 and 8.3, GSBN shall make available to Customer on request information reasonably necessary to demonstrate compliance with this Addendum, and shall allow for and contribute to audits, including inspections, by Customer, Customer’s regulator and/or any auditor appointed by Customer and/or Customer’s regulator(s), in relation to the Processing of Posted Personal Data. Any information so provided shall only be used for assessing GSBN’s compliance with this Addendum and not for any other purpose.
8.2. Customer shall give GSBN reasonable (and in any event at least 35 days’) prior notice of any audit or inspection to be conducted under Section 8.1 and shall (and ensure that each of its mandated auditors shall) take all reasonable steps to avoid causing any damage, injury or disruption to the Contracted Processors’ premises, equipment, personnel and business during the course of such an audit or inspection. GSBN may object in writing to an auditor appointed by Customer to conduct any audit under Section 8.1 if the auditor is, in GSBN’s reasonable opinion, not suitably qualified or independent, a competitor, or otherwise manifestly unsuitable. Customer shall (and ensure that each of its mandated auditors shall) comply with any conditions that GSBN may reasonably impose on such audit or inspection. Except as otherwise required by applicable Data Protection Laws, a Supervisory Authority or any other applicable industry regulations with which Customer must comply, any audit or inspection will be at Customer’s sole expense and conducted within normal business hours no more than once in any calendar year and in a manner which preserves the confidentiality of any confidential information. A Contracted Processor need not give access to its premises for the purposes of such an audit or inspection to any individual unless he or she produces reasonable evidence of identity and authority.
8.3. Customer shall ensure that a written report is produced with the findings of any audit or inspection conducted under this Section 8 and that a copy of such report is promptly provided to GSBN and any such information obtained or received shall only be used or disclosed to the extent strictly necessary to assess GSBN’s compliance with this Addendum and not for any other purpose.
9. Subprocessing
9.1. Customer authorises GSBN to appoint and replace appointed Subprocessors, provided such is done in accordance with this Section 9 and Section 10.
9.2. Subject to GSBN meeting its obligations set out in Section 9.4, GSBN may continue to use those Subprocessors already engaged by a Contracted Processor as at the date of this Addendum provided that a list of such Subprocessors is provided to Customer in advance of the Parties entering into this Addendum.
9.3. GSBN shall give Customer prior notice of the appointment of any new Subprocessor. If, within thirty (30) calendar days of receipt of that notice, Customer notifies GSBN in writing of any objections (on reasonable grounds) to the proposed appointment, GSBN shall take reasonable steps to address the objections raised by Customer and provide Customer with a reasonable explanation of the steps taken.
9.4. GSBN shall ensure that each Subprocessor is bound by contractual obligations with regard to its Processing of Posted Personal Data that are no less onerous than those set out in this Addendum.
9.5. GSBN shall remain fully liable to Customer (to the extent set out in this Addendum) where a Subprocessor fails to perform its obligations with regard to the Processing of Posted Personal Data.
9.6. The Customer acknowledges that node operators participating in the distributed ledger are subject to GSBN’s governance requirements but are not engaged by GSBN as Subprocessors.
10. International Transfers of Personal Data
10.1. Customer hereby permits GSBN in order to provide the Services to transfer the Posted Personal Data outside the jurisdiction from which it was originally collected or first disclosed to GSBN, including but not limited to Hong Kong SAR, Singapore, United States of America and Mainland China. The transfer of Posted Personal Data outside the European Economic Area is only permitted in case the requirements of Section 10.4 are met.
10.2. Except as provided in Section 10.1 or Annex 1 to this Addendum and except as permitted or required by applicable laws, GSBN shall not otherwise transfer any Posted Personal Data outside the jurisdiction from which it was originally collected or first disclosed to GSBN: (a) without Customer’s prior written consent; and (b) unless in accordance with any terms Customer may reasonably impose on such transfer to comply with applicable Data Protection Laws (which may be at Customer’s cost).
10.3. GSBN shall ensure that such Posted Personal Data is at all times subject to an equivalent or comparable level of protection as the jurisdiction in which the Posted Personal Data was originally collected or first disclosed to GSBN or otherwise to meet such standards required by applicable Data Protection Laws.
10.4. Subject to Sections 10.1 and 10.3, where such International Transfer involves the transfer of Posted Personal Data outside of the European Economic Area, the Processing of Posted Personal Data by GSBN shall be subject to and in accordance with the following:
10.4.1. Processing of Posted Personal Data by a Contracted Processor is in a jurisdiction that has been designated by the European Commission as providing adequate levels of protection with respect to data protection for the purposes of Chapter V of the GDPR; or
10.4.2. in respect of International Transfers to which Section 10.4.1 does not apply, Customer acting on its own behalf, or where it is not an independent Controller in respect of the Posted Personal Data, as agent and on behalf of the relevant Controller(s) (each as “data exporter”) and GSBN acting on its own behalf and as agent for each Contracted Processor (each as “data importer”) with effect from the commencement of the relevant International Transfer, shall enter into the SCCs (attached as ANNEX 3) in respect of any International Transfer from Customer to a Contracted Processor (or onward transfer). If acting as agent on behalf of the relevant Controller(s), Customer shall ensure that it has a proper power of attorney to conclude the SCCs on behalf of the relevant Controller(s). If Customer is unable to enter into the SCCs as agent and on behalf of the relevant Controller(s), it shall immediately procure that such relevant Controller(s) execute the SCCs as data exporter with any relevant Contracted Processor as the data importer prior to the commencement of the relevant International Transfer.
10.5. Subject to Sections 10.1 and 10.3, where such International Transfer involves the transfer of Posted Personal Data outside of the United Kingdom, the Processing of Posted Personal Data by GSBN shall be subject to and in accordance with the following:
10.5.1. Processing of Posted Personal Data by a Contracted Processor is in a jurisdiction that has been designated by the UK Government as providing adequate levels of protection with respect to data protection for the purposes of Chapter V of the UK GDPR; or
10.5.2. in respect of International Transfers to which Section 10.5.1 does not apply, Customer acting on its own behalf, or where it is not an independent Controller in respect of the Posted Personal Data, as agent and on behalf of the relevant Controller(s) (each as “data exporter”) and GSBN acting on its own behalf and as agent for each Contracted Processor (each as “data importer”) with effect from the commencement of the relevant International Transfer, shall enter into the UK SCCs in respect of any International Transfer from Customer to a Contracted Processor (or onward transfer), which are hereby incorporated into this Addendum by reference and which shall apply from the commencement of a relevant International Transfer. Appendix 1 to the UK SCCs shall be deemed to be prepopulated with the relevant sections of Annex 1 to this Addendum. Appendix 2 shall be deemed to be prepopulated with the security measures set out in Annex 2 to this Addendum. If acting as agent on behalf of the relevant Controller(s), Customer shall ensure that it has a proper power of attorney to conclude the SCCs on behalf of the relevant Controller(s). If Customer is unable to enter into the UK SCCs as agent and on behalf of the relevant Controller(s), it shall immediately procure that such relevant Controller(s) execute the UK SCCs as data exporter with any relevant Contracted Processor as the data importer prior to the commencement of the relevant International Transfer. With respect to International Transfers to Subprocessors, Customer authorizes GSBN to enter into the UK SCCs for and on behalf of Customer with any Subprocessor.
10.5.3. If at any time the UK Government approves the SCCs for use under UK Data Protection Laws, the provisions of Section 10.4 shall apply in place of this Section 10.5 in respect of International Transfers subject to UK Data Protection Laws, subject to any modifications to the SCCs required by UK Data Protection Laws (and subject to the governing law of the SCCs being English law and the supervisory authority being the Information Commissioner’s Office).
10.6. Notwithstanding Sections 10.1 to 10.5:
10.6.1. the Parties acknowledge that the GSBN Platform operates a permissioned distributed ledger, and that cryptographic hashes and transactional references recorded on the blockchain ledger may be replicated across nodes operated by approved node operators, including nodes located outside the European Economic Area or the United Kingdom. Such ledger records do not include identifiable personal data and form part of the decentralised ledger infrastructure of the Platform; and
10.6.2. node operators participating in the distributed ledger are subject to GSBN’s governance requirements but are not engaged by GSBN as Subprocessors. Replication of such ledger records to nodes does not constitute a transfer of Posted Personal Data by GSBN for the purposes of this Section 10.
10.7. GSBN shall, upon reasonable request, provide the Customer with high-level information regarding node geography and the ledger replication model to support Customer’s assessment of any applicable international data transfer obligations. The Parties’ position that ledger replication does not constitute a data transfer (as stated in Section 10.6.2) reflects the technical architecture whereby only non-identifiable cryptographic hashes are stored on-chain. However, this position has not been definitively established under Data Protection Laws and may be subject to challenge by Supervisory Authorities, particularly if linkage between on-chain and off-chain data could enable re-identification. The parties acknowledge this legal uncertainty and acting reasonable and in good faith agree to: (a) monitor regulatory developments and guidance on blockchain data transfers; (b) implement supplementary measures as may be required; and (c) cooperate between the Parties if Supervisory Authorities challenge this position.
11. Data Protection Impact Assessment and Prior Consultation
11.1. GSBN shall provide reasonable assistance to Customer with (a) data protection impact assessments or security assessments which are required under applicable Data Protection Laws (in particular in respect of any International Transfer); and (b) any prior consultations to any Supervisory Authority of Customer, in each case which are required under applicable Data Protection Laws, and in each case solely in relation to Processing of Posted Personal Data by GSBN on behalf of Customer and taking into account the nature of the Processing and information available to GSBN.
11.2. The Customer is solely responsible for determining whether a data protection impact assessment is required under Data Protection Laws in relation to its use of the GSBN Platform, and for carrying out any such assessment. In doing so, the Customer is responsible for identifying and assessing any risks arising from its activities, including risks specific to the use of distributed ledger technology, such as immutability, dissemination of ledger records across nodes, linkages between on-chain records and off-chain data, and cryptographic key management.
12. Records
12.1. GSBN shall maintain a record of its Processing activities conducted for and on behalf of Customer. Such record shall contain:
12.1.1. the name and contact details of GSBN and the name and contact details of Customer;
12.1.2. the categories of Processing carried out on behalf of Customer;
12.1.3. (where applicable) details of any International Transfers as referred to in Sections 10.1, 10.4 and 10.5; and
12.1.4. a general description of the technical and organisational measures GSBN has put in place to ensure the security of Posted Personal Data.
12.2. At Customer’s reasonable request, GSBN shall make available the record of Processing activities referred to in this Section 12 as soon as reasonably practicable after receiving such request.
13. Deletion or Return of Personal Data
13.1. Subject to Section 13.2, upon termination or expiration of the Agreement, GSBN shall delete, or at Customer’s request return, Posted Personal Data to Customer within ninety (90) days following the end of the Services.
13.2. GSBN shall only retain Posted Personal Data for as long as necessary or in accordance with the term of the Agreement or such other period agreed by the Parties in writing, provided that: (i) off-chain Posted Personal Data (including user identifiers, authentication data, and account linkage information) shall be deleted no later than ninety (90) days following termination unless a longer period is required by specific applicable laws (which GSBN shall identify in writing); (ii) cryptographic hashes and transactional references on the immutable blockchain ledger will persist indefinitely due to technical limitations, but GSBN shall delete all off-chain linkage data that would enable association of such hashes with identifiable individuals; (iii) upon deletion of off-chain linkage data, on-chain hashes shall be considered effectively anonymized and no longer constitute Personal Data. Notwithstanding the foregoing, GSBN may retain a copy of Posted Personal Data for record-keeping or archiving purposes only to the extent required by applicable Data Protection Laws or any other applicable record retention laws or regulations with which GSBN must comply, and GSBN shall document the specific legal basis for any such extended retention.
14. General Terms
14.1. GSBN Data Protection Contact. GSBN can be contacted in respect of any data protection matters at: info@gsbn.trade.
14.2. Costs. Customer shall reimburse GSBN for all costs (including internal and third party costs) which are reasonably and properly incurred by GSBN in the performance of GSBN’s obligations under Section 6. Section 7, Section 8 inclusive and/or Section 11 of this Addendum. GSBN shall charge for internal resources at GSBN’s current professional day rates as set by GSBN from time to time.
14.3. Order of Precedence. In the event of any conflict or inconsistency between the terms of the Agreement (excluding this Addendum) and the terms of this Addendum, the terms of this Addendum will prevail.
15. Refer to Annex 1 for the DETAILS OF PROCESSING OF POSTED PERSONAL DATA
16. Refer to Annex 2 for the TECHNICAL AND ORGANISATIONAL MEASURES
17. Refer to Annex 3 for the Standard Contractual Clause