Data processing agreement

This Data Processing Agreement ("DPA") forms part of the agreement between:

• the client named in the Statement of Work, at the address given there (the "Client", "you"); and
• AutonomicsAI LLP (LLPIN ADA-5258), trading as "Autonomics AI", 303, Gitanjali Pride 1, 5th Main, 3rd A Cross, Jeevanbhimanagar, Bengaluru 560075, Karnataka, India (the "Processor", "we", "us"),

under the Autonomics AI Terms of Service for Business Clients and the Statements of Work accepted under them (together, the "Agreement").

It applies whenever we process Client Personal Data in providing the services. It is accepted when the Agreement is accepted, or when you sign it.

1. Definitions

1.1 "Data Protection Law" means all laws on personal data that apply to the processing, which may include: the EU General Data Protection Regulation 2016/679 ("EU GDPR"); the UK GDPR and the Data Protection Act 2018 (together the "UK GDPR"); India's Digital Personal Data Protection Act, 2023 and the rules made under it (the "DPDP Act"); and US federal and state privacy laws.

1.2 "Client Personal Data" means personal data that we process on your behalf in providing the services, as described in Annex 1.

1.3 "Controller", "processor", "data subject", "personal data", "processing", "personal data breach" and "supervisory authority" have the meanings given in the GDPR. Under the DPDP Act, "controller" includes a data fiduciary, "processor" includes a data processor, and "data subject" includes a data principal. Under US state laws, "processor" includes a service provider or contractor.

1.4 "Sub-processor" means a third party we engage to process Client Personal Data.

1.5 "Restricted Transfer" means a transfer of Client Personal Data that Data Protection Law allows only with appropriate safeguards, such as from the EU or UK to a country without an adequacy decision.

2. Roles

2.1 You are the controller (or data fiduciary) of Client Personal Data, and we are your processor (or data processor).

2.2 You are responsible for: having a lawful basis (or valid consent) for the processing; giving data subjects the notices the law requires; the accuracy of the data; and the lawfulness of your instructions. You will not instruct us to process personal data in a way that breaks Data Protection Law.

2.3 Under the DPDP Act, where we process personal data of data principals outside India under a contract with you as a person outside India, many duties of the Act do not apply (section 17(1)(d)). We will still take reasonable security safeguards and comply with the duties of the Act that continue to apply.

3. Our obligations

These are the terms required by Article 28(3) of the GDPR, and the equivalent duties under other Data Protection Law. We will:

3.1 Instructions. Process Client Personal Data only on your documented instructions, including about transfers to other countries, unless the law requires otherwise; in that case we will tell you before processing unless the law forbids it. The Agreement, the SOW and your written instructions by email are your documented instructions. We will tell you promptly if we believe an instruction breaks Data Protection Law, and we may suspend that processing until you confirm or change the instruction.

3.2 Confidentiality. Ensure that everyone we authorise to process Client Personal Data is bound by a duty of confidentiality.

3.3 Security. Take the technical and organisational measures in Annex 2, which are designed to provide a level of security appropriate to the risk, as Article 32 of the GDPR and section 8(5) of the DPDP Act require.

3.4 Sub-processors. Follow clause 5.

3.5 Data subject requests. Taking into account the nature of the processing, help you by appropriate technical and organisational measures, so far as possible, to respond to requests from data subjects to exercise their rights. If we receive a request directly, we will pass it to you within 5 business days and will not respond to it ourselves unless you tell us to.

3.6 Assistance. Help you comply with your obligations on security, breach notification, data protection impact assessments and prior consultation with supervisory authorities, taking into account the nature of the processing and the information available to us.

3.7 Deletion or return. Follow clause 8.

3.8 Information and audits. Follow clause 9.

3.9 No other use. Not sell Client Personal Data, not share it for cross-context behavioural advertising, not combine it with personal data from other sources except as needed for the services, and not use it for our own purposes, including training AI models, unless you consent in writing.

3.10 AI tools. Use AI tools to process Client Personal Data only through AI tools on business accounts that do not allow our data to be used to train models, as listed in Annex 3, and with human review of output before it is delivered or sent, unless the SOW describes an automated process you have approved.

4. Your instructions about the scope

Annex 1 describes the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects. You will not send us special-category data, data about criminal convictions, children's data, government identity numbers, or payment card or bank account numbers unless the SOW expressly provides for it.

5. Sub-processors

5.1 General authorisation. You authorise us to use the Sub-processors listed in Annex 3.

5.2 Changes. We will tell you by email at least 14 days before we add or replace a Sub-processor. You may object in writing on reasonable data protection grounds within that period. If you object, we will try in good faith to address the objection. If we cannot, either party may end the affected services by written notice, and we will refund any Fees you prepaid for the period after termination.

5.3 Flow-down. We will impose on each Sub-processor, by written contract, data protection obligations that offer at least the same protection as this DPA (in the case of large cloud providers, their standard data processing terms, which we review for this purpose). We remain responsible to you for each Sub-processor's performance of those obligations.

6. International transfers

6.1 You acknowledge that we are located in India and that Client Personal Data will be processed in India and in the locations of our Sub-processors set out in Annex 3.

6.2 EU transfers. To the extent that you are subject to the EU GDPR and your transfer of Client Personal Data to us is a Restricted Transfer, the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914 are incorporated into this DPA by reference, as follows: Module Two (controller to processor) applies; clause 7 (docking) applies; under clause 9(a), Option 2 (general written authorisation) applies with the notice period in clause 5.2 above; the optional wording in clause 11 does not apply; under clause 17, Option 1 applies and the governing law is the law of Ireland; under clause 18, the courts are those of Ireland; Annexes I and II of the Clauses are completed by Annexes 1 and 2 of this DPA, and the competent supervisory authority is determined under clause 13. If you are a processor, Module Three applies on the same basis.

6.3 UK transfers. To the extent that you are subject to the UK GDPR and your transfer to us is a Restricted Transfer, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force 21 March 2022), as amended from time to time, is incorporated by reference. Tables 1 to 3 are completed by the details in this DPA and its Annexes, and in Table 4 either party may end the Addendum as set out in its Section 19.

6.4 Swiss transfers. For transfers subject to the Swiss Federal Act on Data Protection, the Clauses in clause 6.2 apply with the changes the Swiss Federal Data Protection and Information Commissioner requires.

6.5 Onward transfers. We will transfer Client Personal Data to a Sub-processor outside India only under a lawful transfer mechanism.

6.6 Precedence. If the incorporated Clauses or Addendum conflict with this DPA or the Agreement, the Clauses or Addendum prevail.

6.7 Transfer impact. We will give you reasonable information you need to complete a transfer risk assessment, including about any requests for access by public authorities that we receive (subject to the law).

7. Personal data breaches

7.1 Notice. We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Client Personal Data.

7.2 Content. The notice will describe, as far as we know at the time: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address it and to reduce its effects; and a contact for more information. Where we do not have all the information at once, we will provide it in stages without undue delay.

7.3 Response. We will take reasonable steps to contain, investigate and remedy the breach, and cooperate with you in notifying supervisory authorities, the Data Protection Board of India and affected individuals. We will not notify them ourselves about a breach of Client Personal Data unless the law requires it or you ask us to.

7.4 No admission. Our notice of a breach is not an admission of fault or liability.

8. Deletion or return on termination

8.1 When the services involving processing end, we will, at your choice, return Client Personal Data to you in a commonly used format or delete it. If you do not tell us your choice within 30 days after the end of the services, we will delete it.

8.2 We will complete deletion within 30 days after your choice or the end of that 30-day period, except that copies in backups will be deleted under our normal backup rotation (not longer than 90 days) and will not be used in the meantime.

8.3 We may keep Client Personal Data where the law requires us to, in which case this DPA continues to protect it and we will process it only for the purpose for which the law requires it.

8.4 We will confirm deletion in writing on request.

9. Information and audits

9.1 Questionnaire. We will make available to you all information reasonably necessary to demonstrate our compliance with this DPA. The primary means of doing so is a written security and privacy questionnaire, which we will answer completely and accurately within 30 days of your request, not more than once in any 12-month period (except after a personal data breach or where a supervisory authority requires it).

9.2 Further audit. If the questionnaire answers and any certifications or reports we provide do not reasonably show our compliance, or a supervisory authority requires it, you (or an independent auditor bound by confidentiality, who is not our competitor) may carry out an audit, which may include an inspection. You must give at least 30 days' written notice and a proposed scope, carry it out during normal business hours in Bengaluru with minimal disruption, and bear its costs (including our reasonable time at our standard rates), unless it reveals a material breach of this DPA by us. Audits of our Sub-processors are carried out by relying on their own independent audit reports.

9.3 Nothing in this clause limits any audit right that the Clauses in clause 6 give you.

10. US state privacy laws

Where we act as your service provider or contractor under the California Consumer Privacy Act or a similar US state law, we: process the personal information only for the business purposes in the Agreement; do not sell or share it; do not retain, use or disclose it outside our direct business relationship with you; do not combine it with other personal information except as the law permits; comply with the law that applies and provide the same level of privacy protection it requires; tell you if we can no longer meet our obligations; and allow you to take reasonable steps to stop and remedy unauthorised use.

11. Liability

Each party's liability under or in connection with this DPA is subject to the limitations and exclusions of liability in the Agreement, except to the extent that Data Protection Law or the incorporated Clauses do not permit it. This does not limit either party's liability to data subjects under the Clauses.

12. Term and precedence

12.1 This DPA lasts as long as we process Client Personal Data, and then until the deletion or return under clause 8 is complete.

12.2 For matters of personal data, this DPA prevails over the rest of the Agreement, subject to clause 6.6.

12.3 This DPA is governed by the law that governs the Agreement, except where the Clauses or Data Protection Law require otherwise.

Annex 1: Description of the processing

A. Parties.

Data exporter / controller: the Client, as named above. Contact: the person named in the SOW.

Data importer / processor: AutonomicsAI LLP. Contact: Sean Paul, Founder, AutonomicsAI LLP (Grievance Officer), [email protected], +91 88613 65188 (the business number).

B. Categories of data subjects. As set out in the SOW, typically: the Client's prospective customers and leads; customers; people who submit forms on the Client's website; recipients of messages sent through the services; the Client's staff who use the services.

C. Types of personal data. As set out in the SOW, typically: name; email address; phone number; postal or project address; business name and role; the content of enquiries, requests for quotes and messages; project details and photos the person chooses to send; timestamps; technical data such as IP address and browser type where a form collects it; product or catalog data that contains personal data.

D. Special-category data. None, unless the SOW expressly provides otherwise, together with the additional safeguards stated there.

E. Frequency of transfer. Continuous for the duration of the services.

F. Nature of the processing. Collection through forms and integrations; storage; organisation; routing and notification; drafting and sending replies; summarising; formatting and enriching catalog data; scheduling meetings; deletion.

G. Purpose. To provide the services described in the SOW.

H. Duration and retention. For the term of the services and as set out in clause 8, or a shorter retention period set out in the SOW.

I. Sub-processor transfers. As set out in Annex 3, for the same purposes and duration.

Annex 2: Technical and organisational security measures

1. Encryption. Data is encrypted in transit with TLS. Data at rest is encrypted by our hosting and email providers.
2. Access control. Access only for personnel who need it for the services; individual accounts; multi-factor authentication on all accounts that can access Client Personal Data; access removed promptly when no longer needed.
3. Credentials. Client credentials kept in a password manager or equivalent secure store; not shared by chat or plain email where avoidable; rotated when personnel change.
4. Minimisation. We collect only the fields the SOW requires; form submissions are given an automatic expiry where the platform supports it; IP addresses used for rate limiting are hashed.
5. Separation. Each client's data is kept separate by account, project or key prefix.
6. AI tools. Only AI tools on business accounts that do not allow our data to be used to train models; no Client Personal Data entered into consumer AI accounts; human review of output.
7. Devices. Full-disk encryption, screen lock, and up-to-date operating systems and browsers on devices used to access Client Personal Data.
8. Logging and monitoring. Account and administrative activity logs kept by our providers are reviewed when an incident is suspected.
9. Incident response. A documented process to contain, assess, notify (clause 7) and learn from incidents.
10. Backups and resilience. Rely on the redundancy of our hosting providers; backups deleted under clause 8.2.
11. Personnel. Confidentiality undertakings and data protection instructions for everyone who processes Client Personal Data.
12. Review. These measures are reviewed at least once a year and after any significant incident.

Annex 3: Authorised Sub-processors

The SOW may list additional Sub-processors that are specific to a service, including platforms that you choose and contract with directly (which are your own processors, not ours).