Data Processing Agreement

1.1 This DPA is between the customer identified in the Terms or order ("Customer", Data Fiduciary / controller) and DigAI Technologies Pvt. Ltd. ("DigAI", Data Processor), and applies when DigAI processes personal data in Customer Content on the Customer's behalf.

1.2 It forms part of the Terms. If they conflict on personal-data processing, this DPA prevails.

"Applicable Data Protection Law" means the DPDP Act 2023 and rules, the IT Act 2000 and rules and, where they apply, GDPR and UK GDPR. "Personal Data", "Data Principal/Data Subject", "Processing", "Personal Data Breach" have the meanings in that law. "Subprocessor" means a third party DigAI engages to process Personal Data.

3.1 The Customer is responsible for the lawfulness of its Personal Data, notices and consents, and its instructions.

3.2 DigAI will process Personal Data only to provide and support the Services, per the Terms, this DPA and the Customer's documented instructions (including through product settings and API use), unless law requires otherwise, in which case DigAI will inform the Customer where lawful.

3.3 DigAI will tell the Customer if it believes an instruction infringes Applicable Data Protection Law.

Annex I sets out subject matter, duration, nature, purpose, data types and categories of people.

DigAI ensures personnel with access to Personal Data are bound by confidentiality and given access only as needed.

DigAI implements the measures in Annex II and may update them if the overall protection is not reduced.

7.1 The Customer gives general authorisation to the Subprocessors in Annex III (also on the Subprocessors page).

7.2 DigAI will give at least 30 days' notice of additions or replacements. The Customer may object on reasonable data-protection grounds within that period; if unresolved, the Customer may terminate the affected Services and receive a pro-rata refund of prepaid fees.

7.3 DigAI imposes data-protection terms on Subprocessors no less protective than this DPA and remains responsible for their performance.

7.4 Third-party services the Customer itself connects (for example its own AI, SMTP, SMS, Meta or Google accounts) are not DigAI Subprocessors; the Customer's own agreements with them apply.

8.1 Requests from people. DigAI will, taking account of the Services, help the Customer respond to access, correction, erasure and other requests, and will forward any request it receives directly. Many actions can be done in the product.

8.2 Impact assessments and consultations. DigAI will provide reasonable information to help the Customer meet its obligations.

DigAI will notify the Customer without undue delay, and aim to do so within 72 hours, after becoming aware of a Personal Data Breach affecting the Customer's Personal Data, with the information then available (nature, categories, likely consequences, measures taken) and updates as it learns more. The Customer decides whether and how to notify authorities and people, and DigAI will cooperate.

Where Applicable Data Protection Law restricts transfers, the parties rely on the lawful transfer mechanism available, including Standard Contractual Clauses for GDPR-covered data, which are incorporated by reference where needed. Hosting location: our cloud infrastructure providers listed on the Subprocessors page.

On termination, DigAI will make Customer Content available for export for 30 days and then delete it, and delete backups within 35 days, unless law requires retention.

DigAI will provide information reasonably necessary to show compliance, including answers to a security questionnaire and the current Trust Center materials. If that is insufficient, the Customer may, no more than once a year (or after a breach), conduct a reasonable audit on 30 days' notice during business hours at its own cost, subject to confidentiality and without access to other customers' data.

Each party's liability under this DPA is subject to the limits in the Terms. The governing law and dispute clause of the Terms apply, except where Applicable Data Protection Law requires otherwise.

This DPA lasts for as long as DigAI processes Personal Data for the Customer.