Data Processing Agreement

Capitalised terms not defined in this DPA have the meanings given in the Agreement. In this DPA:

1. (a)Applicable Data Protection Law means all laws on the processing of personal data that apply to a party's processing under the Agreement, which may include the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (DPDP Law), the Information Technology Act, 2000 and rules made under it, the EU General Data Protection Regulation 2016/679 (EU GDPR), the EU GDPR as retained in UK law (UK GDPR) and the California Consumer Privacy Act as amended (CCPA).
2. (b)Controller means the Data Fiduciary under DPDP Law, the controller under the EU GDPR and UK GDPR, or the business under the CCPA, as applicable.
3. (c)Processor means the Data Processor under DPDP Law, the processor under the EU GDPR and UK GDPR, or the service provider under the CCPA, as applicable.
4. (d)Customer Personal Data means personal data contained in Customer Content that StratVeda processes on the Customer's behalf in providing the Service.
5. (e)Data Subject means the individual to whom Customer Personal Data relates, including a Data Principal under DPDP Law.
6. (f)Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data, including a personal data breach as defined in DPDP Law.
7. (g)Subprocessor means a third party engaged by StratVeda that processes Customer Personal Data.
8. (h)Supervisory Authority means the Data Protection Board of India, a supervisory authority under the EU GDPR, the UK Information Commissioner, or another competent regulator.
9. (i)Standard Contractual Clauses means the clauses approved by European Commission Implementing Decision (EU) 2021/914, and UK Addendum means the International Data Transfer Addendum issued by the UK Information Commissioner.

The Customer is the Controller of Customer Personal Data and StratVeda is its Processor. Where the Customer is itself a Processor for a third party, the Customer warrants that its instructions are authorised by that third party, and StratVeda is a sub-processor.

StratVeda processes personal data relating to the Customer's Account administration, billing, security and its own business relationship with the Customer as an independent Controller under the Privacy Policy. This DPA does not apply to that processing.

The subject matter, nature, purpose, categories of data and Data Subjects, and duration of processing are described in Schedule 1.

This DPA remains in effect for as long as StratVeda processes Customer Personal Data on the Customer's behalf, including after termination of the Agreement until the deletion or return of Customer Personal Data under clause 12.

StratVeda will process Customer Personal Data only on the Customer's documented instructions. The Agreement, this DPA and the Customer's configuration and use of the Service constitute the Customer's complete instructions at the date of this DPA. Further instructions must be in writing, consistent with the Agreement, and technically feasible; instructions that change the scope of the Service may be subject to agreed charges.

StratVeda may process Customer Personal Data otherwise than on instructions only where required by applicable law, in which case it will inform the Customer before processing unless the law prohibits it.

StratVeda will promptly inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law. StratVeda is not obliged to provide legal advice.

StratVeda will not (a) sell or share Customer Personal Data within the meaning of the CCPA, (b) retain, use or disclose it for any purpose other than the business purposes specified in the Agreement, (c) retain, use or disclose it outside the direct business relationship with the Customer, (d) combine it with personal data received from other sources except as permitted by law, or (e) use Customer Content or Output to train, fine-tune or improve artificial-intelligence models.

The Customer is responsible for the lawfulness of the Customer Personal Data and its instructions, including giving any notices to and obtaining any consents from Data Subjects required by Applicable Data Protection Law, and for ensuring that the Customer Personal Data is accurate and limited to what is necessary for the Decision.

The Customer will not submit special categories of personal data, sensitive personal data or information, government identification numbers, financial account credentials, or personal data of children, except where permitted by law and agreed in writing with StratVeda.

The Customer is responsible for the security of its Accounts, credentials and Authorised User access.

StratVeda will ensure that personnel authorised to process Customer Personal Data are bound by written confidentiality obligations or an appropriate statutory duty of confidentiality, receive appropriate data protection training, and access Customer Personal Data only as needed to provide, secure and support the Service.

StratVeda will implement and maintain the technical and organisational measures described in Schedule 2, which are designed to protect Customer Personal Data against a Personal Data Breach and are appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing.

StratVeda may update the measures in Schedule 2 from time to time, provided that updates do not materially reduce the overall level of protection.

Where DPDP Law applies, the measures include reasonable security safeguards within the meaning of DPDP Law, including encryption, access control, visibility of access through logs, measures for continued processing, and retention of logs for at least one year.

The Customer gives StratVeda general authorisation to engage Subprocessors. The Subprocessors engaged at the date of this DPA are listed in Schedule 3.

StratVeda will notify the Customer of any intended addition or replacement of a Subprocessor at least 30 days before the change takes effect, by email or by notice in the Service. In an emergency affecting the security or availability of the Service, StratVeda may give shorter notice.

The Customer may object to a new Subprocessor on reasonable data protection grounds by written notice within 15 days of notification. The parties will discuss the objection in good faith. If they cannot resolve it within 30 days, the Customer may terminate the affected part of the Service and receive a pro-rata refund of prepaid Fees for the terminated period.

StratVeda will enter into a written agreement with each Subprocessor imposing data protection obligations that are no less protective than those in this DPA, to the extent applicable to the services provided, and remains responsible to the Customer for each Subprocessor's performance of those obligations.

StratVeda will process Customer Personal Data in the locations described in Schedule 1 and Schedule 3. Transfers out of India will comply with any restriction notified by the Government of India under section 16 of the DPDP Act.

Where Customer Personal Data subject to the EU GDPR or UK GDPR is transferred to StratVeda in India or onward to a Subprocessor in a country without an adequacy decision, the parties will, on the Customer's written request, enter into the Standard Contractual Clauses (Module 2 for Controller-to-Processor, or Module 3 for Processor-to-Processor, as applicable) and, for UK data, the UK Addendum, with the options agreed at that time.

If a transfer mechanism is invalidated or replaced, the parties will cooperate to adopt an appropriate alternative.

Taking into account the nature of the processing, StratVeda will assist the Customer by appropriate technical and organisational measures, insofar as possible, to respond to requests from Data Subjects to exercise their rights under Applicable Data Protection Law.

If StratVeda receives a request directly from a Data Subject about Customer Personal Data, it will forward the request to the Customer without undue delay and will not respond to it except to direct the Data Subject to the Customer, unless the law requires otherwise.

The Customer can access, correct and delete much of the Customer Personal Data directly in the Service. For other requests, StratVeda will provide reasonable assistance within a timescale that allows the Customer to meet its legal deadlines.

StratVeda will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.

The notification will describe, to the extent then known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed to address it and mitigate its effects, and a contact point. StratVeda will provide further information in phases as it becomes available.

StratVeda will take reasonable steps to contain, investigate and remediate the breach and will cooperate with the Customer in meeting its obligations to notify Data Subjects and Supervisory Authorities, including the Data Protection Board of India's requirement for a detailed report within 72 hours.

Notification of a Personal Data Breach is not an acknowledgement of fault or liability.

StratVeda will provide reasonable assistance to the Customer, taking into account the nature of processing and the information available to StratVeda, in carrying out data protection impact assessments and prior consultations with Supervisory Authorities where required by Applicable Data Protection Law.

Each party will cooperate in good faith with any inquiry or investigation by a Supervisory Authority relating to Customer Personal Data. StratVeda will notify the Customer promptly of any regulatory request about Customer Personal Data unless prohibited by law.

Where a government authority requests access to Customer Personal Data, StratVeda will, unless prohibited by law, notify the Customer, require the request to be made through proper legal channels, and disclose only the minimum data legally required.

On termination or expiry of the Agreement, StratVeda will, at the Customer's choice, make Customer Personal Data available for export for 30 days, in the formats then available in the Service, and then delete it, or delete it.

StratVeda will delete Customer Personal Data from active systems within a reasonable period after termination, normally within 90 days, and from backups as they are overwritten in the ordinary backup cycle, unless applicable law requires retention, in which case StratVeda will keep the data confidential, protect it under this DPA and process it only for the purpose for which retention is required.

On request, StratVeda will confirm deletion in writing.

StratVeda will make available to the Customer, on written request, information reasonably necessary to demonstrate compliance with this DPA, including responses to reasonable security questionnaires, a description of its security measures and any available third-party audit reports or certifications.

Where required by a Supervisory Authority or Applicable Data Protection Law, or where agreed in a signed Order Form, the Customer may conduct an audit, no more than once in any 12-month period (except following a Personal Data Breach or regulatory request), on at least 30 days' written notice, during business hours, at the Customer's cost, by the Customer or an independent auditor bound by confidentiality, and in a manner that does not compromise the security of the Service or other customers' data.

Audits of Subprocessors will be satisfied by reports or certifications that the Subprocessor makes available, where these reasonably demonstrate compliance.

Each party's liability arising out of or in connection with this DPA is subject to the exclusions and limitations of liability in the Agreement, except to the extent such limitations are not permitted by Applicable Data Protection Law or the Standard Contractual Clauses.

Each party will indemnify the other against fines, penalties and third-party claims to the extent they result from the indemnifying party's breach of this DPA or Applicable Data Protection Law, subject to the limitations in the Agreement.

If there is a conflict, the following order applies: (a) the Standard Contractual Clauses and UK Addendum, where incorporated; (b) this DPA; (c) any signed Order Form; and (d) the Terms of Service. A separately negotiated data processing agreement signed by both parties replaces this DPA for that Customer.

This DPA is governed by the law and subject to the jurisdiction set out in the Agreement, except where the Standard Contractual Clauses require otherwise.

StratVeda may update this DPA to reflect changes in Applicable Data Protection Law or the Service, on at least 30 days' notice, provided that the update does not materially reduce the protection of Customer Personal Data.