Data Processing Agreement

This Data Processing Agreement ("DPA") is between PWIN Technologies Private Limited ("Nagent") and the customer ("Customer") that has agreed to Nagent's Terms of Service or signed a Master Subscription Agreement with Nagent (either, the "Agreement"). It forms part of the Agreement and applies while Nagent processes Customer Personal Data.

This DPA covers Customer Personal Data only. Personal data that Nagent processes for its own purposes is covered by Nagent's Privacy Policy, for which Nagent is the data fiduciary or controller. That includes account administration, billing, security of its own systems, and Nagent's own sales and marketing.

If this DPA conflicts with the Agreement on the processing of personal data, this DPA prevails, except that the limitations and exclusions of liability in the Agreement always apply under section 15. A signed Business Associate Agreement prevails over both for protected health information. The Standard Contractual Clauses prevail over everything where they apply.

"Data Protection Law": all laws on personal data that apply to a party's processing under the Agreement. These include India's Digital Personal Data Protection Act, 2023 and the rules under it ("DPDP Act"); the Information Technology Act, 2000 and its rules, while in force; the EU General Data Protection Regulation ("GDPR"); the UK GDPR and Data Protection Act 2018; the Swiss Federal Act on Data Protection; and US state privacy laws.

"Customer Personal Data": personal data within Customer Data that Nagent processes on Customer's behalf in providing the Service.

"Controller" includes a Data Fiduciary, and "Processor" includes a Data Processor, under the DPDP Act. "Data Subject" includes a Data Principal. Other terms have the meanings given in the GDPR or the Agreement.

"Security Incident": a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data in systems Nagent or its Sub-processors control. This includes a personal data breach under the DPDP Act. Unsuccessful attempts that do not compromise security are excluded, such as pings, port scans and failed log-ins.

"Sub-processor": a third party Nagent engages to process Customer Personal Data.

"SCCs": the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914. "UK Addendum": the International Data Transfer Addendum issued by the UK Information Commissioner.

Customer is the Controller, and Nagent is a Processor of Customer Personal Data. Where Customer is itself a processor for its own clients, Nagent is Customer's sub-processor. Customer warrants that its controller has authorised Nagent's appointment, and Customer remains Nagent's sole point of contact.

Nagent processes Customer Personal Data only on Customer's documented instructions. Customer's complete instructions are:

• the Agreement and this DPA;
• Customer's configuration and use of the Service, including the AI Teammates it enables, the Autonomy Levels it sets, the Agent Actions it approves or allows, the Connected Services it links, and the searches, enrichment and outreach it starts;
• other reasonable written instructions consistent with the Agreement.

Instructions that need work beyond the Service's standard functionality may be charged for.

Nagent will tell Customer if, in its opinion, an instruction breaches Data Protection Law. Nagent may then decline to follow that instruction without liability. Nagent will not otherwise assess Customer's instructions.

Customer is solely responsible for:

• the lawfulness of the processing it instructs;
• having a valid consent or other lawful basis;
• giving every notice Data Protection Law requires, including to people Customer finds, enriches or contacts through the Service;
• honouring their objections and withdrawals of consent;
• the accuracy of Customer Personal Data.

If Data Protection Law requires Nagent to process Customer Personal Data other than on Customer's instructions, Nagent will tell Customer before doing so, unless the law forbids it.

Nagent does not use Customer Personal Data to train or fine-tune any AI model. Nagent engages frontier AI model providers under commercial agreements that prohibit them from training on data Nagent sends, and holds every AI Sub-processor to the same requirement. For Enterprise customers, Nagent will use zero-data-retention terms on request where a provider offers them.

Improvements the Service learns from Customer's Workspace, such as refined instructions for AI Teammates, are part of Customer Data and are never used for another customer.

Nagent may derive de-identified, aggregated performance measurements that contain no Customer Personal Data, such as action success rates, and use them to operate and improve the Service. Once de-identified, they are not Customer Personal Data.

Where Customer uses its own account with an AI model, email or integration provider, that provider processes data under Customer's own agreement with it. It is not Nagent's Sub-processor.

Nagent limits access to Customer Personal Data to personnel who need it to provide, support or secure the Service. Those personnel are bound by confidentiality obligations and trained in data protection. Nagent personnel access a Workspace only as the Agreement allows, and each access is recorded in Customer's audit log.

Nagent will implement and maintain the technical and organisational measures in Annex II. These are designed to protect Customer Personal Data in a way appropriate to the risk, as GDPR Article 32 and section 8(5) of the DPDP Act require.

Nagent may update the measures, provided the overall level of protection does not decrease. Customer is responsible for its own use of the Service, including its credentials, its users' access, enabling multi-factor authentication, and the security of any Customer Environment.

Customer gives general authorisation for Nagent to engage Sub-processors, including those Nagent uses when Customer accepts this DPA. Nagent uses Sub-processors, for example for hosting, data storage, AI model providers, payments and email. Nagent will publish the list of its Sub-processors at nagent.ai/subprocessors, which forms Annex III, and will update it before a new Sub-processor begins processing Customer Personal Data.

Nagent will bind each Sub-processor by written agreement to data protection obligations no less protective than this DPA. Nagent remains liable for each Sub-processor's performance, subject to the Agreement's limits of liability.

Nagent will give at least 30 days' notice before a new Sub-processor begins processing Customer Personal Data. Notice is given by updating the list and emailing subscribers and Workspace administrators. In an emergency affecting security or continuity, Nagent will give notice as soon as practicable.

Customer may object on reasonable data protection grounds within 15 days of notice. The parties will discuss the objection in good faith. If Nagent cannot reasonably avoid using that Sub-processor for Customer, Customer may terminate the affected service. It then receives a pro-rata refund of prepaid fees, which is its sole remedy for the objection. Without a timely objection, Customer is deemed to accept the new Sub-processor.

The Service provides tools Customer can use to access, correct, export and erase Customer Personal Data, including lead erasure and export.

If Nagent receives a request from a Data Subject about Customer Personal Data, it will forward the request to Customer without undue delay. Nagent will not respond itself, except to confirm the request was passed on.

Where Customer cannot fulfil a request with those tools, Nagent will give reasonable assistance. Assistance beyond the self-service tools may be charged at Nagent's then-current rates.

When Customer instructs Nagent to erase Customer Personal Data because a Data Principal has withdrawn consent or the purpose is complete, Nagent will erase it within 30 days. This does not apply where law requires retention. It supports Customer's duty under section 8(7) of the DPDP Act.

Nagent will notify Customer of a Security Incident without undue delay, and in any event within 48 hours of confirming it, by email to Customer's Workspace administrators.

Nagent will provide, as the information becomes available, what Customer reasonably needs to meet its own duties. That includes reporting to the Data Protection Board of India under the DPDP Rules and to supervisory authorities under GDPR Article 33. It covers:

• the nature of the incident;
• the categories and approximate volume of data and Data Subjects;
• likely consequences;
• measures taken or proposed.

Nagent will take reasonable steps to contain and remedy the incident. Notification is not an admission of fault or liability. Customer decides whether to notify regulators and Data Subjects, and Nagent will not notify Customer's Data Subjects unless the law requires.

Taking into account the nature of the processing and the information available to Nagent, Nagent will give reasonable assistance with Customer's data protection impact assessments and prior consultations, and with any periodic assessment the DPDP Act requires of Customer. Nagent will first refer Customer to its certifications, documentation and this DPA. Further assistance may be charged.

Nagent hosts Customer Personal Data in India by default. Sub-processors may process it in other countries. Transfers out of India comply with section 16 of the DPDP Act and are never made to a country the Government of India restricts.

Where Customer transfers personal data from the EEA to Nagent in India, and no adequacy decision covers the transfer, the SCCs apply. They are incorporated into this DPA as follows:

• Modules. Module Two applies where Customer is a controller, and Module Three where Customer is a processor.
• Exporter and importer. Customer is the data exporter and Nagent the data importer.
• Options. Clause 7 (docking) applies. Option 2 of Clause 9(a) applies, with the notice period in section 7.3. The optional wording in Clause 11 does not apply.
• Law and forum. Clauses 17 and 18 select the law and courts of Ireland.
• Annexes. Annexes I and II of the SCCs are completed by Annexes I and II of this DPA. Annex III of the SCCs is completed by Annex III of this DPA.

Transfers from the United Kingdom are governed by the UK Addendum, with the SCCs as completed above, and either party may end it as section 19 of the Addendum allows. Transfers from Switzerland are governed by the SCCs, adjusted as the Swiss Federal Data Protection and Information Commissioner requires.

Nagent's onward transfers to Sub-processors are covered by the SCCs, or another valid mechanism, between Nagent and each Sub-processor.

Nagent will make available the information reasonably needed to demonstrate compliance with this DPA, namely:

• its ISO/IEC 27001:2022 certificate (InterCert, IC-IS-2609127);
• its SOC 2 Type II report, shared under NDA, once issued (that programme is underway);
• answers to one reasonable security questionnaire a year.

For self-serve customers, section 12.1 satisfies Customer's audit rights, except where a supervisory authority requires an audit or after a Security Incident affecting Customer. In those cases section 12.3 applies.

Enterprise customers, and the cases in 12.2, may audit under section 10.4 of the MSA. That means no more than once a year, with 30 days' notice, at Customer's cost, carried out by Customer or an independent auditor bound by confidentiality, and remotely first. On-site audits may not access other customers' data or compromise Nagent's security. This section is how the parties agree audits under Clause 8.9 of the SCCs are carried out.

Customer may export Customer Personal Data with the Service's export tools, or on request, during the term and for 30 days after it ends. Under the MSA, the window is 60 days.

After the export window, Nagent will delete Customer Personal Data from its live systems within 30 days, and from backups as they rotate, within 35 days. The exceptions are:

• data the law requires Nagent to retain, which it will keep confidential and process only for that purpose;
• data reduced to the de-identified measurements under 4.3.

Nagent will certify deletion on request for Enterprise customers.

Voice and likeness. If Customer uses voice, avatar or persona features, Nagent processes voice samples and facial images of the people Customer names. It does so only to generate the content Customer requests, not to identify anyone. Customer warrants that it has each person's explicit written consent covering that use. Customer will not submit voice or images of anyone under 18.

Sensitive and health data. Customer will not submit special categories of personal data, or sensitive personal data under Indian law, except where the Service is designed for it or the Agreement allows it. Protected health information may be processed only under a signed Business Associate Agreement, on a deployment and with features designated as eligible.

Private Cloud. On a Private Cloud deployment, Customer Personal Data stays in the Customer Environment, which Customer controls. This DPA then applies only to:

• Customer Personal Data that Nagent personnel access during support sessions Customer approves;
• any Customer Personal Data in the telemetry described in Schedule B of the MSA, which is designed to contain none.

Sections 7 and 11 apply only to providers Nagent engages for that deployment.

US state privacy laws. Where these apply, Nagent acts as a service provider or processor. It will not:

• sell or share Customer Personal Data, as those laws define the terms;
• retain, use or disclose it outside the direct business relationship with Customer, or for any purpose other than the Agreement;
• combine it with personal data from other sources, except as those laws permit.

Nagent will tell Customer if it can no longer meet these obligations.

All liability of Nagent arising out of or relating to this DPA, including for breach of data protection, security or confidentiality obligations and for the acts of its Sub-processors, is subject to, and counts towards, the limitations and exclusions of liability in the Agreement. For self-serve customers, that is section 20 of the Terms of Service. This DPA creates no separate cap, no uncapped liability and no indemnity. Nothing in this DPA limits liability that cannot be limited under applicable law, including any liability to Data Subjects that the SCCs, where they apply, do not allow to be limited.

This DPA ends when Nagent no longer processes Customer Personal Data. Sections 9, 13 and 15 survive. Governing law and dispute resolution follow the Agreement, except as the SCCs require.

The Sub-processors are those Nagent engages under section 7, as published at nagent.ai/subprocessors and updated under section 7.