Data Processing Addendum

What This Is

This Data Processing Addendum ("DPA") applies if you upload any personal data about other people into ADRITHM (customer lists, leads, audiences, WhatsApp contacts, etc.). It clarifies our roles and obligations under the Digital Personal Data Protection Act, 2023 ("DPDP Act").

Your Responsibility (You're the Fiduciary)

You own and control customer data you upload. You are responsible for:

• Having a lawful basis to collect and use this data
• Obtaining consent from each person whose data you upload (if required by law)
• Providing privacy notices to those people explaining what you're doing
• Responding to data subject requests (access, correction, erasure) directed at you
• Handling breach notifications to individuals (if a breach occurs)
• Complying with sector-specific law (e.g., health, finance)

Our Responsibility (We're the Processor)

We:

• Process customer data only on your instructions (to deliver ADRITHM features)
• Implement technical and organizational measures to protect it
• Don't share it with third parties without your consent, except where necessary for platform operation
• Delete it when you delete your account or 90 days of inactivity, whichever is first
• Notify you of any data breach within 72 hours of discovery

Prohibited Data Categories

You must not upload personal data belonging to:

• Minors — Anyone under 18
• Health or genetic data — Medical conditions, test results, genetic markers
• Biometric data — Facial recognition, fingerprints, iris scans
• Financial account numbers — Credit card numbers, bank account details
• Government IDs — Aadhaar, PAN card, passport numbers, driver's license

If you upload prohibited data, we may suspend your account and delete it.

Subprocessors

We use these third parties to process customer data:

Breach Notification

If we discover a data breach:

1. We notify you within 72 hours of discovery
2. You are responsible for notifying affected individuals (your customers)
3. We will cooperate with your breach investigation and provide technical details