Data Processing Addendum

1. Scope and Parties

This Data Processing Addendum ("DPA") forms part of the Terms of Service between you ("Customer") and Neuradigi Technologies (OPC) Pvt. Ltd. ("Prativani"). It applies whenever we process personal data about your customers, prospects, visitors or other individuals in the course of providing the Service. It takes effect automatically when you accept the Terms — you do not need to sign a separate copy, though we will sign one on request at [email protected].

Terms such as controller, processor, sub-processor, personal data, processing and data subject carry the meaning given to them in the applicable data-protection law — including the EU and UK GDPR, India's Digital Personal Data Protection Act 2023, and the California Consumer Privacy Act as amended.

2. Roles

You are the controller (data fiduciary) of the personal data you put into the Service and of the data your customers generate by contacting you through it. We are your processor (data processor) and act only on your documented instructions.

We are a separate, independent controller for the limited data we hold about you and your team as our customer — account, billing and support records. That processing is governed by our Privacy Policy, not by this DPA.

Under the CCPA we act as a service provider. We do not sell or share personal data, and we do not retain, use or disclose it for any purpose other than performing the Service.

3. What We Process, and Why

• Subject matter and purpose — providing the Prativani customer-communication platform: receiving, routing, answering, storing and reporting on conversations across chat, WhatsApp, Facebook, Instagram, email and voice, plus contact management, campaigns, automation and analytics.
• Duration — for as long as your account is active, plus the retention and deletion periods set out in section 11.
• Categories of data subject — your customers, prospects and website visitors; your own team members whose details appear in conversation records.
• Categories of personal data — identifiers (name, email address, phone number, social messaging identifiers, device identifier); communication content (messages, email bodies and headers, attachments, call audio and transcripts); interaction data (pages viewed, session times, ratings, tags, notes, attributes); technical data (IP address, approximate location derived from it, browser and device information).
• Special category data — the Service is not designed for it. You should not route health, biometric, financial-account, government-identifier or similarly sensitive data through it, and you remain responsible if you do.

4. Your Instructions

We process personal data only to provide and secure the Service, as described in this DPA and the Terms, and as further instructed by you through the product's own settings and controls — retention periods, consent notices, channel configuration, deletion actions and the like. Your use of the Service constitutes those documented instructions.

If we believe an instruction breaches data-protection law, we will tell you and may suspend that processing until it is resolved. We will not process personal data for our own purposes, and we will not use your data or your customers' data to train AI models.

5. Your Obligations

You are responsible for having a lawful basis to collect and process the personal data you put into the Service, for giving data subjects the notices their law requires, for obtaining and recording consent where it is needed, and for the accuracy of what you upload or import. The Service provides consent-notice, retention and deletion controls; configuring them appropriately is your decision. You must not instruct us to do anything that would put either party in breach of data-protection law.

6. Confidentiality

Access to personal data is limited to personnel who need it to operate or support the Service. Everyone with such access is bound by written confidentiality obligations that survive the end of their engagement, and receives training appropriate to that access.

7. Security Measures

We maintain technical and organizational measures appropriate to the risk, including:

• encryption of all traffic in transit;
• passwords stored only as bcrypt hashes, and optional two-factor authentication by authenticator app, email or SMS;
• role-based access control within each workspace, with session review and revocation;
• strict separation of data between workspaces, enforced at the database level as well as in the application;
• an audit log of administrative and security-relevant actions, retained for 24 months;
• restricted access to production systems, with credentials held in encrypted secret storage;
• abuse, rate and sending controls that limit the blast radius of a compromised account.

We may update these measures as the platform evolves, provided the level of protection is not reduced.

8. Sub-processors

You give general authorisation for us to engage sub-processors. Each one is bound by a written contract imposing data-protection obligations no less protective than those in this DPA, and we remain liable to you for their performance.

The current list — with what each does and where it operates — is published on our Subprocessors page, which is versioned separately from this DPA so that a change of provider does not re-issue the agreement. We will give at least 30 days' notice before adding or replacing a sub-processor that handles end-user data; email [email protected] to receive those notices. If you reasonably object on data-protection grounds within that window, we will work with you on an alternative, and if none is workable you may terminate the affected part of the Service without penalty for the remainder of the paid term.

9. International Transfers

We operate from India and use sub-processors in the United States and the European Union, so personal data may be transferred across borders. Where a transfer is subject to European or UK law, it is made under the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable), which are incorporated into this DPA by reference, together with the measures in section 7. Where a transfer is subject to other law, we rely on the mechanism that law provides.

10. Data Subject Requests and Assistance

The Service gives you the tools to answer most requests yourself: search and export of a contact's data, correction of contact records, deletion of individual contacts and conversations, and configurable automatic deletion. Where you need more, we will provide reasonable assistance, taking into account the nature of the processing and the information available to us.

If a data subject contacts us directly about data we process for you, we will not respond substantively — we will tell them to contact you and, unless prohibited, let you know. We will also assist you, on request and at your cost where the effort is substantial, with data-protection impact assessments and prior consultations with a regulator.

11. Retention, Return and Deletion

Personal data is retained for as long as your account is active and the retention rules you configure allow. The default periods that apply to each category are published in section 8 of our Privacy Policy.

You may export your data at any time using the export tools in the product. On termination, or on your written request, we will delete the personal data we process for you: a deleted workspace is closed immediately and permanently purged after a 7-day grace period, which destroys conversations, contacts, recordings and stored files. We may retain data for longer only where a law requires it, and it stays protected by this DPA for as long as we hold it.

12. Personal Data Breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting data we process for you, and in any case within 72 hours. The notice will describe what we know: the nature of the breach, the categories and approximate number of records and data subjects affected, the likely consequences, and the measures taken or proposed. We will keep you updated as we learn more, and cooperate reasonably with your own notification obligations to regulators and data subjects.

13. Audits

On reasonable written request, and no more than once a year unless a regulator or a breach requires otherwise, we will provide the information reasonably necessary to demonstrate compliance with this DPA. Where documentation is not sufficient for your legal obligations, we will accommodate an audit by you or an independent auditor you appoint, on reasonable notice, during business hours, subject to confidentiality, without disrupting the Service or exposing other customers' data, and at your cost.

14. Liability and Precedence

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service. If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails; if it conflicts with the Standard Contractual Clauses, those clauses prevail. Everything else in the Terms continues to apply unchanged.

15. Contact

Data-protection matters, sub-processor notifications and requests for a signed copy of this DPA: [email protected].

Neuradigi Technologies (OPC) Pvt. Ltd.
156-Upper, Evershine Mall, Malad West
Mumbai 400064, Maharashtra, India
CIN: U62099MH2024OPC431071