Data Processing Agreement

Between the Customer (the CA firm accepting the Terms and Conditions) and Cognitive Automation (the "Company") for the service CA Assist.

1. Definitions

Capitalised terms not defined here have the meaning in the Terms and Conditions.

• "Data Protection Law": the Digital Personal Data Protection Act, 2023 and rules made under it (as and when in force), the Information Technology Act, 2000 and rules made under it (including the SPDI Rules, 2011 while in force), and any other Indian law on personal data that applies.
• "Personal Data", "Data Principal", "Data Fiduciary", "Data Processor", "Personal Data Breach": as in Data Protection Law.
• "Client Data": Personal Data relating to the Customer's Clients (and their contacts) that the Company processes for the Customer in providing the Service.
• "Sub-processor": a third party engaged by the Company to process Client Data.
• "Services": the Service described in the Terms.

2. Roles and scope

2.1 For Client Data, the Customer is the Data Fiduciary and the Company is the Data Processor. The Company processes Client Data only on the Customer's behalf.

2.2 For account and business data of the Customer's own users and billing contacts, the Company is an independent Data Fiduciary and processes that data under its Privacy Policy. This DPA does not apply to that data.

2.3 Details of the processing (subject matter, duration, nature, purpose, categories of Data Principals and data) are in Annex 1.

3. Instructions

3.1 The Company will process Client Data only on the Customer's documented instructions, which are: (a) the Terms and this DPA; (b) the Customer's configuration and use of the Service (for example uploads, contact records, security levels, bot settings); and (c) other written instructions the Customer gives that are consistent with the Terms.

3.2 The Company will inform the Customer if it believes an instruction infringes Data Protection Law. The Company may suspend the affected processing until the instruction is clarified or modified.

3.3 The Company will not process Client Data for its own purposes, other than: (a) to provide, secure, support and maintain the Service; (b) to comply with legal obligations; (c) creating aggregated or de-identified data that does not identify the Customer, its Clients or any individual; and (d) as otherwise permitted by the Terms. The Company will not sell Client Data and will not use the content of Documents to train general-purpose or third-party AI models.

4. Customer's obligations

4.1 The Customer is responsible for: (a) determining the purposes and means of processing Client Data; (b) giving Data Principals the notices, and obtaining the consents or establishing another lawful basis, required by Data Protection Law, including for WhatsApp communications; (c) the accuracy and lawfulness of Client Data and instructions; (d) configuring security levels and access appropriately for the sensitivity of Documents; (e) maintaining accurate contact details and client-contact mapping; (f) responding to Data Principal requests directed to it; and (g) complying with its professional confidentiality obligations.

4.2 The Customer warrants that it has the authority to give the Company the instructions and access described in this DPA and that its use of the Service complies with Data Protection Law.

5. Confidentiality and personnel

5.1 The Company will ensure that persons authorised to process Client Data are bound by confidentiality obligations and have access only on a need-to-know basis.

5.2 The Company will provide appropriate training on data protection and security to relevant personnel.

6. Security

6.1 The Company will implement and maintain reasonable technical and organisational security safeguards appropriate to the risk, including those in Annex 2.

6.2 The Company may update its safeguards from time to time provided that it does not materially reduce the overall level of protection.

6.3 The Customer is responsible for securing its own accounts, devices and credentials and for using the Service's security features.

7. Personal Data Breach

7.1 The Company will notify the Customer without undue delay and, where feasible, within 24 hours after the Company becomes aware and reasonably confirms a Personal Data Breach affecting Client Data, so that the Customer can meet its own 72-hour reporting duty to the Data Protection Board of India.

7.2 The notice will describe, to the extent known: the nature of the breach, categories and approximate number of Data Principals and records affected, likely consequences, measures taken or proposed, and a contact point. The Company will provide further information as it becomes available.

7.3 The Company will take reasonable steps to contain and remediate the breach and will reasonably cooperate with the Customer so that the Customer can meet its obligations to the Data Protection Board of India, other authorities, and affected Data Principals.

7.4 The Customer is responsible for deciding whether and how to notify authorities and Data Principals, and for the content of such notices, except where the Company is legally required to notify. Notification of a breach is not an admission of fault or liability.

8. Sub-processors

8.1 The Customer gives general authorisation for the Company to engage Sub-processors, including those listed in Annex 3.

8.2 The Company will bind each Sub-processor by a written contract requiring data-protection obligations no less protective in substance than this DPA, and remains responsible for their performance of those obligations, subject to the limitations in the Terms.

8.3 The Company will give the Customer at least 30 days' notice (by email or in the app) before adding or replacing a Sub-processor that processes Client Data. The Customer may object on reasonable data-protection grounds within 15 days. If the parties cannot resolve the objection, the Customer's sole remedy is to stop using the affected part of the Service or terminate and receive a pro-rata refund of prepaid fees for the unused period.

9. Assistance

9.1 Taking into account the nature of processing, the Company will provide reasonable assistance, through the Service's features and support channels, to help the Customer respond to Data Principal requests (access, correction, erasure, grievance) and to meet its obligations relating to security, breach handling and, where required, assessments.

9.2 The Company will forward to the Customer any request it receives directly from a Client's Data Principal about Client Data, and will not respond substantively except as instructed or as required by law.

9.3 The Company may charge reasonable fees for assistance that goes beyond the Service's ordinary features and support, on prior notice.

10. International transfers

10.1 The Company hosts Client Data in India. Some Sub-processors (for example Meta for WhatsApp) process limited data outside India as part of delivering messages.

10.2 The Company will transfer Client Data outside India only where permitted by Data Protection Law and subject to appropriate contractual safeguards, and will comply with any restriction the Government of India imposes by notification.

11. Return and deletion

11.1 During the term, the Customer can delete Client Data and export Documents and records through the Service.

11.2 On termination or expiry, the Company will make Client Data available for export during the 60-day Export Window described in the Terms. After that, the Company will delete or irreversibly anonymise Client Data within 60 days, and clear it from backups within 90 days of deletion from live systems.

11.3 The Company may retain Client Data to the extent, and for as long as, Data Protection Law or another applicable law requires, subject to continued confidentiality and security, and will use it only for that legal purpose.

11.4 An account whose free trial ends without a paid Plan is suspended at once and closed after 60 days; its Client Data is then handled as in 11.2.

12. Audit and information

12.1 The Company will, on request and not more than once per twelve months, provide the Customer with reasonable information to show compliance with this DPA, such as its security summary, policies, questionnaire responses and, when available, summaries of third-party audits or penetration-test attestations (with technical details redacted).

12.2 If that is not reasonably sufficient, and only where required by Data Protection Law or a regulator, the Customer may audit the Company's relevant controls once per twelve months, on at least 30 days' written notice, during business hours, subject to a written scope and confidentiality agreement, without access to other customers' data or to the Company's proprietary or security-sensitive information, and at the Customer's cost. The audit must not unreasonably disrupt the Company's operations.

13. Liability

Each party's liability under this DPA is subject to the limits and exclusions in Section 15 of the Terms, which apply to the DPA and Terms taken together. Nothing limits liability that cannot lawfully be limited.

14. Term and precedence

14.1 This DPA takes effect on acceptance of the Terms and continues while the Company processes Client Data for the Customer, and afterwards for as long as the Company holds Client Data.

14.2 If there is a conflict between this DPA and the Terms regarding processing of Client Data, this DPA prevails. Otherwise the Terms prevail.

15. General

15.1 The parties will negotiate in good faith to amend this DPA if required by a change in Data Protection Law (including on commencement of the DPDP Rules' substantive provisions).

15.2 Governing law and dispute resolution are as in the Terms.

15.3 This DPA is an electronic record and is accepted by electronic click-through, which forms a valid contract under section 10A of the Information Technology Act 2000. Section 19.5 of the Terms (electronic records and evidence) applies to it.

Annex 1: Details of processing

Annex 2: Security measures (summary)

Annex 3: Authorised Sub-processors

Sub-processors of the Customer's own payment gateway (for client fee collection) are engaged by the Customer directly and are outside this Annex.