Data Processing Addendum (DPA)

This Data Processing Addendum (“DPA”) supplements the Terms of Service between [[LEGAL ENTITY NAME]] (“Autometa”, the “Processor”) and the customer agreeing to those Terms (“Customer”, the “Controller” or “Data Fiduciary”). It forms part of the Terms and takes effect automatically; no signature is required.

It applies to Autometa’s processing of personal data contained in Customer Data, to the extent that processing is subject to the Digital Personal Data Protection Act, 2023 (India), the EU General Data Protection Regulation, the UK GDPR, or the Swiss Federal Act on Data Protection (together, “Applicable Data Protection Law”).

• Customer is the Data Fiduciary / Controller for all personal data it submits to or generates in its workspace, and determines the purposes and means of its processing.
• Autometa is the Data Processor for that data, and acts only on Customer’s instructions.
• For Customer’s own account, billing, session and support data, Autometa acts as Data Fiduciary in its own right, as described in the Privacy Policy. That processing is outside the scope of this DPA.

Subject matter and duration: the provision of Autometa CRM for the term of the Customer’s subscription. Nature and purpose: hosting, storage, transmission, indexing, search, analysis and AI-assisted processing as configured by the Customer. Categories of data subject: the Customer’s employees and authorised users, and its contacts, leads, customers and correspondents. Categories of personal data: as set out in Section 3 of the Privacy Policy.

Autometa shall process personal data only on the Customer’s documented instructions, unless required otherwise by law — in which case, where legally permitted, Autometa will inform the Customer before processing. The Customer’s configuration and use of the Services, together with the Terms and this DPA, constitute its complete documented instructions.

• Lawfulness: the Customer warrants that it has a lawful basis and any required consents for the personal data it submits, and that its instructions do not cause Autometa to breach Applicable Data Protection Law. This includes consents for attendance geolocation, call recording, mobile contact and call-log ingestion, and marketing communications, as set out in Section 8 of the Terms.
• Unlawful instructions: Autometa will inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend the affected processing.
• Confidentiality: Autometa ensures that personnel authorised to process personal data are bound by confidentiality obligations, and limits access to those who need it to deliver or support the Services.
• No secondary use: Autometa does not sell personal data, use it for its own marketing, or use Customer Data to train any artificial-intelligence model.

Autometa implements and maintains technical and organisational measures appropriate to the risk, described in full in the Security Centre and Section 11 of the Privacy Policy. They currently include:

• Enforced TLS on all public endpoints and APIs; HTTP-only, Secure session cookies.
• Passwords stored as bcrypt hashes; integration credentials, API tokens and two-factor secrets encrypted with AES-256-GCM at the application layer.
• Logical multi-tenant isolation: every domain table is partitioned by organisation identifier and every API path is filtered by the caller’s organisation and role permissions.
• Role-based access control, optional enforced two-factor authentication, optional IP allow-listing, session enumeration and revocation, and audit logging of administrative actions.
• Self-service data export and erasure tooling to support data-subject requests.
• [[DESCRIBE BACKUP FREQUENCY, RETENTION AND RESTORE TESTING — state only what is actually in place]].
• [[DESCRIBE STAFF ACCESS CONTROLS AND MFA ENFORCEMENT]].

These measures may be updated as the Services evolve, provided the level of security is not materially reduced.

The Customer grants general written authorisation for Autometa to engage sub-processors. The current list, with each provider’s purpose and processing region, is maintained on our Sub-processors page.

• Autometa imposes on each sub-processor data-protection obligations no less protective than those in this DPA.
• Autometa remains fully liable to the Customer for the performance of each sub-processor’s obligations.
• Notice: Autometa will give at least 30 days’ notice before a new sub-processor begins processing personal data, by updating the sub-processors page and notifying customers by email or in-product notice.
• Objection: the Customer may object on reasonable data-protection grounds within that notice period. The parties will work in good faith towards an alternative; if none is available, the Customer may terminate the affected Services and receive a refund of prepaid fees for the unused remainder of the term.

Taking into account the nature of the processing, Autometa assists the Customer in meeting its obligations to data principals and data subjects:

• Self-service: the Services include export, correction, anonymisation and workspace-deletion tooling that the Customer can operate itself. In most cases this is sufficient to satisfy a request without our involvement.
• Forwarding: if an individual contacts Autometa directly about data held in a Customer workspace, Autometa will not respond substantively but will refer them to the Customer and notify the Customer promptly.
• Further assistance: Autometa provides reasonable assistance with data protection impact assessments, prior consultations and security reviews, at the Customer’s cost where the effort is substantial.

The Customer should note the limits of erasure described in Section 10 of the Privacy Policy: erasing an individual anonymises their identity but retains associated business records in anonymised form.

On becoming aware of a personal data breach affecting Customer personal data, Autometa shall notify the Customer without undue delay, and in any event within 72 hours of becoming aware.

The notification will describe, to the extent then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where the information cannot all be provided at once, it will be supplied in phases without further undue delay.

Autometa will provide reasonable assistance to enable the Customer to meet its own notification obligations to the Data Protection Board of India, to supervisory authorities, and to affected individuals. Notification is not, and shall not be construed as, an acknowledgement of fault or liability.

Autometa’s primary infrastructure is located in India. Certain sub-processors — in particular AI, error-monitoring, email and secrets providers — process personal data in the United States or the European Union, as identified on the sub-processors page.

Where personal data originating in the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, the parties rely on the transfer mechanism made available by the relevant provider, including the European Commission’s Standard Contractual Clauses (Module Three, processor to processor) and the UK International Data Transfer Addendum, where the provider offers them.

[[CONFIRM WHICH TRANSFER MECHANISMS ARE ACTUALLY EXECUTED, AND WITH WHICH PROVIDERS. Do not assert executed SCCs that do not exist — describe the mechanism honestly or offer to execute SCCs on request.]] A customer requiring executed Standard Contractual Clauses for its own transfer assessment should write to privacy@autometa.in.

Autometa will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA and with Article 28 of the GDPR, and will contribute to audits conducted by the Customer or an independent auditor it mandates.

• In the first instance, Autometa will respond to a reasonable written security questionnaire, no more than once in any twelve-month period.
• [[INDEPENDENT ASSESSMENT: name the auditor and audit period if a completed report exists and can be shared under NDA. Delete this bullet entirely if there is no completed report — do not describe an intention to be audited as an audit.]]
• An on-site audit may be conducted where required by a supervisory authority or following a confirmed personal data breach, on 30 days’ written notice, during business hours, subject to confidentiality undertakings, and at the Customer’s cost.

On termination or expiry of the subscription, the Customer may export its data using the Services’ export tooling. Data remains available for export for 30 days after termination.

After that period, Autometa will delete the Customer’s workspace. Deletion removes the organisation record, cascades to all dependent tables, and erases the workspace’s entire object-storage prefix, including uploaded files, call recordings and generated exports. Operational backups may retain data for a further period until rotated out. Autometa may retain data where required by law, in which case it remains subject to this DPA.

Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms of Service. In the event of a conflict between this DPA and the Terms, this DPA prevails in respect of the processing of personal data.

This DPA is governed by the same law and subject to the same jurisdiction and dispute-resolution provisions as the Terms, except where Applicable Data Protection Law requires otherwise.