Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Aadee Infosys Ltd ("we", the processor) and the subscribing organisation ("you", the customer). It applies whenever we process personal data on your behalf through AadeeRMM. No signature is needed. If you would like a signed copy for your records, email aadeermm@aadeeinfosys.com.

1. Definitions
2. Roles
3. Instructions
4. Your obligations
5. Our personnel
6. Security
7. Sub-processors
8. Data subject requests
9. Personal data breaches
10. Impact assessments
11. International transfers
12. Information and audits
13. Return and deletion
14. Liability and precedence
15. Annex 1 — Processing details
16. Annex 2 — Security measures
17. Annex 3 — Sub-processors

1. Definitions

• "Data Protection Laws" means all laws that apply to the processing of Customer Personal Data. These include the UK GDPR and Data Protection Act 2018, the EU General Data Protection Regulation 2016/679 ("EU GDPR"), the Swiss Federal Act on Data Protection, and India's Digital Personal Data Protection Act 2023 ("DPDP Act").
• "Customer Personal Data" means personal data that we process for you as your processor in providing the Service.
• "Controller", "processor", "data subject", "personal data", "personal data breach", "processing" and "supervisory authority" have the meanings given in the GDPR. Under the DPDP Act, "Data Fiduciary" corresponds to controller and "Data Processor" to processor.

2. Roles

You are the controller of Customer Personal Data and we are your processor.

If you use the Service on behalf of your own customers, as a managed service provider does, you act as their processor and we act as your sub-processor. In that case, you confirm that your customers have authorised you to appoint us on the terms of this DPA.

The subject matter, nature, purpose and duration of the processing, and the types of data and data subjects, are set out in Annex 1.

3. Instructions

We process Customer Personal Data only on your documented instructions, including with regard to international transfers. Your instructions are:

• the Terms and this DPA;
• your configuration and use of the Service;
• any other reasonable written instructions consistent with them.

The only exception is processing that the law requires of us. In that case we will tell you first, unless the law forbids it. We will tell you if we believe an instruction breaks Data Protection Laws.

4. Your obligations

You are responsible for:

• having a lawful basis for the processing;
• giving data subjects the notices the law requires, including notice that their computers are monitored and remotely supported;
• the accuracy of Customer Personal Data;
• keeping protected health information, payment card data and special categories of data out of the Service, as section 7 of the Terms requires.

5. Our personnel

Only personnel who need access to provide, secure or support the Service may access Customer Personal Data. They are bound by confidentiality obligations.

6. Security

We implement and maintain the technical and organisational measures described in Annex 2, as Article 32 GDPR requires. They are appropriate to the risk and take into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing. We may update the measures, provided the overall level of protection is not reduced.

7. Sub-processors

• You give general authorisation for us to use sub-processors. Those currently in use are listed in Annex 3.
• We will tell you at least 30 days before adding or replacing a sub-processor, by email to subscription Owners and by updating Annex 3.
• You may object on reasonable data protection grounds within that period, and we will work with you in good faith to resolve it. If we cannot, you may terminate the affected part of the Service. We will then refund fees you paid in advance for the unused period.
• We impose on each sub-processor, by written contract, data protection obligations no less protective than those in this DPA, and we remain fully liable to you for its performance.

8. Data subject requests

The Service gives you tools to access, correct, export and delete Customer Personal Data. Taking into account the nature of the processing, we will also give you reasonable assistance in responding to requests from data subjects exercising their rights. If we receive such a request directly, we will pass it to you without undue delay and will not respond ourselves except to direct the person to you, unless you authorise us to.

9. Personal data breaches

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. As far as it is available, we will tell you:

• the nature of the breach;
• the categories and approximate number of data subjects and records concerned;
• the likely consequences;
• the measures taken or proposed.

We will send further information as it becomes available, take reasonable steps to contain the breach and limit its effects, and cooperate with you in meeting your own notification obligations. A notification is not an admission of fault.

10. Impact assessments and consultations

Taking into account the nature of the processing and the information available to us, we will give you reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, under Articles 35 and 36 GDPR.

11. International transfers

The Service is hosted in India. Our sub-processors' locations are listed in Annex 3.

• EEA. For transfers of Customer Personal Data from the EEA to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("SCCs") are incorporated into this DPA by reference, as follows:
  • Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) where you are a processor;
  • the optional Clause 7 (docking clause) applies;
  • in Clause 9, Option 2 (general written authorisation) applies, with the notice period in section 7 of this DPA;
  • the optional wording in Clause 11 does not apply;
  • in Clause 13, the competent supervisory authority is the one determined by that clause;
  • in Clauses 17 and 18, the law and courts of Ireland apply;
  • Annexes I, II and III of the SCCs are completed by Annexes 1, 2 and 3 of this DPA.
• United Kingdom. For transfers from the UK, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0) applies and is incorporated by reference, completed with the details in this DPA. Either party may end it as allowed by its Section 19.
• Switzerland. For transfers from Switzerland, the SCCs apply with the adaptations required by the Swiss Federal Act on Data Protection. References to the GDPR are read as references to that Act, and the Federal Data Protection and Information Commissioner is the competent authority.
• India. Under the DPDP Act, we act as your Data Processor under this contract and process Customer Personal Data only to provide the Service.

If the SCCs conflict with this DPA, the SCCs prevail.

12. Information and audits

We will make available the information you reasonably need to demonstrate compliance with Article 28 GDPR and this DPA. This includes our Security & compliance page and written answers to reasonable security questionnaires.

Where that information is not enough, or a supervisory authority requires it, you may audit our compliance yourself or through an independent auditor bound by confidentiality, on these conditions:

• no more than once in any 12 months, unless there has been a personal data breach or a supervisory authority requires more;
• with at least 30 days' notice;
• during business hours and at your cost;
• in a way that does not compromise the security of the Service or the data of other customers.

13. Return and deletion

When the Service ends, you may export Customer Personal Data for 30 days. We then delete it within 30 days, and copies in our backups are overwritten within a further 14 days. The only exception is data that the law requires us to keep, which we keep confidential and process only for that purpose. We will confirm deletion in writing on request.

14. Liability, precedence and healthcare data

Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Laws or the SCCs do not allow this. For data protection matters, this DPA prevails over the Terms.

This DPA is not a HIPAA Business Associate Agreement, and the Service must not be used to process protected health information.

Annex 1 — Details of the processing

Annex 2 — Technical and organisational security measures

• Access control:
  • two-factor authentication required for every technician; Microsoft and Google single sign-on available;
  • passwords checked against known breaches;
  • role-based access from Owner to read-only, with technicians limited to the customers they are assigned;
  • each subscriber's data separated from every other's.
• Encryption:
  • TLS for all traffic, including agent connections, with HTTP Strict Transport Security;
  • secrets (two-factor keys, stored passwords, API, payment and storage keys, Microsoft tokens, device backup keys) encrypted at rest with keys held only on our servers;
  • screen recordings encrypted;
  • device backups encrypted on the computer before upload;
  • database replication between our servers runs only inside an encrypted tunnel.
• Logging and accountability: a tamper-evident audit log records sensitive actions, including remote sessions, commands, file transfers and changes to settings.
• Transparency to end users: users see a notice whenever someone is connected and can end a session themselves. Consent prompts protect sessions, chats and calls.
• Secure software:
  • the agent and its updates are code-signed by Aadee Infosys Ltd and checked by signature and checksum before installation;
  • the agent only connects out and opens no listening ports;
  • dependencies are kept up to date, and security fixes are prioritised.
• Infrastructure:
  • the database is not reachable from the internet;
  • application services run in containers as unprivileged users;
  • only the web proxy accepts connections;
  • strict security headers are set;
  • administrative access to servers is restricted to authorised staff.
• Availability and resilience:
  • a standby server at a second location keeps a continuously replicated copy of the database and takes over automatically if the primary fails;
  • daily backups are kept for 14 days.
• Data minimisation and deletion:
  • terminal output is not stored;
  • voice calls are never recorded;
  • transferred files are deleted after delivery, within 1 hour at the latest;
  • recordings are deleted after the customer's retention period;
  • AI features run on our own servers and do not send data to outside AI providers.
• Incident response: incidents are investigated and contained, and personal data breaches are notified as described in section 9.
• Suppliers: sub-processors are chosen with care and bound by written data protection terms.

How these measures map to ISO/IEC 27001:2022 and the NIST Cybersecurity Framework 2.0 is shown on our Security & compliance page.

Annex 3 — Sub-processors

Our standby server is our own equipment, operated by Aadee Infosys at a second location in India. Payment providers (Razorpay, Stripe) process billing data for which we are the controller, so they are listed in our Privacy Policy. Services that you connect yourself, such as Microsoft 365 or your own mail server or storage, are your choice and not our sub-processors.