Data Processing Addendum

2.1 The Client is the Controller and Scalric is the Processor of Personal Data. Details of Processing (subject matter, duration, nature, purpose, data types, and data subjects) are in Annex 1.

2.2 Where Scalric acts as an independent controller (for example, for its own website visitors, marketing, and recruitment), its Privacy Policy applies, not this DPA.

2.3 Where the Client is itself a processor for a third-party controller, the Client confirms it has authority to give these instructions and that Scalric acts as sub-processor.

3.1 Scalric will Process Personal Data only on the Client's documented instructions, which are the Agreement, this DPA, and configurations the Client makes in the Services, unless required to do otherwise by law (in which case Scalric will inform the Client beforehand unless legally prohibited).

3.2 Scalric will promptly inform the Client if, in its opinion, an instruction infringes Applicable Data Protection Law. Scalric is not obliged to perform an infringing instruction.

3.3 The Client is responsible for the lawfulness of Processing, including having a lawful basis and all required notices and consents (including for call recording, messaging, and automated or AI-based interaction) and for the accuracy and quality of Personal Data.

Scalric ensures that persons authorised to Process Personal Data are bound by confidentiality obligations, receive appropriate training, and access Personal Data only as needed to provide the Services.

5.1 Scalric implements and maintains appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, as described in Annex 2 and Scalric's Security page.

5.2 Scalric may update its measures provided the overall level of protection is not materially reduced.

6.1 The Client gives general written authorisation for Scalric to engage Sub-processors, including those listed in Annex 3.

6.2 Scalric will give the Client at least [30] days' prior notice of any intended addition or replacement (by email or on its sub-processor page). The Client may object on reasonable data-protection grounds within [14] days. The parties will work in good faith to resolve the objection; if unresolved, the Client may terminate the affected Services and receive a pro-rata refund of prepaid fees for the unexpired term.

6.3 Scalric imposes written data-protection obligations on each Sub-processor no less protective than this DPA and remains liable for the Sub-processor's performance to the same extent as for its own.

Taking into account the nature of the Processing, Scalric will provide reasonable assistance, through appropriate technical and organisational measures, to help the Client respond to requests to exercise data subject rights (access, correction, erasure, restriction, portability, objection, grievance redressal, and withdrawal of consent). If Scalric receives such a request directly, it will promptly forward it to the Client and not respond except to acknowledge it, unless instructed or legally required. Assistance beyond reasonable and ordinary support may be charged at Scalric's then-current rates.

8.1 Scalric will notify the Client without undue delay and no later than 48 hours after becoming aware of a Personal Data Breach affecting Client Personal Data.

8.2 The notice will, to the extent known, describe the nature of the breach, categories and approximate numbers of data subjects and records, likely consequences, and measures taken or proposed, and will be supplemented as information becomes available.

8.3 Scalric will take reasonable steps to contain and remediate the breach and cooperate with the Client's investigation and any required notifications to Supervisory Authorities (including the Data Protection Board of India) or Data Subjects. The Client decides whether and how to notify authorities and individuals, except where Scalric is itself legally required to do so.

8.4 Notification of or response to a breach is not an admission of fault or liability.

On request and at the Client's cost for non-trivial effort, Scalric will provide information reasonably required for the Client's data protection impact assessments, algorithmic or AI risk assessments, and consultations with Supervisory Authorities relating to the Services.

10.1 Scalric may Process Personal Data in the locations stated in Annex 3 and as configured by the Client.

10.2 Where Personal Data subject to EU GDPR, UK GDPR, or Swiss FADP is transferred to a country without an adequacy decision, the parties agree to the SCCs (Module Two, Controller to Processor; Module Three where the Client is a processor), incorporated by reference with the following elections: Clause 7 (docking) included; Clause 9(a) Option 2 (general authorisation), notice period per Section 6.2; Clause 11 optional language omitted; Clause 17 Option 1, governed by the law of [Ireland]; Clause 18, courts of [Ireland]; Annexes I to III completed by Annexes 1 to 3 of this DPA. For UK transfers, the UK Addendum applies, with the Tables completed by reference to this DPA, and law of England and Wales. For Swiss transfers, references to GDPR include FADP and the competent authority is the Swiss FDPIC.

10.3 For transfers out of India, the parties will comply with any restrictions notified by the Central Government under the DPDP Act, 2023.

10.4 If a transfer mechanism is invalidated, the parties will cooperate in good faith to implement an alternative lawful mechanism.

11.1 Scalric will make available to the Client information reasonably necessary to demonstrate compliance with this DPA, including its security documentation and, where available, independent audit summaries or certifications.

11.2 If the above is insufficient, or where required by a Supervisory Authority or Applicable Data Protection Law, the Client may audit Scalric's relevant controls no more than once per 12 months, on 30 days' written notice, during business hours, subject to confidentiality, a mutually agreed scope and plan, and minimal disruption. The Client bears the audit costs, including Scalric's reasonable time at its standard rates. Audits do not extend to other customers' data or to systems or information not relevant to the Services.

12.1 On termination or expiry of the Services, or earlier on the Client's written request, Scalric will, at the Client's election, return or delete all Personal Data within [30] days, and delete existing copies, unless law requires continued storage.

12.2 Backups are deleted in the ordinary backup rotation cycle, not exceeding [90] days, during which the data remains protected under this DPA.

12.3 On request, Scalric will certify deletion in writing.

13.1 Scalric will not use Client Personal Data to train or fine-tune general-purpose models for other customers or for its own products, and will not permit Sub-processors to do so, without the Client's prior written consent.

13.2 Where the Services use third-party AI model providers, those providers are Sub-processors listed in Annex 3 and operate under terms restricting use of data to providing the service (and, where available, zero or limited data-retention settings).

13.3 Where the Services involve automated decision-making or profiling, the Client remains responsible for determining the lawful basis, providing notices, and providing human review where required by law.

To the extent the CCPA or other US state privacy laws apply, Scalric is a service provider/processor and will: not sell or share Personal Data; not retain, use, or disclose it for any purpose other than the business purposes in the Agreement or outside the direct business relationship; not combine it with other data except as permitted by law; comply with applicable obligations and give the same level of privacy protection as required; notify the Client if it can no longer meet its obligations; and allow the Client to take reasonable steps to ensure compliant use and to stop and remediate unauthorised use.

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where Applicable Data Protection Law prohibits such limitation (including liability to Data Subjects and fines that cannot lawfully be reallocated).

16.1 This DPA lasts for as long as Scalric Processes Personal Data under the Agreement, and survives until deletion or return is complete.

16.2 In the event of conflict regarding Personal Data, the order of precedence is: SCCs/UK Addendum (where applicable), then this DPA, then the Agreement.

16.3 Subject to Section 10.2, this DPA is governed by the law governing the Agreement.

Data protection contact: privacy@scalric.com · [Grievance / Data Protection Officer name and email, if appointed]

Scalric maintains, at minimum, the measures below (see the Security page for detail):

• Governance: Information security policies; named security owner; annual review; risk assessments.
• Access control: Least privilege, role-based access, MFA, periodic access reviews, prompt de-provisioning.
• Encryption: TLS 1.2+ in transit; AES-256 (or equivalent) at rest; managed key storage.
• Network and system security: Segmentation, firewalls/WAF, hardened configurations, patch management, anti-malware and endpoint protection.
• Application security: Secure SDLC, code review, dependency and secret scanning, separation of environments, periodic penetration testing.
• Logging and monitoring: Centralised, tamper-resistant logs and alerting.
• Tenant segregation: Logical separation of client data and environments.
• Resilience and recovery: Encrypted backups, tested restoration, documented continuity and disaster-recovery plans.
• Incident management: Documented response plan, 48-hour client notification.
• Personnel: Confidentiality undertakings, background checks where lawful, security training.
• Physical security: Cloud data centres with ISO 27001/SOC 2 attestations; secured, access-controlled offices.
• Vendor management: Due diligence and contractual controls on Sub-processors.
• AI controls: No training on client data; output/input safeguards; access-scoped tool credentials; human escalation paths.
• Data minimisation and deletion: Retention limits; secure deletion and return at end of Services.

Signatures