Data Processing Addendum

Scope and roles

This Data Processing Addendum ("DPA") forms part of the agreement between PYD ENTERPRISES PRIVATE LIMITED and Customer for PYD ENTERPRISES software licenses and support. It applies where PYD ENTERPRISES processes personal data on Customer's behalf as a processor (or data processor under India's Digital Personal Data Protection Act, 2023).

Because PYD ENTERPRISES software is deployed and operated by Customer inside Customer's own data center or private cloud account, PYD ENTERPRISES does not host, access or process the source code, outputs or business data in a Customer deployment. Processing under this DPA is limited to: - personal data of Customer's users held in license administration (names, work emails, seat assignments); - personal data Customer chooses to include in support tickets, diagnostic bundles or files shared with PYD ENTERPRISES support; - personal data of Customer staff that PYD ENTERPRISES architects encounter while assisting on-site or over a screen share, at Customer's direction.

Processing instructions

PYD ENTERPRISES processes Customer personal data only on Customer's documented instructions, which are the agreement, this DPA and any written instructions Customer gives through support. PYD ENTERPRISES will tell Customer if it believes an instruction infringes applicable data protection law.

During on-site or remote assistance, PYD ENTERPRISES personnel work inside Customer's environment using Customer-issued accounts and do not copy source code, extracted rules or data to PYD ENTERPRISES systems.

Confidentiality and security measures

PYD ENTERPRISES personnel are bound by written confidentiality obligations. PYD ENTERPRISES maintains the technical and organizational measures described in its SOC 2 Type II report and ISO 27001 Statement of Applicability, including: - single sign-on with phishing-resistant multi-factor authentication for all internal systems; - encryption of personal data in transit (TLS 1.2 or higher) and at rest (AES-256); - role-based, least-privilege access to support systems, reviewed quarterly; - background checks for employees with access to customer support data, where local law permits; - security awareness training at hire and annually.

Subprocessors

Customer gives general authorization for PYD ENTERPRISES to engage the subprocessors listed on the subprocessors page. PYD ENTERPRISES will give at least 30 days' notice of a new subprocessor by updating that page and emailing subscribed customers; Customer may object on reasonable data protection grounds, and if the parties cannot resolve the objection Customer may terminate the affected service and receive a pro-rata refund. PYD ENTERPRISES remains responsible for its subprocessors' performance.

Personal data breaches

PYD ENTERPRISES will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer personal data. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records affected, likely consequences, and the measures taken or proposed. PYD ENTERPRISES will cooperate with Customer's own notification obligations, including to the Data Protection Board of India where applicable.

Data subject requests, audits and transfers

PYD ENTERPRISES will assist Customer, by appropriate technical and organizational measures, in responding to requests from data subjects or data principals. PYD ENTERPRISES makes its SOC 2 Type II report and ISO 27001 certificate available under NDA; where those are not sufficient for a regulator's requirement, Customer may conduct an audit once per year on 30 days' notice, at Customer's cost.

Transfers of personal data from the EEA, UK or Switzerland are governed by the Standard Contractual Clauses (Module 2 or 3 as applicable) and the UK Addendum, incorporated by reference.

Deletion and return

On termination PYD ENTERPRISES will delete Customer personal data in support and license systems within 90 days, except where retention is required by law (for example invoice records), in which case it remains protected by this DPA. A signed copy of this DPA is available from legal@pydenterprises.com.