Data Processing Addendum

Processor means the HuskyVoiceAI legal entity identified as the contracting service provider in the applicable signed MSA or Order Form:

Either entity may enter into an MSA or Order Form. If the applicable MSA and Order Form identify different service-provider entities, those documents must expressly specify which entity is responsible for processing under this DPA.

Customer means the entity identified as customer in the Agreement. The other group entity does not automatically become a contracting party or gain access to Customer Personal Data. Any processing by it must be authorized under this DPA's affiliate and subprocessor requirements or the Customer's express written instructions.

Applicable Data Protection Law: means laws applicable to the processing, including India’s Digital Personal Data Protection Act, 2023 and its rules as their relevant provisions come into force, and the EU GDPR, UK GDPR or other privacy laws where applicable.

Personal Data: means information relating to an identified or identifiable individual.

Processing: includes collecting, transmitting, recording, analyzing, storing, accessing, disclosing, returning and deleting Personal Data.

Subprocessor: means a third party engaged by Processor to process Personal Data on the Customer’s behalf.

The Agreement, Order Form and authorized service configurations constitute instructions. Processor will inform Customer if an instruction appears to infringe Applicable Data Protection Law and may suspend the affected processing pending clarification.

Customer is responsible for lawful collection, required notices and consent or another lawful basis, lawful calling instructions, and responding to individuals. Processor is responsible for obligations applicable to its own processing role. Each party must comply with laws applicable to its own activities.

Processor will process Personal Data only to deliver the agreed services, perform customer-directed configuration and agent optimization, provide support, maintain security, prevent misuse, and meet applicable legal obligations consistently with Customer's instructions and this DPA.

Schedule A describes the default processing. An Order Form may expressly supplement or replace it.

Using identifiable Customer Personal Data or identifiable customer content for general product improvement, or to train or fine-tune a shared or general-purpose AI model, requires a separate, explicit written opt-in specifying the purpose and scope.

Use of an AI model to perform inference and produce a response is service delivery, not permission to train that model.

Processor may use anonymized operational and performance statistics that do not identify Customer or an individual to operate, secure and improve the services. Removing names alone is insufficient if a person remains identifiable. Processor will not re-identify anonymized information or use this provision to bypass restrictions on Personal Data.

Any processing needed to produce anonymized statistics remains subject to this DPA.

Processor will restrict Personal Data access to authorized persons who need access for permitted purposes and are bound by confidentiality obligations. It will maintain appropriate access controls and reasonable safeguards.

Affiliates and external providers receiving Personal Data for service delivery must be authorized under Section 6 or another express written customer instruction.

Confidentiality and processing restrictions continue while Personal Data remains in Processor's or its subprocessors' possession, including during authorized post-termination retention.

Unless the Agreement specifies another supported region, Processor-managed persistent structured data is stored in MongoDB Atlas in Mumbai, India, and recordings and files are stored in AWS in Mumbai, India.

Regional provisioning options. Where supported for the selected services and agreed in the applicable Order Form, Customer deployments may be provisioned using supported AWS regions in India, the United States, or the European Union. The specific storage region and any deployment-specific data-residency commitments will be identified in the applicable Agreement, Order Form, or processing schedule.

Encrypted backups for Processor-managed infrastructure are maintained in the same region as the applicable primary infrastructure unless otherwise expressly agreed.

Provider retention varies by service, contract and configuration. Limited inference data may be retained for abuse monitoring or other authorized service purposes under disclosed provider terms.

Zero-retention treatment applies only where explicitly confirmed for the selected service and configuration. Model inference, provider retention and model training are distinct activities; Section 3 continues to govern permitted training use.

Processor will comply with applicable transfer restrictions and use safeguards required by the law governing the relevant transfer, including approved contractual mechanisms where applicable. This DPA does not promise that one transfer mechanism satisfies every jurisdiction.

Customer generally authorizes the subprocessors disclosed in the Subprocessor List to perform necessary functions for the selected services.

The list will identify provider legal entities, functions, Personal Data categories, storage and processing countries, and applicable retention information. Optional providers and failover routes will be distinguished from those active for a particular deployment.

The Subprocessor List identifies generally available providers and processing locations. For deployments with agreed regional provisioning, Customer may request a deployment-specific record identifying the infrastructure, storage regions, processing locations, and applicable providers used for that deployment.

Processor will impose confidentiality, security and processing restrictions on subprocessors consistent with their functions and this DPA. Processor remains responsible for its subcontracted processing obligations, subject to the Agreement's applicable liability provisions.

Customer may object in writing before the change takes effect on reasonable, documented data-protection or security grounds.

The parties will work in good faith to resolve a timely objection through appropriate safeguards, configuration changes or a reasonable alternative.

If no reasonable solution is available, Customer may terminate the affected service before the objected-to change takes effect without an early-termination penalty and receive a prorated refund of prepaid fees attributable to the unused terminated service period.

Unused separately purchased prepaid usage units for that affected service will also be refunded; ordinary expiry of included allowances is otherwise governed by the Order Form. Unaffected services and charges already accrued remain payable.

Processor will maintain reasonable technical and organizational safeguards proportionate to the processing risks, including:

Processor will provide available documentation describing the implemented controls and available security-assessment evidence on reasonable request.

Testing methods, frequency and scope will be described accurately in that evidence. No certification is represented unless expressly identified as held and current. Any customer-specific security schedule supplements these commitments.

Customer remains responsible for its endpoints, user permissions, credentials, connected systems and secure configuration. This does not relieve Processor of its own obligations.

A personal data breach includes unauthorized or accidental disclosure, access, loss, destruction or alteration compromising that data's confidentiality, integrity or availability.

The first notice may be preliminary and will not await completion of an investigation. Processor will provide available information about the breach, affected data, likely consequences, containment and remediation, together with a response contact, and provide material updates as the investigation progresses.

Processor will reasonably assist Customer with applicable regulatory and individual notifications. Each party remains responsible for its own mandatory reporting obligations and applicable legal deadlines, which are not extended by this 24-hour contractual deadline.

Notification does not itself constitute an admission of liability.

Processor will reasonably assist Customer with lawful individual access, correction, deletion, restriction and portability requests, and other applicable privacy obligations, taking account of the processing and information available to Processor.

An individual's request received directly by Processor will ordinarily be referred to Customer unless law requires otherwise.

Processor will permit reasonable audits and inspections of compliance with this DPA. The parties will first use available documentary evidence where sufficient and coordinate reasonable notice, scope, confidentiality and access arrangements.

The Agreement governs any separately agreed assistance charges. These arrangements must not defeat audit rights required by Applicable Data Protection Law.

Retention follows the Order Form's express settings and the Data Retention Policy.

A purchased plan, Order Form or customer configuration may specify a shorter period. Expired records are not recoverable through an export request.

Customer may export retained data before deletion. At Customer's election, Processor will reasonably assist with return of retained Personal Data in supported standard formats and deletion, including upon termination.

Standard export and deletion certification are included; bespoke transformation, migration or development may require a separately agreed scope. No fixed export turnaround is promised unless agreed in writing.

Subject to legally required retention, primary Personal Data will be deleted within 60 days after termination and backups purged within 90 days.

Customer-directed deletion during service will follow supported settings and applicable legal requirements. Legally retained records will be restricted to the required purpose and deleted when that requirement ends.

Backups are encrypted and used for disaster recovery; if restored, applicable deletion instructions will be reapplied. Processor will provide written deletion certification once the relevant deletion is completed, identifying any lawful exception.

Processor may update this DPA to reflect law, services and operational changes, but an online update or continued use does not override signed customer-specific terms or materially reduce existing negotiated protections.

Such reductions require express written agreement. Mandatory legal requirements continue to apply, and subprocessor changes follow Section 6. Changes to fees or liability limits require the amendment mechanism in the Agreement.

The contracting entity and its notice address are those stated in the Agreement.