DPDP Readiness

India's Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 are being brought into force in stages. Customers should assess the provisions that are applicable and in force for their processing activities at the relevant time.

The applicable Customer Agreement and Data Processing Addendum govern the parties' respective processing roles where HuskyVoiceAI processes Personal Data on the Customer's behalf.

HuskyVoiceAI supports Customer-configured notice and consent workflows for use cases such as:

• Voice calls using Customer-approved notice or consent language
• Call recording and transcription notices
• Appointment booking, confirmation, rescheduling, and reminder workflows
• Lead qualification and follow-up
• Candidate screening and recruitment workflows
• WhatsApp, email, or other supported follow-up communications
• Other Customer-configured business workflows

Customers are responsible for determining the lawful purpose and lawful basis for their use case, providing required notices, obtaining consent where required, and issuing lawful calling and messaging instructions.

Where supported by the configured workflow, HuskyVoiceAI can help present Customer-approved notice language, capture consent-related responses, and maintain relevant workflow records.

Depending on Customer configuration, HuskyVoiceAI may process:

• Call audio and recordings where recording is enabled
• Transcripts and conversation summaries
• Call metadata such as caller or callee number, timestamp, duration, routing, and outcome
• Caller-provided information and appointment or workflow details
• Structured workflow outputs, tags, actions, and system updates

These data are processed for the Customer's configured business purposes and for permitted service delivery, support, security, and Customer-directed agent configuration or optimization.

Although the DPDP Act does not create a separate statutory category called "sensitive personal data," HuskyVoiceAI treats health-related communication data as higher-sensitivity information requiring appropriate care.

Healthcare workflows may involve information such as:

• Patient or caller name and phone number
• Appointment preference, booking, rescheduling, or reminder status
• Call audio, transcript, or summary where enabled
• Follow-up status and communication history
• Information voluntarily shared by the caller during the workflow

To the extent applicable DPDP provisions are in force, HuskyVoiceAI can reasonably assist Customers with supported Data Principal requests, including:

• Access to relevant Personal Data or processing information where applicable
• Correction, completion, or updating of relevant Personal Data
• Erasure or deletion, subject to lawful retention and technical limitations
• Withdrawal-of-consent workflows where processing depends on consent
• Grievance routing and Customer assistance
• Export or other supported data-return functions where applicable

Other privacy laws may provide additional rights, such as portability, restriction, or objection. Those rights apply only where the relevant law governs the processing.

Where HuskyVoiceAI acts as a Data Processor, the Customer ordinarily validates the request, verifies identity, determines applicable retention obligations, and communicates with the Data Principal. HuskyVoiceAI provides reasonable assistance based on the processing and information available to it.

Unless the applicable Agreement specifies another supported arrangement, Processor-managed persistent structured Customer Data is stored in MongoDB Atlas in Mumbai, India, and recordings and files are stored in AWS in Mumbai, India.

Where supported for the selected Services and agreed in the applicable Order Form, certain Customer deployments may be provisioned using supported AWS regions in the United States or European Union. The specific storage region and any deployment-specific data-residency commitments are identified in the applicable Agreement, Order Form, or processing schedule.

Approved AI, communications, support, monitoring, messaging, or other subprocessors may process specified data in other locations depending on the provider, configuration, and Services used. Applicable transfer restrictions and safeguards are addressed through the Customer Agreement, DPA, Subprocessor List, and deployment-specific processing information.

HuskyVoiceAI uses approved service providers to help deliver Customer-configured Services. Depending on the deployment, these may include providers for:

• Cloud infrastructure, compute, storage, and backup
• Structured data storage
• Telephony and communications
• AI inference, transcription, speech, translation, and related processing
• Messaging and integration services
• Security, monitoring, support, and operational tooling where applicable

The Subprocessor List identifies applicable provider legal entities, functions, Personal Data categories, and relevant storage or processing locations. Optional or failover providers may be distinguished from providers active in a particular deployment.

Customers with agreed regional provisioning may request a deployment-specific record identifying relevant infrastructure, storage regions, processing locations, and applicable providers.

See the current Subprocessor List and our Data Processing Addendum.

HuskyVoiceAI maintains reasonable technical and organizational safeguards proportionate to the nature of the processing and associated risks, including:

Available documentation describing implemented controls and available security-assessment evidence can be provided on reasonable request, subject to confidentiality and security restrictions. No certification is represented unless expressly identified as held and current.

Additional information is available in our Security Policy.

Customer Data retention follows the applicable Order Form, supported configuration, and Data Retention Policy.

A purchased plan, Order Form, or supported Customer configuration may specify a shorter retention period. Customer Data that has expired under the applicable retention settings may no longer be recoverable through an export request.

Customer-controlled copies stored in a connected CRM or other Customer system remain the Customer's responsibility. Carrier or subprocessor records that are subject to separate legal or operational retention requirements may follow the applicable provider's obligations.

Initial notice may be preliminary. HuskyVoiceAI will provide available information regarding the nature of the incident, affected data, likely consequences, containment, remediation, and response contacts, with material updates as the investigation progresses.

HuskyVoiceAI will reasonably assist Customers with applicable regulator and Data Principal notifications. Each party remains responsible for the legal deadlines and notification obligations applicable to its own role.

See the Data Processing Addendum for the governing contractual terms.

Where HuskyVoiceAI acts as Data Processor, privacy requests concerning Customer-controlled workflow data should ordinarily be directed to the relevant Customer as Data Fiduciary. HuskyVoiceAI will reasonably assist the Customer where required.

For privacy questions, privacy-rights assistance, or grievances relating to HuskyVoiceAI's own processing, contact:

We respond within the timeframe required by applicable law and, where no specific legal timeframe applies, within a reasonable period.

Where applicable under the DPDP framework, a Data Principal may have the right to approach the Data Protection Board of India after following the applicable grievance process.