Data Processing Agreement

This Data Processing Agreement (the "DPA") is between the business that uses Kredoo (the "Client") and [ElevAIte Labs, full legal entity name and registered address to be confirmed] ("ElevAIte Labs", "we", "us"). It forms part of the Terms of Service. A workspace admin accepts it on behalf of the Client at signup or when asked in the app.

1. Roles

For personal data of the Client's contacts (its leads, customers, patients, guests and anyone else it communicates with through Kredoo), the Client is the Data Fiduciary and ElevAIte Labs is the Data Processor, as those terms are used in India's Digital Personal Data Protection Act, 2023 and the rules made under it (together, "Data Protection Law"). Words defined in Data Protection Law have the same meaning here.

2. What we process, and why

Details are in Annex A. In short: we store and process the Client's contact data only to provide Kredoo to the Client, which includes keeping conversations so the Client has an inbox and history, running the flows, campaigns, reminders and AI replies the Client sets up, and keeping the service secure and supported.

3. We act only on the Client's instructions

• We process the Client's personal data only on the Client's documented instructions. The Client's configuration of Kredoo (which channels it connects, which flows and AI features it switches on, what it imports or deletes) and these terms are its instructions.
• We will not use the Client's contact data for our own purposes, sell it, or combine it with other customers' data.
• If we believe an instruction breaks Data Protection Law, we will tell the Client.

4. The Client's responsibilities

The Client confirms that it:

• has a lawful basis, normally consent, for every contact whose data it puts into Kredoo, and has given those people the notice Data Protection Law requires;
• has each contact's opt-in to be messaged on WhatsApp as required by Meta's WhatsApp Business Messaging Policy, keeps a record of it, and honours opt-outs;
• follows Meta's Instagram and Platform policies for Instagram messaging;
• puts into Kredoo only the personal data it needs, and does not store sensitive data (health details, financial account numbers, government ID numbers, children's data) unless genuinely needed and lawfully obtained;
• if it is a health business, takes extra care with clinical information and does not use AI features to give diagnoses or medical advice;
• obtains verifiable parental consent before processing any child's data;
• answers its contacts' requests to access, correct or erase their data, or withdraw consent.

5. Confidentiality

Everyone at ElevAIte Labs who can access Client personal data is bound by confidentiality obligations and accesses it only as needed to provide, secure or support the service.

6. Security

We maintain the technical and organisational measures in Annex B, appropriate to the risk. We may improve them over time but will not reduce the overall level of protection.

7. Sub-processors

• The Client gives general authorisation for us to use the sub-processors listed in Annex C.
• We will give the Client at least [30 days'] notice (by email or in the app) before adding or replacing a sub-processor. If the Client objects on reasonable data protection grounds, we will discuss it in good faith; if we cannot resolve it, the Client may end the affected service and receive a pro-rata refund of prepaid fees for it.
• We impose data protection obligations on each sub-processor that are no less protective than this DPA, and remain responsible for their performance.

8. Processing outside India

Some sub-processors, in particular AI providers, may process data outside India. AI features are switched on by the Client. We will not transfer personal data to any country the Government of India restricts by notification under Data Protection Law.

9. Personal data breaches

• If we become aware of a personal data breach affecting the Client's personal data, we will notify the Client without undue delay and in any case within [72 hours] of becoming aware of it.
• The notice will describe, as far as we know at the time, what happened, the data and people likely affected, the likely consequences, and what we are doing about it. We will update the Client as we learn more.
• The Client, as Data Fiduciary, is responsible for notifying the Data Protection Board of India and affected people. We will give the Client the information and help it reasonably needs to do so.

10. Helping the Client

Taking into account the nature of the processing, we will help the Client:

• respond to requests from its contacts, mainly by providing tools in Kredoo to find, export, correct and delete a contact's data, and by passing on any request we receive directly;
• meet its security, breach notification and other obligations under Data Protection Law.

11. Deletion and return

• The Client can delete contacts and conversations in Kredoo at any time, and can export its data before closing its workspace.
• When the Client's workspace is closed, we delete the Client's personal data within [90 days], and copies in backups expire within [35 days] after that, unless the law requires us to keep it. [ENGINEERING TO CONFIRM these periods match actual practice.]
• Records of the Client's acceptance of these documents are kept as evidence for as long as the law allows or requires.

12. Information and audits

On reasonable written request, and not more than once a year unless required by a regulator or after a breach, we will provide information needed to show compliance with this DPA, such as a description of our security measures and our sub-processor list. We do not currently hold third-party security certifications. Any on-site audit must be agreed in advance, at the Client's cost, and must protect other customers' data and our confidential information.

13. Term, liability and order of precedence

This DPA lasts as long as we process the Client's personal data. Liability under this DPA is subject to the limits in the Terms of Service. If this DPA conflicts with the Terms on the processing of personal data, this DPA wins.

Annex A: Details of processing

Annex B: Security measures

• Encryption in transit: all connections to Kredoo use HTTPS/TLS, including connections between our application and its database where supported.
• Credentials at rest: WhatsApp and Instagram access tokens, AI provider keys, API keys and webhook secrets are stored encrypted or hashed.
• Passwords: stored only as one-way salted hashes.
• Conversations at rest: [We encrypt stored conversations at rest. LAWYER AND ENGINEERING TO CONFIRM BEFORE LAUNCH: include this line only if at-rest encryption of conversations has shipped. Until then, state that stored data relies on the hosting provider's infrastructure controls.]
• Tenant separation: every query is scoped to the Client's workspace.
• Access control: role-based access inside each workspace (admins and members), with members limited to the leads assigned to them where the Client sets that up; sign-in rate limits and lockouts; sign out of all devices.
• Accountability: an audit log of sensitive actions, and signature checks on incoming webhooks from Meta.
• Staff access: limited to people who need it to operate and support the service.
• Backups: regular backups of the database. [ENGINEERING TO CONFIRM frequency and retention.]

Annex C: Sub-processors

Other AI providers may be added when the Client configures them in its own AI settings. In that case the Client chooses the provider and accepts that provider's terms.