================================================================================ DOTNITRON DATA PROCESSING ADDENDUM (DPA) TEMPLATE ================================================================================ Effective Date: [Insert Date] Between: (1) [CUSTOMER LEGAL NAME], with offices at [Customer Address] ("Customer" or "Controller"); and (2) DOTNITRON TECHNOLOGIES PRIVATE LIMITED, a company incorporated under the laws of India, with its registered office in New Delhi, India ("Dotnitron" or "Processor"). Customer and Dotnitron are individually referred to as a "Party" and collectively as the "Parties". -------------------------------------------------------------------------------- 1. BACKGROUND & SCOPE -------------------------------------------------------------------------------- 1.1 Dotnitron provides AI-powered software, forward-deployed engineering, and workflow automation products (including Underlying, Regoscope, Repdate, and custom enterprise deployments) pursuant to the principal agreement entered into between the Parties (the "Agreement"). 1.2 In delivering the Services, Dotnitron may process Personal Data on behalf of Customer. 1.3 This Data Processing Addendum ("DPA") governs all processing of Personal Data by Dotnitron on behalf of Customer in accordance with applicable Data Protection Laws, including the EU General Data Protection Regulation (GDPR), the UK Data Protection Act 2018 (UK GDPR), and the Digital Personal Data Protection Act, 2023 (India DPDP Act). -------------------------------------------------------------------------------- 2. DEFINITIONS -------------------------------------------------------------------------------- 2.1 "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", and "Processing" shall have the meanings given in applicable Data Protection Laws. Under the India DPDP Act, "Data Fiduciary" corresponds to "Controller", and "Data Principal" corresponds to "Data Subject". 2.2 "Client Data" or "Customer Data" means all data, text, files, documents, and inputs uploaded or made available by Customer to Dotnitron for processing under the Agreement. 2.3 "Sub-processor" means any third-party data processor engaged by Dotnitron to perform processing activities on Customer Data. -------------------------------------------------------------------------------- 3. ROLES AND PROCESSING INSTRUCTIONS -------------------------------------------------------------------------------- 3.1 Role of the Parties: The Parties acknowledge that Customer is the Controller (Data Fiduciary) and Dotnitron is the Processor (Data Processor) of Customer Personal Data. 3.2 Processing on Instructions: Dotnitron shall process Customer Personal Data solely on documented instructions from Customer, including regarding transfers of Personal Data, unless required to do so by applicable law. 3.3 Zero Training Commitment: Dotnitron expressly covenants that it does NOT use Customer Data (including confidential transaction files, virtual data room documents, workpapers, prompts, completions, embeddings, or analyst reviews) to train, retrain, fine-tune, or improve any public, foundational, or shared third-party AI models. -------------------------------------------------------------------------------- 4. CONFIDENTIALITY & PERSONNEL -------------------------------------------------------------------------------- 4.1 Dotnitron ensures that persons authorized to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, have passed background verifications, and have completed training in data protection and secure AI handling. -------------------------------------------------------------------------------- 5. SECURITY OF PROCESSING (TECHNICAL & ORGANIZATIONAL MEASURES) -------------------------------------------------------------------------------- 5.1 Dotnitron shall implement and maintain appropriate technical and organizational measures (TOMs) designed to ensure a level of security appropriate to the risk, as detailed in Schedule 2 (Technical & Organizational Measures). 5.2 Such measures include: (a) Tenant isolation and role-based access control (RBAC); (b) Encryption of Personal Data at rest using AES-256 and in transit using TLS 1.3; (c) Cryptographic separation of customer workspaces; (d) Per-request dynamic cryptographic nonces and strict Content Security Policies; (e) Multi-factor authentication (MFA) required for all administrative access; (f) Regular vulnerability management and automated dependency scanning. -------------------------------------------------------------------------------- 6. SUB-PROCESSORS -------------------------------------------------------------------------------- 6.1 Authorized Sub-processors: Customer grants general authorization to Dotnitron to engage the Sub-processors listed in the Dotnitron Sub-processor Directory (/sub-processors). 6.2 Notification of Changes: Dotnitron shall provide Customer at least thirty (30) days' prior written notice before engaging a new Sub-processor, providing Customer an opportunity to object on reasonable data protection grounds. 6.3 Contractual Pass-through: Dotnitron shall impose data protection terms on any Sub-processor that are no less protective than those set out in this DPA. -------------------------------------------------------------------------------- 7. ASSISTANCE & DATA SUBJECT RIGHTS -------------------------------------------------------------------------------- 7.1 Data Subject Requests: Taking into account the nature of processing, Dotnitron shall assist Customer by appropriate technical and organizational measures in fulfilling Customer's obligation to respond to requests exercising Data Subject rights (access, rectification, erasure, data portability, grievance redressal). 7.2 If a Data Subject contacts Dotnitron directly regarding Customer Data, Dotnitron shall promptly forward the request to Customer without responding directly, unless legally required. 7.3 Breach Notification: Dotnitron shall notify Customer in writing without undue delay (and in any event within 48 hours) upon becoming aware of a confirmed Personal Data Breach affecting Customer Data, and shall provide reasonable cooperation and information. -------------------------------------------------------------------------------- 8. INTERNATIONAL DATA TRANSFERS -------------------------------------------------------------------------------- 8.1 Deployment Boundaries: Where agreed in an Order Form, Dotnitron deploys Services within Customer's designated cloud tenant, virtual private cloud (VPC), or on-premise infrastructure, ensuring data remains within Customer's required geographic jurisdiction. 8.2 Transfer Safeguards: Where transfers of Personal Data from the EEA, Switzerland, or the UK to a third country occur, such transfers shall be governed by: (a) The EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 2 Controller-to-Processor); and/or (b) The UK International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (Version B1.0). -------------------------------------------------------------------------------- 9. DELETION AND RETURN OF PERSONAL DATA -------------------------------------------------------------------------------- 9.1 Upon termination or expiration of the Agreement, Dotnitron shall, at Customer's choice, delete or return all Customer Personal Data within thirty (30) days, unless applicable law requires continued storage. 9.2 Deletion encompasses PostgreSQL relational records, S3 object storage files, Qdrant vector embeddings, and cached AI traces. -------------------------------------------------------------------------------- 10. AUDITS AND ASSURANCE -------------------------------------------------------------------------------- 10.1 Dotnitron shall make available to Customer all information reasonably necessary to demonstrate compliance with this DPA, and shall allow for and contribute to audits or inspections conducted by Customer or an independent auditor mandated by Customer. ================================================================================ SCHEDULE 1: DETAILS OF PROCESSING ================================================================================ A. Subject Matter: The provision of AI software, workflow automation, and forward-deployed engineering services described in the Agreement. B. Duration: The duration of the Agreement plus the period until full deletion or return. C. Nature & Purpose: Processing customer documents, financial records, diligence items, and user queries to perform requested analysis, semantic extraction, and workpaper drafting. D. Categories of Data Subjects: Customer personnel, clients, counterparties, and reviewers. E. Types of Personal Data: Business contact details, identification data, reviewer notes, and unredacted source content contained in customer-uploaded transaction files. ================================================================================ SCHEDULE 2: TECHNICAL AND ORGANIZATIONAL MEASURES (TOMs) ================================================================================ 1. Access Control: Role-based access control, principle of least privilege, MFA on all accounts. 2. Encryption: Data encrypted in transit via TLS 1.3 and at rest via AES-256 / AWS KMS. 3. Network Security: Edge proxy middleware, strict Content-Security-Policy with per-request nonces, HSTS Preload (max-age=63072000), anti-clickjacking (DENY), nosniff. 4. Business Continuity: Automated backups, multi-region redundancy options, documented disaster recovery runbooks. 5. Vulnerability Management: Continuous automated dependency scanning, published RFC 9116 security.txt, and active Vulnerability Disclosure Policy. ================================================================================ For custom DPA execution or legal inquiries, contact: info@dotnitron.com Dotnitron Technologies Private Limited, New Delhi, India