Snapshot 171378
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Products Company Resources Solution Manifest AI Book a demo Data processing addendum - BIK This Data Processing Addendum (“DPA”) forms an integral part of the Company’s Terms of Use, available at https://bik.ai/bik-terms, the master service agreement or similar agreement (including any exhibits, appendices, annexes, terms, orders or policies referenced therein) (“Agreement”), entered into by and between Bikayi, Inc. (the “Company”) and Customer that governs Customer’s use and Company’s provision of Company’s Services (identified either as “Services” or otherwise in the applicable agreement, and hereinafter defined as “Services”) to reflect the parties’ agreement with regard to the Processing of Personal Data. By signing the Agreement, Customer enters into this DPA on behalf of itself and, to the extent required under applicable Data Protection Laws and Regulations, in the name and on behalf of its Authorised Affiliates, if and to the extent Bikayi, Inc. processes Personal Data for which such Authorised Affiliates qualify as the Controller. For the purposes of this DPA only, and except where indicated otherwise, the term "Customer" shall include Customer and Authorised Affiliates. All capitalised terms not defined herein shall have the meaning set forth in the Agreement. In the course of providing the Services to Customer pursuant to the Agreement, Company may Process Personal Data on behalf of Customer, and the Parties agree to comply with the following provisions with respect to any Personal Data, each acting reasonably and in good faith. For the avoidance of doubt, each reference to the DPA in this DPA means this DPA including its Schedules. Data Processing Terms 1. Definitions Affiliate means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. Control, for purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity. Authorized Affiliate means any of Customer's Affiliate(s) which (i) is subject to the data protection laws and regulations of the European Union, the European Economic Area and/or their member states, and (ii) is permitted to use the Services pursuant to the Agreement between Customer and Company. CCPA means the California Consumer Privacy Act 2018, Cal. Civ. Code § 1798.100 et seq., and its implementing regulations, as the same may be amended from time to time. Controller means the entity which determines the purposes and means of the Processing of Personal Data. Customer Data means all electronic data or information submitted by or on behalf of Customer to, or collected from the Customer by Company. Data Protection Laws and Regulations means all laws and regulations, including GDPR and CCPA, as well as other similar applicable worldwide data protection laws applicable to a party in its use or provision of the Services, in connection with the Processing of Personal Data under the Agreement. Data Subject means the identified or identifiable natural person to whom Personal Data relates. Data Subject right means any right afforded to a Data Subject under Data Protection Laws and Regulations, including the rights to access, rectify, restrict the Processing of Personal Data, erasure (including the right to be forgotten), data portability, objecting to the Processing, or to not be subject to an automated individual decision making. GDPR means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). Personal Data means any information relating to an identified or identifiable natural person where such data is Customer Data. Processing means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Processor means the entity which Processes Personal Data on behalf of the Controller Personal Data Breach means a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data, transmitted, stored or otherwise Processed by Company or its Sub-processors of which the Company becomes aware. Security, Privacy and Architecture Datasheet means the Security, Privacy and Architecture Datasheet for the Company Services, as updated from time to time. Standard Contractual Clausesmeans the agreement by and between Customer and Bikayi, Inc. pursuant to the European Commission's decision on Standard Contractual Clauses for the transfer of personal data to processors established in third countries which do not ensure an adequate level of data protection, a copy of which can be found at https://bik.ai/scc Sub-processor means any Processor engaged by the Company or its Affiliates engaged in the Processing of Personal Data. 2. Processing of personal data 2.1 Details of the Processing. The parties acknowledge and agree that with regard to the Processing of Personal Data, Customer is the Controller, Company is the Processor and that Company, or its Affiliates engaged in the Processing of Personal Data will engage Sub-processors pursuant to the requirements set forth in Section 5 Sub-processors below. The subject-matter of Processing of Personal Data by Company is the performance of the Services pursuant to the Agreement. The duration of the Processing, the nature and purpose of the Processing, the types of Personal Data and categories of Data Subjects Processed under this DPA are further specified in Schedule 3 (Details of the Processing) to this DPA. 2.2 Customer's Processing of Personal Data. Customer shall, in its use of the Service, Process Personal Data in accordance with the requirements of Data Protection Laws and Regulations. For the avoidance of doubt, Customer's instructions for the Processing of Personal Data shall comply with Data Protection Laws and Regulations. This DPA and the Agreement are, Customer's complete and final documented instructions to Company for the Processing of Personal Data, and Customer's configuration of the Services shall constitute an additional instruction to Company. Any additional or alternate instructions must be agreed upon separately. Customer shall have sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Customer acquired the Personal Data 2.3 Company's Processing of Personal Data. Company shall treat Personal Data as Confidential Information and shall only Process Personal Data on behalf of Customer and in accordance with Customer's documented instructions for the following purposes: (i) Processing in accordance with the Agreement; (ii) Processing initiated by Users in their use of the Services; and (iii) Processing to comply with other documented reasonable instructions provided by Customer (e.g., via email) where such instructions are consistent with the terms of the Agreement. Company will Process Personal Data in compliance with applicable Data Protection Laws and Regulations, provided however that Company shall not be in violation of this contractual obligation in the event that Company's Processing of Personal Data in non-compliance with applicable Data Protection Laws and Regulations is due to Customer. 2.4 Customer warranty and representation Customer warrants and represents that its instruction to Process Personal Data shall at all times comply with Data Protection Laws and Regulations. Customer shall be solely responsible for the legality of the Personal Data and for ensuring it has an appropriate lawful basis to enable the collection and Processing of Personal Data pursuant to the terms of the Agreement and this DPA. 3. Rights of data subjects 3.1 Data Subject requests. Customer shall be solely responsible for compliance with any statutory obligations concerning requests to exercise Data Subject rights under Data Protection Laws (e.g., for access, rectification, or deletion of Customer Personal Data etc.). Taking into account the nature of the Processing, Company shall reasonably assist Customer insofar as feasible, to fulfil Customer's said obligations with respect to such Data Subject requests, as applicable, at Customer's sole expense. 3.2 Company: (a) shall promptly notify Customer if it receives a request from a Data Subject under any Data Protection Law in respect of Customer Personal Data (unless prohibited by applicable law); and (b) shall not respond to that request except on the documented instructions of Customer or as required by applicable laws. Notwithstanding the foregoing, Company shall be permitted to respond (including through automated responses) to any such requests informing the Data Subject that his request has been received and/or with instructions to contact Customer in the event that his request relates to Customer. 4. Company personnel 4.1 Confidentiality. Company shall ensure that its personnel engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data, have received appropriate training on their responsibilities and have executed written confidentiality agreements. Company shall ensure that such confidentiality obligations survive the termination of the personnel engagement. 4.2 Reliability. Company shall take commercially reasonable steps to ensure the reliability of any Company personnel engaged in the Processing of Personal Data. 4.3 Limitation of Access. Company shall ensure that Company's access to Personal Data is limited to those personnel performing Services in accordance with the Agreement. 5. Sub-processors 5.1 Appointment of Sub-processors. Customer acknowledges and agrees that (a) Company's Affiliates may be retained as Sub-processors; and (b) Company and Company's Affiliates respectively may engage third-party Sub-processors in connection with the provision of the Services. Company or a Company Affiliate has entered into a written agreement with each Sub- processor containing data protection obligations not less protective than those in this DPA with respect to the protection of Personal Data to the extent applicable to the nature of the Services provided by such Sub-processor. 5.2 List of Current Sub-processors and Notification of New Sub-processors. Attached hereto as Schedule 2 is a current list of Sub-processors for the Services. Such Sub-processor list shall include the identities of those Sub-processors, their country of location as well as the type of processing they perform. The Company may appoint new Sub Processors at any time and shall update the Sub Processors Website upon such appointments. 5.3 Objection Right for New Sub-processors. Customer may object to Company's use of a new Sub-processor by notifying Company promptly in writing of any reasonable objections to the proposed appointment within ten (10) business days of such notice. The Company shall not utilise such Sub-processor to process the Customer Personal Data until reasonable steps have been taken to address the objections raised by Customer, and Customer has been provided with a reasonable written explanation of the steps taken. Where such steps are not sufficient to relieve Customer's reasonable objections then Customer or Company may, by written notice to the other party, with immediate effect, terminate the Agreement to the extent that it relates to the Services which require the use of the proposed Sub Processor, without bearing liability for such termination. 5.4 Liability for Sub-processors. Company shall be liable for the acts and omissions of its Sub-processors to the same extent Company would be liable if performing the services of each Sub-processor directly under the terms of this DPA. 6. Security 6.1 Controls for the Protection of Customer Data. Company shall maintain appropriate technical and organisational measures for protection of the security (including protection against Personal Data Breach), confidentiality and integrity of Customer Data, as set forth in the Security, Privacy and Architecture Datasheet attached hereto as Schedule 1. Company regularly monitors compliance with these measures. Customer is responsible for reviewing the information made available by Company relating to data security and making an independent determination as to whether the Services meet Customer's requirements and legal obligations under Data Protection Laws and Regulations. Customer acknowledges that the security measures described within the Security, Privacy and Architecture Datasheet are subject to technical progress and development and that Company may update or modify such documents from time to time provided that such updates and modifications do not result in a material decrease of the overall security of the Services during a subscription term. 6.2 Customer Data Incident Management and Notification. Company maintains security incident management policies and procedures specified in the Security, Privacy and Architecture Datasheet and shall notify Customer without undue delay after becoming aware of a Personal Data Breach. Company shall provide information to Customer necessary to enable Customer to comply with its obligations under Data Protection Laws and Regulations. The content of such communication to Customer will (i) include the nature of Processing and the information available to Company, and(ii) take into account that under applicable Data Protection Laws and Regulations, Customer may need to notify regulators or individuals of the following: (a) a description of the nature of the Personal Data Breach including, where possible, the categories and approximate number of individuals concerned, and the categories and approximate number of Personal Data records concerned; (b) a description of the likely consequences of the Personal Data Breach; and (c) a description of the measures taken or proposed to be taken to address the Personal Data Breach, including, where appropriate, measures to mitigate its possible adverse effects. Company shall make commercially reasonable efforts to identify the cause of such Personal Data Breach and take those steps as Company deems necessary and reasonable in order to remediate the cause of such Personal Data Breach to the extent the remediation is within Company's reasonable control. The obligation to remediate the cause of a Personal Data Breach shall not apply to Personal Data Breaches that are caused by Customer or Customer's Users.At the written request of the Customer, Company shall reasonably cooperate with Customer and take such commercially reasonable steps, as are agreed by the parties or necessary under Data Protection Laws, to assist in the investigation, mitigation and remediation of each such Personal Data Breach, at Customer's sole expense. 6.3 Third-Party Certifications and Audits. Company has obtained the third-party certifications and audits set forth in the Security, Privacy and Architecture Datasheet. Upon Customer's written request at reasonable intervals, and subject to the confidentiality obligations set forth in the Agreement, Company shall allow for and contribute to audits and inspections (Audits) conducted by Customer (or Customer's independent, third-party auditor that is not a competitor of Company and that is subject to confidentiality obligations substantially similar to those set forth in the Agreement), by providing any information regarding Company's compliance with the obligations set forth in this DPA in the form of a copy of Company's then most recent third-party audits or certifications, as applicable. Customer may perform an Audit remotely or on-site, up to one (1) time per year, with at least three (3) weeks' advance written notice, unless otherwise required by Customer's regulators or applicable law. If Customer requests an on-site Audit, the following terms shall apply: (a) such Audit shall be limited to facilities operated by Company and shall not exceed one (1) business day; (b) before the commencement of any such on-site Audit, Customer and Company shall mutually agree upon the scope and timing of the Audit; (c) Customer shall reimburse Company for actual expenses and costs incurred in connection with such Audit.Customer shall use (and ensure that each of its mandated auditors uses) its best efforts to avoid causing any damage, injury or disruption to Company's premises, equipment, personnel and business while its personnel are on those premises in the course of such an audit or inspection. All such audits shall be subject to the confidentiality obligations set forth in the Agreement. Additionally, Company need not give access to its premises for the purposes of such an audit or inspection: (a) to any individual unless he or she produces reasonable evidence of identity and authority; (b) to any competitor of Company or (c) outside Company's normal business hours. 7. Return and deletion of customer data Company shall return or make available to Customer the Personal Data per the terms of the Agreement, or if no such terms are provided then immediately prior to termination of the Agreement. Following termination of the Agreement, Personal Data shall be deleted or otherwise made unrecoverable and/or anonymized, other than such copies, as authorised under the Agreement or this DPA, or required, to be retained in accordance with applicable law and/or regulation. 8. Authorised affiliates 8.1 Relationship between Company and Customer's Authorised Affiliates. The parties acknowledge and agree that, by executing the Agreement, the Customer enters into this DPA on behalf of itself and, as applicable, in the name and on behalf of its Authorised Affiliates, thereby establishing an independent DPA between Company and each such Authorised Affiliate, subject to the provisions of the Agreement and this Section 8 and Section 9. Each Authorised Affiliate agrees to be bound by the obligations under this DPA and, to the extent applicable, the Agreement. For sake of clarity, an Authorised Affiliate is not and does not become a party to the Agreement and is only a party to this DPA. All access to and use of the Services by Authorised Affiliates must comply with the terms and conditions of the Agreement and any violation of the terms and conditions of the Agreement by an Authorised Affiliate shall be deemed a violation by Customer. 8.2 Communication. The Customer that is the contracting party to the Agreement shall remain responsible for coordinating all communication with the Company under this DPA and be entitled to make and receive any communication in relation to this DPA on behalf of its Authorised Affiliates. 8.3 Rights of Authorised Affiliates. Where an Authorised Affiliate executes a DPA with Company, it shall to the extent required under applicable Data Protection Laws and Regulations, be entitled to exercise the rights and seek remedies under this DPA, subject to the following: 8.3.1 Except where applicable Data Protection Laws and Regulations require the Authorised Affiliate to exercise a right or seek any remedy under this DPA against Company directly by itself, the parties agree that (i) solely the Customer that is the contracting party to the Agreement shall exercise any such right or seek any such remedy on behalf of the Authorised Affiliate, and (ii) the Customer that is the contracting party to the Agreement shall exercise any such rights under this DPA not separately for each Authorised Affiliate individually but in a combined manner for all of its Authorised Affiliates together. 8.3.2 The parties agree that the Customer that is the contracting party to the Agreement shall, when carrying out an on-site Audit, take all reasonable measures to limit any impact on Company and its Sub-Processors by combining, to the extent reasonably possible, several Audit requests carried out on behalf of different Authorised Affiliates in one single Audit. 9. Limitation of liability Each party's and all of its Affiliates' liability, taken together in the aggregate, arising out of or related to this DPA, and all DPAs between Authorised Affiliates and Company, whether in contract, tort or under any other theory of liability, is subject to the 'Limitation of Liability' as set out below, and any reference in such section to the liability of a party means the aggregate liability of that party and all of its Affiliates under the Agreement and all DPAs together. Limitation of Liability. TO THE EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY'S LIABILITY WITH RESPECT TO ANY SINGLE INCIDENT ARISING OUT OF OR RELATED TO THIS DPA WILL EXCEED THE AMOUNT PAID OR PAYABLE BY CUSTOMER HEREUNDER IN RESPECT OF THE TWELVE-MONTH SUBSCRIPTION TERM IN WHICH THE INCIDENT GIVING RISE TO LIABILITY OCCURRED, PROVIDED THAT IN NO EVENT SHALL EITHER PARTY'S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT, WHETHER IN CONTRACT, TORT OR UNDER ANY OTHER THEORY OF LIABILITY, EXCEED THE TOTAL AMOUNT PAID BY CUSTOMER HEREUNDER. THE ABOVE LIMITATIONS WILL NOT LIMIT CUSTOMER'S PAYMENT OBLIGATIONS HEREUNDER. Exclusion of Indirect Damages.s IN NO EVENT SHALL EITHER PARTY HAVE ANY LIABILITY TO THE OTHER PARTY FOR ANY LOST PROFITS OR FOR ANY INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, CONSEQUENTIAL OR COVER DAMAGES OF ANY KIND OR NATURE HOWEVER CAUSED AND, WHETHER IN CONTRACT, TORT OR UNDER ANY OTHER THEORY OF LIABILITY, WHETHER OR NOT THE PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THE FOREGOING DISCLAIMER WILL NOT APPLY TO THE EXTENT PROHIBITED BY LAW. 10. European specific provisions 10.1 Data Protection Impact Assessment. Upon Customer's request, Company shall provide Customer with reasonable cooperation and assistance needed to fulfil Customer's obligation under the GDPR to carry out a data protection impact assessment related to Customer's use of the Services, to the extent Customer does not otherwise have access to the relevant information, and to the extent such information is available to Company. Company shall provide reasonable assistance to Customer in the cooperation or prior consultation with the Supervisory Authority (as defined in the GDPR) in the performance of its tasks relating to this Section 10.1 of this DPA, to the extent required under the GDPR. 10.2 Infringing instructions. Company shall immediately inform the Customer if, in its opinion, an instruction infringes GDPR. 10.3 Transfer mechanism(s) for data transfers. As of the Effective Date of this DPA, with regard to any transfers of Personal Data under this DPA from the European Union, Switzerland, the European Economic Area and/or their member states and the United Kingdom to countries which do not ensure an adequate level of data protection within the meaning of Data Protection Laws and Regulations of the foregoing territories, to the extent such transfers are subject to such Data Protection Laws and Regulations, Company makes available the following transfer mechanism(s) which shall apply, in the order of precedence as set out below, if applicable: The EU-US and Swiss-US Privacy Shield frameworks, so long as Company remains self-certified to such frameworks; The Standard Contractual Clauses, in accordance with the following terms: 2.For purposes of the SCC, when and as applicable, Customer and any applicable Authorised Affiliates are each the data exporter, and Customer's signing of this DPA or an Agreement referencing this DPA, or a Customer's Affiliate signing an Order Form under an Agreement referencing this DPA, shall be treated as signing of the SCC and their appendices. Company's signature of this DPA or an Agreement referencing this DPA shall be treated as signing of the SCC and their appendices Details required under the SCC's Appendix 1 are available in Schedule 3 to this DPA and under the SCC's Appendix 2 are outlined in Schedule 1 to this DPA. In the event of any conflict or inconsistency between this DPA and the SCC, the SCC shall prevail. Section 5 of this DPA represents Customer's express consent regarding existing and new Sub-processors under Clause 5(h) of the SCC. Copies of the Sub-processor agreements that must be provided by Company to Customer pursuant to Clause 5(j) of the SCC may have all commercial information, or clauses unrelated to the SCC or their equivalent, removed by Company beforehand; such copies will only be provided by Company upon request by Customer. Audits pursuant to Clause 5(f) and Clause 12(2) of the SCC shall be carried out in accordance with Section 6.3 of this DPA. 5.The parties agree that the certification of deletion of Personal Data that is described in Clause 12(1) of the SCC shall only be provided by Company to Customer upon Customer's request. 11. California Consumer Privacy Act of 2018 (CCPA) 11.1 Effective as of January 1, 2020, the following shall apply for Customers subject to the CCPA: 11.1. All references to Data Protection Laws and Regulations in this DPA shall be deemed to include a reference to the CCPA; 11.1. All references to Personal Data in this DPA shall be deemed to include Personal Information, as defined in the CCPA, provided such data is Customer Data; 11.1. All references to 'Controller' in this DPA shall be deemed to be references to Business, as defined in the CCPA; 11.1. All references to 'Processo' in this DPA shall be deemed to be references to Service Provider, as defined in the CCPA; 11.1. Any capitalised term used in this Section 11 but not defined herein, shall have the meaning set forth in the CCPA. 11.2 Cmpany does and shall not Sell any Personal Information. 11.3 Cmpany will Process Personal Information solely as set forth in Section 2.3 (the 'Business Purpose'), and shall not retain, use, or disclose the Personal Information for any purpose other than the Business Purpose. 11.4 ompany does not receive any Personal Information from Customer as consideration for Company's provision of the Services. 11.5 ompany certifies that it understands the restrictions set forth in this Section 11 and will comply with them. 12. Retention of Customer Data During the Term of the DPA, and subject to Company's retention obligations under applicable laws, including Data Protection Laws, Company shall adhere to Customer's instructions with regard to retention (including, without limitation, deletion) of Customer Data Processed pursuant to the DPA. Further, and subject to Company's retention obligations under applicable laws, including Data Protection Laws, Company shall, and shall cause its Subcontractors to, immediately securely destroy (by making unreadable, unreconstructable, and indecipherable) any or all Customer Data (including, without limitation, all electronic copies on hard drives, backup media, portable devices, optical, magnetic, or other storage media, as well as hard copies) upon the earlier to occur of the following: (a) termination or expiration of the DPA or any applicable statement of work for any reason; or (b) cessation of Company's need to retain such Customer Data to perform the Services. Company shall certify in writing that such destruction has been completed. If Customer requests return or transfer of all or a portion of such Customer Data prior to the destruction described above, Company shall promptly return to Customer all such Customer Data, through a secure method designated by Customer, or shall promptly transfer such Customer Data to Customer's designee, in accordance with the instructions of, and using the secure method prescribed by, Customer, following Customer's written demand therefor. In either event, Company shall promptly provide Customer with a certification by an officer of Company that all Customer Data has been removed from Company's and any Subcontractor's possession and/or control. 13. Governing Law & Settlement of Disputes The laws of the state of Delaware, without giving effect to the principles of conflicts of law, will apply to any disputes arising out of or relating to the DPA. Each of the parties hereto consents to the exclusive jurisdiction and venue of the courts of New Castle County, Delaware Any dispute arising between the parties hereto in respect of the interpretation of this DPA and the performance of obligations hereunder shall be settled amicably by mutual consultations as far as practicable. In the event a claim, controversy or dispute between the parties arises out of or in connection with this DPA or the transactions and business contemplated hereby, including the validity, construction or enforcement thereof, whether by way of contractual breach, tort or quasi-delict, the parties agree that the matter will be referred to an independent mediator mutually agreed upon by the parties. Where the parties cannot agree on a mediator, the parties agree to submit the dispute to either ad hoc or institutional arbitration, the choice of venue, law and rules of procedure of which shall be mutually agreed upon. All dispute resolution proceedings and records shall be in English. Issuance of an arbitration demand shall suspend the effect of any default entailed by such claim, controversy or dispute and any judicial or administrative proceedings instituted in connection therewith, for the duration of the arbitration proceedings. The parties agree to participate in good faith in any mediation or arbitration begun under this paragraph. Any mediation or arbitral award shall be binding upon the parties, and shall be final and unappealable except on grounds provided under the applicable Alternative Dispute Resolution and Arbitration Laws, Rules and Procedures. It is understood that where the parties have mutually agreed upon a mode of dispute resolution, the same shall be the exclusive remedy in the event such mode of dispute resolution is agreed upon, except that parties shall be entitled to obtain equitable relief, such as injunctive relief, from any court of competent jurisdiction in the Delaware in order to protect its rights while such proceeding is pending or in support of any award made pursuant to such arbitration. List of schedules: Schedule 1: Company Security, Privacy and Architecture Datasheet Schedule 2: List of Sub-Processors as of the Effective Date Schedule 3: Details of the Processing The parties' authorised signatories have duly executed this agreement Customer Bikayi, Inc Signature Signature Printed Printed Sonakshi Nathani Title Title CEO Date Date Schedule 1 We take data security, privacy and compliance very seriously. We have put in several standards and diligently follow protocols to protect our customer’s user data. Company follows a “security by design” philosophy. Which means, Company does not treat security as an afterthought. The “security by design” team consists of product managers, architects, engineers and compliance consultants, who review privacy policies and security measures regularly. Company complies with the two most critical facets of GDPR, “Right to Erasure” and “Right to Restriction of Processing”. Under "Right To Erasure" of GDPR, Company has exposed an API which will remove all the personal data associated with specific users who have requested to be erased. To comply with the data tracking opt-out requests of users under "Right To Restriction of Processing" of GDPR, the latest Company SDKs are now shipped with the methods to opt out of data tracking. Company is committed towards abiding by increased transparency regarding the collection and processing of personal information. Confidentiality Company gives high priority to customer information safety. To ensure the same, the Company has enabled encryption across all our Data volumes where customer data resides. All the database activities are strictly monitored and audited on time-to-time basis. Availability Company maintains high uptime up to 99.9% for all Company services and applications to help the customers utilize the platform to the highest and make use of redundant resources to make sure the services are available to Company customers without any interruptions. Company takes backups continuously and follows disaster recovery plans to ensure the Company platform is available even in case of unexpected scenarios. Few of the key practices Company follows under Security Process: A very strict Secure SDLC process while developing any application. In-depth VAPT (vulnerability assessment and penetration testing) for any application going into production. Regular assessments on all our infrastructure on a quarterly basis. Continuous audits on all our database machines to ensure high security standards Regular info-sec assessments on all Company Corp assets to ensure the security at End Point level. Support for SSO via SAML 2.0 and acts as a service provider (SP) for SSO. Compliance with the California Consumers Protection Act (CCPA). RBAC for all Company internal application/software(s) to ensure only authorised personnel perform privileged actions. Schedule 2 SUB-PROCESSORS USED IN CONNECTION WITH THE COMPANY’s SERVICES This Schedule describes the Sub-processors material to Company’s provision of the Company Services. (effective as of the Effective Date; subject to change) Last Modified: December 2022 Bikayi, Inc. (“Company”) uses certain Sub-processors in connection with its provision of the Company Services to its customers. Following is the full list of Sub-processors that Company uses in its provision of the Company Services. Depending upon a Customer’s use of the Company Services e.g., geographical location of the Customer, not all Sub-Processors will be needed to deliver the Company Services. As used herein, Sub-processors refer to Affiliates of Company and third parties who process Personal Data on behalf of Company. Third parties engaged by Company as Sub-processors are subject to written agreements that contain confidentiality and security commitments not less protective than those in the DPA with respect to the protection of Personal Data to the extent applicable to the nature of the services provided by such Sub- processor. Company remains responsible for the acts and omissions of its Sub-processors pursuant to the DPA. Terms used herein without definition are used as defined in the MSA. Sl. No. List of third party processor Service Provided Corporate Headquarters Service Provided 1 zohobooks. Accounting tool Chennai,India Customer financial information 2 outplay. Marketing tool Delaware, USA Customer contact data 3 moengage. Marketing tool San Francisco, CA Customer contact data 4 sales navigator. Marketing tool Templeton, CA Customer contact data 5 Atlassian-Jira. Productivity Tool Sydney, Australia Track of tech tasks; No Customer Data 6 Slack Communication Tool San Francisco, CA Intra company knowledge exchange; No customer data 7 Quickbooks Accounting tool Mountain View, USA Customer financial information 8 Amplitude Analytics Tool Burlington, USA Product usage data; Customer contact data Sl. No. List of third party processor Service Provided Corporate Headquarters Service Provided 1 Google Cloud Platform Cloud hosting Mountain View, USA All platform data 2 Freshworks Customer support tool Delaware, USA Customer support requests, Customer Contact data 3 Amazon AWS Cloud hosting Seattle, USA Information associated with delivery of website content 4 WhatsApp Messaging California, USA Customer contact data 5 SendGrid Messaging Denver, USA Customer contact data 6 TrustSignal Messaging Noida, India Customer contact data 7 Firebase Messaging California, USA Customer contact data 8 Amplitude Analytics Tool Burlington, USA Product usage data; Customer contact data SCHEDULE 3 DETAILS OF THE PROCESSING Nature and Purpose of Processing Company will Process Personal Data as necessary to perform the Services pursuant to the Agreement, as further specified in the Documentation, and as further instructed by Customer in its use of the Services. Duration of Processing Subject to Section 7 of the DPA, Company will Process Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing. Categories of Data Subjects Customer may submit Personal Data to the Services, the extent of which is determined and controlled by Customer in its sole discretion, and which may include, but is not limited to, Personal Data relating to the following categories of Data Subjects: (i) Prospects, customers, End-Users, business partners and vendors of Customer (who are natural persons) (ii) Employees or contact persons of Customer’s prospects, customers, business partners and vendors (iii) Customer’s Users authorized by Customer to use the Services Data exporter Customer may submit Personal Data to the Services, the extent of which is determined and controlled by Customer in its sole discretion, and which may include, but is not limited to the following categories of Personal Data: 1. Name 2. Email address 3. Mobile Number 4. Device data 5. Address Details relevant for Appendix 1 to Standard Contractual Clauses Data exporter The data exporter is the Customer or a Customer Authorised Affiliate, i.e., a company that wishes to manage its customer engagement via the Company Services. Data importer The data importer is Company, a company which processes Personal Data upon the instruction of the data exporter in accordance with the terms of the Agreement. Data subjects The personal data transferred concern the following categories of data subjects: the data subjects listed above in “Categories of Data Subjects”, in particular the data exporter’s Users of the Company Services and End- Users. Categories of data The personal data transferred concern the following categories of data: Application data, email address, location data, application settings and preferences, campaign data, connections with social networks or other platforms, device data. Special categories of data (if appropriate) The personal data transferred concern the following special categories of data: N/A Processing operations The personal data transferred will be subject to the following basic processing activities: The Personal Data transferred is stored by the data importer and accessible by the data exporter within a web interface to enable the data exporter to segment their user audience and create targeted multi-channel messaging. Increase your revenue with human-like targeted marketing at scale. Follow Us: 110000+ Followers Products Campaigns Chatbot Multi-channel CRM Web Gamification Integrations Company About Us Plans and pricing Privacy Policy Terms Legal DPA GDPR Resources Podcast Blog Case Studies Developer Resources