Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service (or other agreement) between the Customer and ByteYeti, which provides Pulsido ("Pulsido", "we"). It applies whenever we process personal data in Customer Data on the Customer's behalf. If it conflicts with the Terms on data protection, this DPA wins. Customers who need a countersigned copy can request one at legal@pulsido.com.

1. Definitions

"Data Protection Laws" means the laws that apply to the processing, including the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, India's Digital Personal Data Protection Act, 2023 (DPDP Act), and US state privacy laws such as the California Consumer Privacy Act (CCPA). "Personal Data", "Controller", "Processor", "Data Subject", "Processing", and "Personal Data Breach" have the meanings in the GDPR, and include "data fiduciary" and "data processor" under the DPDP Act and "business" and "service provider" under the CCPA.

2. Roles

The Customer is the Controller of Personal Data in Customer Data, and Pulsido is its Processor. Where the Customer is itself a processor for another controller, Pulsido is its sub-processor. The details of the processing are in Annex 1.

3. Customer instructions

We process Personal Data only on the Customer's documented instructions, which are the Terms, this DPA, and the settings the Customer chooses in Pulsido, unless the law requires otherwise (in which case we'll tell the Customer first, unless the law forbids it). We'll tell the Customer if we believe an instruction breaks Data Protection Laws. The Customer is responsible for having a lawful basis for the processing and for giving its people the notices the law requires.

4. Confidentiality

Everyone we authorize to process Personal Data is bound by confidentiality obligations and accesses it only as needed to provide and support the Services.

5. Security

We maintain the technical and organizational measures described on our Security page, which provide a level of security appropriate to the risk. We may update them, as long as the overall level of protection doesn't go down.

6. Sub-processors

The Customer generally authorizes us to use sub-processors. The current list is on our Sub-processors page. We'll update it at least 30 days before a new sub-processor processes Customer Data and, on request, tell the Customer by email. The Customer may object on reasonable data protection grounds within that period. If we can't resolve the objection, the Customer may end the affected Services and receive a prorated refund of prepaid fees. We impose data protection terms on each sub-processor that are no less protective than this DPA, and remain responsible for their work.

7. Helping the Customer

Taking into account the nature of the processing, we'll help the Customer:

• respond to requests from Data Subjects to exercise their rights. If a request reaches us directly, we'll pass it to the Customer and won't answer it ourselves unless the Customer asks us to;
• with security, Personal Data Breach notifications, data protection impact assessments, and prior consultations with authorities, as they relate to our Services.

8. Personal Data Breaches

We'll notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Data. We'll describe what happened, the likely consequences, and what we're doing about it, and share more as we learn it. Notifying the Customer isn't an admission of fault.

9. Deletion and return

When the Services end, the Customer can export its data for 30 days. After that, or sooner on the Customer's written request, we delete Customer Data from our live systems within 30 days, and from backups within a further 30 days, unless the law requires us to keep it.

10. Audits

We'll make available the information reasonably needed to show we comply with this DPA, including answering security questionnaires and sharing our providers' certifications. If that isn't enough, or a regulator requires it, the Customer may audit our compliance once a year, with at least 30 days' notice, during business hours, under confidentiality, and at its own cost, in a way that doesn't put other customers' data at risk.

11. International transfers

We store Customer Data in Singapore and on Cloudflare's global network, operate from India, and use sub-processors in the United States and the United Kingdom. Where a transfer of Personal Data out of the EEA, UK, or Switzerland needs a safeguard:

• the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated into this DPA by reference, with Module Two (controller to processor) or Module Three (processor to processor) as applicable. The Customer is the data exporter and Pulsido the data importer. Clause 7 (docking) applies; under Clause 9(a), Option 2 (general authorization, 30 days' notice) applies; the optional wording in Clause 11 doesn't apply; under Clauses 17 and 18, the clauses are governed by, and disputes resolved in, the courts of Ireland. Annex I is Annex 1 below, and Annex II is our Security page;
• for the UK, the International Data Transfer Addendum issued by the Information Commissioner applies to those clauses;
• for Switzerland, the clauses apply with references to the GDPR read as references to the Swiss FADP, and the Swiss Federal Data Protection and Information Commissioner as the competent authority.

12. CCPA

When we process personal information as a service provider under the CCPA, we won't sell or share it, retain, use, or disclose it outside our direct business relationship with the Customer or for any purpose other than providing the Services, or combine it with personal information from other sources except as the CCPA allows.

13. India's DPDP Act

Where the DPDP Act applies, the Customer is the data fiduciary and Pulsido is its data processor. We process personal data only to provide the Services under this DPA, protect it with reasonable security safeguards, and help the Customer meet its obligations, including erasing personal data when the Customer withdraws it or the purpose is fulfilled.

14. Liability

Each party's liability under this DPA is subject to the limits in the Terms.

Annex 1: Details of the processing

Contacts: for the Customer, its account owner. For Pulsido, the Grievance Officer, privacy@pulsido.com.