Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the agreement between Vibhaga Group, a sole proprietorship of Umesh Yellaboina, 11-3-451, New Ashok Nagar, Parsigutta, Secunderabad, Hyderabad 500061, Telangana, India ("we", "us"), and a business that buys or uses the Services ("the Customer"). It applies to the extent we process personal data on the Customer's behalf. It is for business customers only. It does not apply to a Consumer or to a person who buys for themselves.

1. The short version

2. Definitions

2.1 The terms Services, App, Website, Licence, Computer, Account and Consumer have the meaning they have in the Terms of Service.

2.2 In this DPA:

• Customer means a business, organisation or sole trader that buys Licences or uses the Services in the course of its trade, business or profession.
• Customer Personal Data means personal data that we process on the Customer's behalf under the agreement, as Annex 1 describes.
• Data Protection Law means the laws on personal data that apply to that processing. Depending on where the Customer and the people concerned are, they include: the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"); the UK GDPR and the Data Protection Act 2018; the Swiss Federal Act on Data Protection; the California Consumer Privacy Act ("CCPA"); and, in India, the Information Technology Act, 2000 with the rules under it, and, from the date its business duties begin (which we count as 13 May 2027), the Digital Personal Data Protection Act, 2023 ("DPDP Act") with its Rules.
• controller, processor, data subject, personal data, processing and personal data breach have the meanings that Data Protection Law gives them. The DPDP Act calls a controller a "Data Fiduciary" and a processor a "Data Processor".
• Sub-processor means a provider that we engage and that processes Customer Personal Data.
• SCCs means the standard contractual clauses in the Annex to Commission Implementing Decision (EU) 2021/914.

3. When this DPA applies, and our roles

3.1 For Customer Personal Data, the Customer is the controller (or a processor, where it acts for another business) and we are its processor (or sub-processor). We process Customer Personal Data only to supply the Services to the Customer, as Annex 1 describes. We do not sell Customer Personal Data, and we do not use it to train AI models.

3.2 For other personal data we are a controller. We decide for ourselves why and how to use account, licence, purchase and payment records, support records, security records and website analytics data, for the purposes in the Privacy Policy. Examples are keeping proof of what was agreed, stopping fraud and abuse, and meeting tax and accounting law. Some of the same data can fall in both groups. This DPA covers our handling of it on the Customer's behalf and does not change our role when we use it for our own purposes.

3.3 We do not receive audio, transcripts, History, notes, snippets, vocabulary, prompts, tasks, goals, Assistant chats, files attached to the Assistant, or the API keys saved in the App. We are not the Customer's processor for them. If a person puts such content in a support message, we handle it as a support conversation under Annex 1.

3.4 A person can switch on cloud speech, cloud cleanup or a cloud Assistant engine by saving their own key. The App then sends the data from the computer straight to that provider, under the agreement between the Customer or the person and the provider. We do not receive that data, and the provider is not our Sub-processor. The AI and Third-Party Services Notice has the detail.

4. What we do as the Customer's processor

4.1 Instructions. We process Customer Personal Data only on the Customer's documented instructions. The agreement (the Terms of Service, the Licence Agreement and this DPA) and the Customer's use of the Services' features are its instructions. The features include giving a Licence to a named person, taking it back, and removing a Computer. The Customer may give other written instructions to legal@dictatesafe.com if they are reasonable and within what the Services do. We tell the Customer without undue delay if we think an instruction breaks Data Protection Law. If the law requires us to process in another way, we tell the Customer before we do, unless the law forbids it.

4.2 Confidentiality. We make sure that any person we authorise to process Customer Personal Data is bound by a duty of confidentiality, handles it only for the purposes of the Services, and can reach only what their role needs.

4.3 Security. We apply the measures in Annex 2. We may change them if the overall level of protection does not fall.

4.4 Rights requests. If a data subject writes to us about Customer Personal Data, we refer them to the Customer and do not answer on the substance, unless the law requires us to. We help the Customer to answer requests to exercise rights under Data Protection Law, by suitable measures and within 30 days of its written request.

4.5 Other help. Taking into account the nature of the processing and the information we hold, we help the Customer to meet its duties on security, breach notification, impact assessments and consulting regulators.

4.6 Personal data breaches. We tell the Customer about a personal data breach affecting Customer Personal Data without undue delay, and in any case within 72 hours of becoming aware of it. We write to the Customer's Account email address and to any security contact it has given us. The notice says, as far as we know, what happened, which categories and approximate numbers of people and records are affected, the likely consequences, and what we have done or propose to do. We add detail as we learn it, and we keep a record of personal data breaches. The Customer decides whether and how to tell regulators and the people concerned.

4.7 Deletion or return. When the Customer's use of the Services ends, or earlier on its written request, we delete Customer Personal Data or return a copy in a common, machine-readable format, as the Customer chooses, within 30 days. We may keep what the law requires us to keep, such as tax and accounting records, for the periods in section 11 of the Privacy Policy, and we tell the Customer what we keep. Copies in our backups are deleted as the backups age out, within 56 days. Our Sub-processors delete their copies under their own terms, and some of those periods are longer.

4.8 Information and audits. We give the Customer the information it reasonably needs to show that we meet this DPA. Once in any 12 months the Customer may send us a written questionnaire about our security and privacy practices, and we answer it in writing. The Customer may audit us on site only where Data Protection Law requires it or a regulator has told the Customer to. An on-site audit needs 30 days' written notice, takes place in business hours, is at the Customer's cost, is bound by confidentiality, and gives no access to other customers' data. This section does not limit a regulator's own powers.

5. Sub-processors

5.1 General authorisation. The Customer authorises us to use Sub-processors. The current list is on the sub-processors page. Annex 3 repeats the Sub-processors that can handle Customer Personal Data.

5.2 Notice of changes. We give the Customer at least 30 days' notice before a new Sub-processor starts to handle Customer Personal Data, or before one is replaced. We do this by email to the Customer's Account address and by updating the sub-processors page. If a Sub-processor's own supplier gives us less notice, or a change is needed urgently to protect the Services or the data, we tell the Customer as soon as we learn of it. Section 5.3 applies in those cases too.

5.3 Right to object. The Customer may object in writing, on reasonable data protection grounds, within 30 days of our notice. We then work with the Customer in good faith to find an alternative. If we cannot find one within a further 30 days, the Customer may stop using the part of the Services that the change affects. The Terms of Service and the Refund and Cancellation Policy decide any refund.

5.4 Contracts. We have a written contract with each Sub-processor. It gives Customer Personal Data the same protection in substance as this DPA, taking into account the service the Sub-processor provides. We remain responsible to the Customer for what our Sub-processors do with Customer Personal Data.

6. International transfers

6.1 Our servers are in India (Amazon Web Services, Asia Pacific (Mumbai) region). Our Sub-processors handle Customer Personal Data in the places that the sub-processors page gives.

6.2 European Union. Where the GDPR applies to the Customer's transfer of Customer Personal Data to us, the SCCs apply and are incorporated into this DPA by reference. Module Two applies where the Customer is a controller, and Module Three where it is a processor. The Customer is the data exporter and we are the data importer. Annex 1, Part C sets out the choices that the SCCs leave open. Annexes 1, 2 and 3 of this DPA serve as Annexes I, II and III of the SCCs.

6.3 United Kingdom. Where the UK GDPR applies, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner, as updated or replaced, is incorporated by reference. The information its tables ask for is in Annexes 1, 2 and 3.

6.4 Switzerland. Where the Swiss Federal Act on Data Protection applies, the SCCs apply as in section 6.2 with these changes: references to the GDPR mean that Act, the supervisory authority is the Swiss Federal Data Protection and Information Commissioner, and a data subject in Switzerland may bring a claim in the courts of Switzerland.

6.5 United States Sub-processors. A transfer to a Sub-processor in the United States may rely on that Sub-processor's certification under the EU-US Data Privacy Framework. If it holds no certification, or the framework stops applying, we rely on the standard contractual clauses in our contract with that Sub-processor.

6.6 On request, we give the Customer the information it reasonably needs to assess a transfer. If a transfer tool stops being valid, we work with the Customer to put another in place. If the SCCs or the UK Addendum conflict with the rest of this DPA, they prevail.

7. California

7.1 Where the CCPA applies to the Customer and we process personal information on its behalf, we are its "service provider". We will:

1. process that personal information only for the business purposes in Annex 1, which are the specific purposes the Customer instructs;
2. not sell it or share it (as the CCPA defines those words);
3. not retain, use or disclose it for any other purpose, or outside our direct business relationship with the Customer, unless the CCPA allows;
4. not combine it with personal information that we receive from other sources or collect from our own dealings with the person, except as the CCPA allows;
5. comply with the CCPA obligations that apply to us and give the level of privacy protection that the CCPA requires; and
6. tell the Customer promptly if we decide that we can no longer meet our obligations under the CCPA.

7.2 The Customer may take reasonable and appropriate steps, including through section 4.8, to confirm that we use the personal information consistently with its CCPA obligations. If it finds we are using it without authorisation, it may, on notice, require us to stop and to put that right.

8. India

8.1 Until the business duties of the DPDP Act begin, the Information Technology Act, 2000 and the rules under it apply, and we apply the measures in Annex 2.

8.2 From the date those duties begin, where the Customer is a Data Fiduciary and we are its Data Processor, we will:

1. process Customer Personal Data only on the Customer's instructions and for the purposes in Annex 1;
2. take reasonable security safeguards, as Annex 2 describes;
3. tell the Customer of a personal data breach as section 4.6 says, with the details it needs to inform the Data Protection Board of India and each affected person;
4. erase Customer Personal Data when the Customer instructs us that consent has been withdrawn or the purpose is served, subject to section 4.7 and to any retention that the Act or its Rules require; and
5. help the Customer to answer requests and grievances from data subjects.

The Customer stays responsible as Data Fiduciary.

9. The Customer's duties

9.1 The Customer is responsible for having a lawful basis for the personal data it gives us or tells us to process, and for giving the notices that Data Protection Law requires. This includes the email address of anyone to whom it gives a Licence. It must be entitled to give us that data and to instruct us as it does.

9.2 The Customer gives us accurate instructions, keeps its Account details private, and should not put sensitive personal data in a support message unless that is needed to explain the problem.

10. Liability and order of precedence

10.1 Each party's liability under this DPA is subject to the limits in section 15 of the Terms of Service. Nothing in this DPA limits or excludes liability that Data Protection Law does not allow to be limited, or any right a data subject has under the SCCs.

10.2 If documents conflict about Customer Personal Data, this is the order: the SCCs and the UK Addendum, where they apply; this DPA; the Terms of Service and the Licence Agreement. The Privacy Policy governs our use of personal data as a controller.

11. Term, how this DPA binds, and changes

11.1 How it binds. For a Customer that is a business, this DPA becomes part of the Terms of Service when the Customer buys a Licence or accepts the Terms of Service. No signature is needed. If the Customer wants a signed copy, it writes to legal@dictatesafe.com with its legal name, its address and the name and title of its signatory, and we sign and return the copy.

11.2 Term. This DPA applies from the day the Customer first buys or uses the Services as a business until we have deleted or returned Customer Personal Data under section 4.7. Sections 4.7 and 10 continue after that.

11.3 Changes. We may update this DPA for good reasons, such as a change in law. We give 30 days' notice of a change that affects the Customer, and a change does not lower protection below what Data Protection Law requires. We cannot change the SCCs except as they allow.

11.4 Law. This DPA is governed by the laws of India, and section 17 of the Terms of Service decides disputes, except that the SCCs are governed by the law stated in Annex 1, Part C.

12. Contact

Questions about this DPA: privacy@dictatesafe.com or legal@dictatesafe.com, or the Contact page at https://dictatesafe.com/contact. Our Grievance Officer is named in section 17 of the Privacy Policy.

Annex 1. Description of processing

Part A. The processing

Part B. What this DPA does not cover

Dictation content and the other data listed in section 3.3 is not Customer Personal Data. Data that people send to a cloud AI provider of their choice is outside this DPA (section 3.4).

Part C. Standard contractual clauses, the UK Addendum and the Swiss addendum

1. Parties (Annex I.A). Data exporter: the Customer, with the name, address and contact details in its Account. Role: controller (Module Two) or processor (Module Three). Data importer: Vibhaga Group, address as at the top of this DPA. Contact person: Umesh Yellaboina, privacy@dictatesafe.com. Role: processor.
2. Description of the transfer (Annex I.B). Part A of this Annex. Onward transfers go only to the Sub-processors in Annex 3.
3. Competent supervisory authority (Annex I.C, Clause 13). Where the Customer is established in an EU Member State, the authority of that Member State. Where it is not established in the EU but the GDPR applies to it under Article 3(2) and it has appointed a representative, the authority of the Member State where the representative is established. Where it has no representative, the authority of the Member State where the data subjects whose data is transferred are located.
4. Choices the SCCs leave open.

5. UK. For a transfer under the UK Addendum, its own provisions decide the governing law and the courts. The details its tables need are in this Annex and Annexes 2 and 3.

Annex 2. Security measures

We apply these measures to Customer Personal Data:

1. Connections to the Website are encrypted in transit.
2. Passwords are stored in a protected form, not as plain text.
3. Our team's access to customer records is limited by role, and our staff sign in with two-step verification.
4. We keep regular backups of the Website's database.
5. We keep records of changes that our team makes through our staff tools.
6. We limit repeated attempts to sign in.
7. Servers that hold Customer Personal Data are in India (Amazon Web Services, Mumbai region).
8. We do not receive dictation content, which keeps it out of our systems.
9. Our Sub-processors apply their own security measures under their contracts with us.

Annex 3. Sub-processors that can handle Customer Personal Data

The sub-processors page is the current list. At the date of this DPA, the Sub-processors that can handle Customer Personal Data are:

The AI agent receives the support or chat messages, and for a signed-in or verified person a short summary of their account, which is Support data under Annex 1. It never receives a licence key, a password or card details. The sub-processors page also lists providers that receive website visitors' data for our own analytics and advertising, and providers that act on their own account. They do not receive Customer Personal Data under this DPA.

Document history