Data Processing Agreement

1. Definitions

2. Roles of the Parties

2.1 Controller and Processor

The Customer is the Controller of Personal Data processed through the Platform. Vaanik is the Processor. Vaanik processes Personal Data only on the Customer's instructions as set out in this DPA and the Principal Agreement.

2.2 Customer's responsibility as Controller

The Customer is responsible for:

• Ensuring it has a lawful basis for collecting and sharing Personal Data with Vaanik
• Ensuring Data Principals have been informed about how their data is used, including through AI agents
• Providing any notices and obtaining any consents required under Applicable Law
• Ensuring the accuracy and relevance of Personal Data provided to the Platform

3. How Vaanik Processes Personal Data

3.1 Instructions

Vaanik processes Personal Data solely on the documented instructions of the Customer as reflected in their Workspace configuration and these Terms. Vaanik will not process Personal Data for any other purpose.

3.2 Scope of processing

The nature, purpose, and categories of Personal Data processed depend entirely on how the Customer configures their Workspace and Agents. Typically this includes:

• Contact details of end users or customers interacting with Agents (name, phone number, email address)
• Conversation content and interaction history
• Data passed through connected Integrations as part of Agent workflows
• Any other data the Customer chooses to include in knowledge bases or workflows

3.3 No processing for Vaanik's own purposes

Vaanik does not use Personal Data processed on the Customer's behalf for its own commercial purposes or advertising, or to train general AI models shared across customers. Using the Customer's conversations to train and improve the Customer's own Agents, as described in the Terms and Conditions, is processing on the Customer's instructions; the Customer can switch it off by emailing [email protected].

3.4 Conflict with law

If Vaanik is required by law to process Personal Data in a manner not covered by the Customer's instructions, Vaanik will inform the Customer before doing so unless prohibited by law.

4. Confidentiality

Vaanik ensures that all personnel with access to Personal Data are bound by appropriate confidentiality obligations. Access to Personal Data is limited to those who need it to operate and support the Platform.

5. Security

5.1 Measures

Vaanik implements and maintains technical and organisational measures appropriate to the nature of the Personal Data and the risks involved. These include:

• Encryption of Personal Data at rest and in transit
• Access controls and authentication requirements
• Regular security assessments and monitoring
• Logical separation of data between Workspaces

5.2 No guarantee of absolute security

No system is completely secure. Vaanik's obligation is to apply reasonable and industry-appropriate measures, not to guarantee that Personal Data will never be subject to unauthorised access.

6. Sub-processors

6.1 Use of sub-processors

Vaanik uses sub-processors to provide infrastructure and supporting services — including cloud hosting, AI and speech services, telephony and messaging, and payments. The categories are described in our Privacy Policy, and the Customer may request the current list of sub-processors at [email protected].

6.2 Obligations on sub-processors

Vaanik ensures that sub-processors are bound by data protection obligations no less protective than those in this DPA.

6.3 Changes to sub-processors

Vaanik will provide reasonable notice of any addition or replacement of a sub-processor. If the Customer has a legitimate objection to a new sub-processor, they may raise it with Vaanik at [email protected]. If the objection cannot be resolved, the Customer may terminate their Workspace in accordance with the Principal Agreement.

6.4 Third-party Integrations

Integrations connected by the Customer are not Vaanik sub-processors. When Personal Data flows into a third-party Integration, it is processed under that provider's own terms and data practices. The Customer is responsible for ensuring those flows are lawful.

7. Data Subject and Data Principal Rights

7.1 Assistance

Where a Data Principal exercises a right under Applicable Law — such as access, correction, or erasure — and that request relates to data processed through the Platform, Vaanik will provide reasonable assistance to enable the Customer to respond, to the extent technically possible.

7.2 Requests directed to Vaanik

If a Data Principal contacts Vaanik directly with a rights request, Vaanik will direct them to the Customer as the Controller.

8. Data Breach Notification

8.1 Notification

If Vaanik becomes aware of a confirmed breach affecting Personal Data processed under this DPA, Vaanik will notify the Customer at the email address registered to their account without undue delay and in any case within 72 hours of becoming aware.

8.2 Content of notification

The notification will include, to the extent known at the time: the nature of the breach, the categories and approximate volume of Personal Data affected, likely consequences, and measures taken or proposed.

8.3 Customer's reporting obligations

The Customer is responsible for determining whether and how to notify affected Data Principals and regulators in accordance with Applicable Law.

9. Data Retention and Deletion

9.1 During the agreement

Vaanik retains Personal Data for as long as the Workspace is active and as configured by the Customer.

9.2 On termination

Following closure of a Workspace, Vaanik will delete Personal Data from its systems within 90 days, unless retention is required by law. The Customer may request a data export before closing their Workspace.

9.3 Backups

Personal Data in automated backups may persist for up to 30 additional days following deletion from active systems, after which it will be purged.

10. Audit Rights

The Customer may request written confirmation that Vaanik is complying with this DPA once per calendar year. Vaanik will respond within 30 days. Physical audits are not offered under standard terms but may be arranged separately for enterprise customers.

11. International Data Transfers

Vaanik's primary infrastructure is located in India. Where Personal Data is transferred to or processed in another country — for example through a sub-processor or AI model provider — Vaanik ensures appropriate safeguards are in place in accordance with Applicable Law.

12. Liability

Each party's liability under this DPA is subject to the limitations set out in the Principal Agreement. Vaanik's liability for data processing failures is limited to direct losses caused by Vaanik's failure to meet its obligations under this DPA.

13. Term and Termination

This DPA remains in force for as long as Vaanik processes Personal Data on behalf of the Customer under the Principal Agreement. It terminates automatically when the Principal Agreement ends.

14. Governing Law

This DPA is governed by the laws of India. Any disputes arising from this DPA are subject to the jurisdiction set out in the Principal Agreement.

15. Contact

For any questions relating to this DPA or data protection at Vaanik:
[email protected]
https://www.vaanik.ai