Data Processing Agreement

Capitalized terms not defined in this DPA have the meanings given to them in the Terms of Service. In this DPA:

Personal Data

Any information relating to an identified or identifiable natural person that is contained within Customer Data.

Data Subject

The identified or identifiable natural person to whom Personal Data relates.

Processing

Any operation performed on Personal Data, such as collection, storage, use, disclosure, or deletion.

Security Incident

A confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data processed under this DPA.

Data Protection Laws

All applicable laws and regulations relating to the processing of Personal Data and privacy that apply to the relevant processing activity, which may include, where applicable, the EU General Data Protection Regulation, the UK GDPR, India's applicable data protection framework, and other regional data protection laws.

This DPA applies where Triostack processes Personal Data contained within Customer Data on behalf of the Customer in the course of providing the Services under the Terms of Service or an applicable Order Form. This DPA does not apply to Triostack Data, which is instead addressed in the Privacy Policy.

For most processing of Personal Data within Customer Data, the Customer generally acts as the controller (or, where applicable, data fiduciary or equivalent role under local law), determining the purposes and means of processing, and Triostack generally acts as the processor (or, where applicable, data processor or service provider), processing Personal Data only on the Customer's documented instructions.

Triostack will process Personal Data only in accordance with the Customer's documented instructions, which include instructions given through configuration of the Services and this DPA, unless required to do otherwise by applicable law, in which case Triostack will, where legally permitted, inform the Customer of that legal requirement before processing.

The categories of Personal Data processed depend on the Customer's use of the Services and the applications enabled within TriostackOne, and are determined and controlled by the Customer. They may include, for example, contact details, employment records, or transaction records that a Customer chooses to submit as Customer Data.

Data Subjects may include the Customer's employees, contractors, customers, vendors, and other individuals whose Personal Data the Customer includes in Customer Data, as determined by the Customer.

Triostack maintains technical and organizational measures designed to protect Personal Data appropriate to the risk, as further described on the Security page, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing.

Triostack will ensure that personnel authorized to process Personal Data are subject to a duty of confidentiality, whether contractual or statutory.

The Customer provides general authorization for Triostack to engage subprocessors to assist in providing the Services, subject to the terms of this Section and the Subprocessors page, which lists the categories and (once published) identities of subprocessors currently engaged. Triostack will impose data protection obligations on subprocessors that are materially no less protective than those in this DPA, and will remain responsible for a subprocessor's performance of those obligations.

Triostack will notify Customers of new subprocessors in accordance with the Subprocessors — Section 6, and Customers may object as described in Subprocessors — Section 7.

Where Triostack transfers Personal Data across borders in the course of providing the Services, it will use transfer mechanisms recognized under applicable Data Protection Law, as further described in Section 18.

Where Triostack receives a request from a Data Subject relating to Personal Data it processes on the Customer's behalf, Triostack will, where legally permitted, promptly inform the Customer of the request and will not itself respond to the Data Subject except on the Customer's instructions or as required by law. Taking into account the nature of the processing, Triostack will provide reasonable assistance to the Customer, through appropriate technical and organizational measures, to help the Customer fulfil its obligation to respond to such requests.

Triostack maintains processes to detect and respond to Security Incidents affecting Personal Data, as further described on the Security page.

Upon becoming aware of a Security Incident affecting Personal Data processed on the Customer's behalf, Triostack will notify the Customer without undue delay and, in any event, within the period required by applicable Data Protection Law or the applicable agreement, and will provide information reasonably available to Triostack to assist the Customer in meeting any of its own notification obligations.

Taking into account the nature of processing and the information available to it, Triostack will provide reasonable assistance to the Customer with data protection impact assessments and consultations with supervisory authorities, where required under applicable Data Protection Law and to the extent such assistance relates to Triostack's processing of Personal Data under this DPA.

Triostack will retain and delete Personal Data processed on the Customer's behalf in accordance with the Data Retention & Deletion page and the Customer's documented instructions, subject to any retention required by applicable law.

On reasonable written request, and subject to reasonable confidentiality and scheduling arrangements, Triostack will make available information reasonably necessary to demonstrate compliance with this DPA and allow for, and contribute to, audits conducted by the Customer or an auditor mandated by the Customer, where required under applicable Data Protection Law and subject to a mutually agreed scope and frequency.

If Triostack receives a legally binding request from a public authority for disclosure of Personal Data processed on a Customer's behalf, Triostack will, unless legally prohibited from doing so, notify the Customer promptly and will assess whether the request is legally valid before responding.

Where a cross-border transfer of Personal Data requires a specific legal transfer mechanism under applicable Data Protection Law (for example, standard contractual clauses under the GDPR or an equivalent mechanism), the parties agree to cooperate in good faith to put in place the applicable mechanism.

Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service, Section 17 and the applicable Order Form.

This DPA takes effect on the date it becomes applicable to the Customer's use of the Services and remains in effect for as long as Triostack processes Personal Data on the Customer's behalf under the Terms of Service, unless terminated earlier by mutual written agreement.

In the event of a conflict between this DPA and the Terms of Service regarding the processing of Personal Data, this DPA controls. In the event of a conflict between this DPA and a signed Order Form or master agreement that expressly addresses data processing, the signed Order Form or master agreement controls.

Questions about this DPA can be directed to info@triostack.in or via Legal Contact.

• See the Privacy Policy for how Triostack Data is handled.
• See Subprocessors for the current subprocessor list.
• See Data Retention & Deletion for retention periods.