Data Processing Agreement (DPA)

1. Definitions & Interpretation

Capitalized terms used but not defined in this DPA have the meanings given in the Agreement.

• "Applicable Data Protection Laws" means all worldwide privacy and data protection laws applicable to the processing of Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR, the California Consumer Privacy Act as amended by CPRA ("CCPA"), and the Indian Digital Personal Data Protection Act ("DPDP").
• "Customer Personal Data" means any Personal Data contained within Customer Inputs or processed by Erayaha on behalf of Customer in providing the Service.
• "Controller", "Processor", "Data Subject", "Personal Data", "Processing", and "Personal Data Breach" have the meanings given under the GDPR.

2. Roles & Scope of Processing

• Role of the Parties: Customer is the Controller (or a Processor acting on behalf of a third-party Controller), and Erayaha is the Processor of Customer Personal Data.
• Documented Instructions: Erayaha shall process Customer Personal Data only on documented instructions from Customer (including with respect to transfers), as set forth in the Agreement, this DPA, or through Customer's configuration of the Service, unless required to do so by applicable law.
• Purpose and Duration: The processing shall be conducted solely to provide, maintain, and support the Document Intelligence service for the duration of the Agreement.
• Zero-Retention Architecture: Customer acknowledges that under Erayaha's Connected-Storage model, raw document text is processed transiently in volatile RAM memory and purged immediately upon inference completion.

3. Confidentiality & Personnel

Erayaha ensures that all personnel authorized to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and have received adequate training regarding data protection compliance.

4. Security of Processing & Technical Measures (TOMs)

Erayaha implements and maintains appropriate technical and organizational measures ("TOMs") designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, as detailed in Schedule 3 of this DPA.

5. Subprocessors

• Authorized Subprocessors: Customer provides general authorization for Erayaha to engage the subprocessors listed in Schedule 2 to this DPA.
• Notice of Changes: Erayaha will provide at least thirty (30) days' prior written notice (via email or posted to security.erayaha.ai) before engaging any new or replacement subprocessor. Customer may object on reasonable data protection grounds within fourteen (14) days of notice.
• Subprocessor Obligations: Erayaha imposes data protection terms on each subprocessor that provide at least the same level of protection as those in this DPA, and remains liable for the acts and omissions of its subprocessors.

6. Data Subject Rights Assistance

Taking into account the nature of the processing, Erayaha assists Customer by implementing appropriate technical measures, insofar as possible, to fulfill Customer's obligation to respond to Data Subject requests (e.g., access, rectification, erasure, restriction, or portability). If Erayaha receives a request directly from a Data Subject, Erayaha will promptly forward the request to Customer without responding directly, unless legally required.

7. DPIA & Supervisory Authority Consultation

Taking into account the nature of processing and the information available to Erayaha, Erayaha shall provide reasonable assistance to Customer with any data protection impact assessments (DPIAs) and prior consultations with competent supervisory authorities (including under Articles 35 and 36 of the GDPR / UK GDPR) that Customer reasonably considers required of it under Applicable Data Protection Laws.

8. Audit Rights & Compliance Verification

Upon Customer's reasonable prior written request, Erayaha shall make available to Customer all information reasonably necessary to demonstrate compliance with the obligations laid down in this DPA and Article 28 of the GDPR / UK GDPR, and shall allow for and contribute to audits, including inspections, conducted by Customer or an independent certified auditor mandated by Customer (who is bound by professional confidentiality obligations and is not a competitor of Erayaha), subject to the following conditions:

• Customer shall provide at least thirty (30) business days' prior written notice of any requested audit;
• Audits shall be conducted during normal business hours without disrupting Erayaha's normal business operations, at Customer's sole cost and expense, and without compromising the security or confidentiality of other customers' data;
• Audits shall occur no more than once in any twelve (12) month period, unless mandated by a competent supervisory authority or following a confirmed Personal Data Breach impacting Customer Personal Data; and
• Satisfaction via Security Summaries & Trust Reports: Customer acknowledges and agrees that Erayaha may satisfy its audit obligations by providing Customer with a summary copy of its continuous compliance posture, third-party penetration testing executive summaries, SOC 2 Type II / ISO 27001 auditor reports, or continuous monitoring attestations via security.erayaha.ai (Sprinto Trust Center portal) in lieu of an on-site physical inspection. Sprinto provides continuous compliance posture verification without receiving or storing Customer Document Content or end-user PII.

9. Security Incident & Breach Notification

Upon becoming aware of a confirmed Personal Data Breach impacting Customer Personal Data, Erayaha will:

• Notify Customer in writing without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach, in accordance with GDPR and UK GDPR Article 33.
• Provide timely information regarding the nature of the incident, estimated categories and numbers of Data Subjects affected, and mitigation steps taken or proposed.
• Take reasonable and prompt remedial steps to contain and mitigate the effects of the incident.
• Data Subject Notifications: Customer acknowledges and agrees that, as Controller, Customer maintains sole responsibility for assessing whether notification to affected Data Subjects is required under GDPR Article 34 or equivalent data protection laws. Erayaha will provide reasonable cooperation and timely incident information to support Customer in meeting its statutory obligations.

10. Deletion or Return of Personal Data

Upon termination or expiration of the Agreement, Erayaha shall, at Customer's choice, securely delete or return all Customer Personal Data in its possession or control within thirty (30) days, unless applicable law requires continued retention.

11. International Data Transfers

Where transfers of Customer Personal Data from the EEA, UK, or Switzerland to countries without an adequacy decision occur, the parties agree to be bound by the EU Standard Contractual Clauses (2021/914) (Module 2: Controller-to-Processor, or Module 3: Processor-to-Processor) and the UK International Data Transfer Addendum, incorporated by reference in Schedule 4.

12. DPA Modifications & Subprocessor Updates

This DPA may only be modified by mutual written agreement of the parties, provided that Erayaha may update the list of Authorized Subprocessors in Schedule 2 in accordance with Section 5 by providing at least thirty (30) days' prior notice via email or publication on security.erayaha.ai, subject to Customer's right to object on reasonable data protection grounds within fourteen (14) days of notice.