Data Processing Agreement

Between the customer ("Controller", "you") and PRIMEDHA Technologies Private Limited ("Processor", "we"). It forms part of the Terms of Service and applies when we process personal data on your behalf. Effective on the date you accept the Terms. Version 24 October 2026.

1. Subject and roles

1.1 We process personal data contained in your specifications, deployment state and in the workloads and data stores the service deploys or inspects on your instructions ("Customer Personal Data").

1.2 You are the controller (data fiduciary); we are the processor. You are responsible for having a lawful basis and for informing the people concerned.

1.3 Our own processing of account data (sign-up, billing, security) is as controller and is described in the Privacy Policy.

2. Details of the processing

3. Our obligations

We will: process Customer Personal Data only on your documented instructions (the Terms and what you submit through the service) unless the law requires otherwise, and tell you if we think an instruction breaches the law; ensure our staff are bound by confidentiality; keep the measures in section 5; assist you, taking into account the nature of the processing, with data subject requests, security, breach notification, impact assessments and consultation with authorities; and make available the information needed to show compliance (section 8).

4. Sub-processors

4.1 You authorise the sub-processors listed in the Privacy Policy (cloud hosting, e-mail delivery, language-model providers, pricing service, payment processor). We bind each by a written contract with data protection terms no less protective than these, and remain responsible for them.

4.2 We give you 30 days' notice of a new or replaced sub-processor (e-mail and in the console). You may object on reasonable data protection grounds within that time; if we cannot accommodate the objection, you may terminate the affected service and receive a pro-rata refund of prepaid fees.

5. Security measures

• Access to your cloud account: short-lived federated credentials issued per operation; no stored cloud keys; a permission set you can read in the bootstrap script; you can revoke it at any time.
• Isolation: each customer, project and environment has its own state, working directory and credentials; one customer cannot read another's.
• Encryption: contact e-mail addresses and deployment state are encrypted at rest (authenticated encryption); connections use TLS; the service database has no public address on Google Cloud and Azure [confirm for the cloud you host on, and for AWS before you host there].
• Secrets: customer secrets are read from your own secret manager at deployment time and are not stored in the specification; before any text leaves the platform for a language model, personal data, secrets and tokens and every identifier of your cloud estate (account, project and subscription identifiers, role names, hosts, domains, IP addresses, buckets, registries, the client identifier) are replaced by placeholders and the result is checked; if anything remains, the text is not sent.
• Least privilege and review: services run as non-root with minimal permissions; changes are made through reviewed code and automated tests; supply-chain pinning of build inputs and images.
• Monitoring and response: audit logs of administrative actions, alerting, a documented incident procedure and on-call coverage as stated in the Support Policy.
• Backups: the service database is backed up and point-in-time recoverable for a limited period.
• Personnel: access is limited to people who need it, with two-factor sign-in. We review these measures at least yearly and will not materially reduce them.

6. Personal data breach

We notify you without undue delay and in any case within 72 hours after becoming aware of a breach affecting Customer Personal Data, with what we know: the nature, the data and people concerned, the likely consequences, what we have done and what you can do. We keep you updated. You decide whether to notify authorities and people, and we help.

7. Data subject requests and authorities

If a person writes to us about Customer Personal Data we pass the request to you without answering it ourselves, unless the law requires. If an authority asks us for it we tell you first where the law allows. We help you answer requests using the tools of the service.

8. Audit

On 30 days' notice, no more than once a year (or after a breach), you may ask for the information that shows our compliance (our security overview, the latest test and review results, sub-processor contracts' data protection terms) and, if that does not answer your question, to have an independent auditor you appoint under confidentiality inspect our relevant controls at your cost, at a time that does not disrupt the service.

9. Return and deletion

On termination, at your choice we delete or return Customer Personal Data held by us (specifications, deployment state, logs about your environments) within 30 days; backups expire within [35] days afterwards; we keep what the law requires. Data inside your own cloud account is under your control and is not deleted by us unless you instruct a destroy.

10. International transfers

The service is hosted in [region]. Where Customer Personal Data is transferred to a country without an adequacy decision, the parties rely on the standard contractual clauses (module two, controller to processor) which are incorporated by reference, with Annex content taken from this agreement, or another lawful mechanism.

11. Liability, order of precedence, law

Liability under this agreement is subject to the limits in the Terms of Service. If this agreement and the Terms conflict on data protection, this agreement prevails. Governing law and venue are those of the Terms of Service, except that the standard contractual clauses follow their own rules.

Contact for data protection: privacy@primedha.com.