Data Processing Addendum

This Data Processing Addendum forms part of the agreement governing use of Harvin.ai between Thyleads Private Limited, operating Harvin.ai (‘Harvin’), and the customer using the Harvin service (‘Customer’). It applies where Harvin processes Personal Data on behalf of Customer.

‘Customer Personal Data’ means Personal Data processed by Harvin on behalf of Customer in connection with the Harvin service. ‘Data Protection Laws’ means privacy and data protection laws applicable to the relevant processing. ‘Subprocessor’ means a third party engaged by Harvin to process Customer Personal Data on behalf of Customer.

Customer determines the purposes for which Customer Personal Data is processed through Harvin. To the extent Harvin processes Customer Personal Data solely on behalf of Customer, Customer acts as Controller or equivalent responsible party and Harvin acts as Processor or service provider.

Harvin may separately act as Controller or equivalent responsible party for information processed for its own business purposes, such as account administration, billing, security, legal compliance and operation of its business.

Harvin will process Customer Personal Data only to provide the service, in accordance with Customer’s documented instructions, as described in the applicable agreement, or where required by applicable law. Customer’s configuration and use of Harvin constitute documented instructions.

• Determine whether its use of Harvin complies with applicable law
• Provide required privacy notices
• Establish an appropriate legal basis for processing
• Obtain required permissions or consents
• Ensure Personal Data submitted to Harvin is collected lawfully
• Configure the service appropriately
• Comply with laws governing email, calling, recording, SMS, marketing and other communications

Harvin will ensure that personnel authorised to process Customer Personal Data are subject to confidentiality obligations.

Harvin will maintain technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Harvin does not represent that any system can provide absolute security.

Customer authorises Harvin to engage Subprocessors necessary to provide the service. Harvin will require Subprocessors processing Customer Personal Data to be subject to appropriate data protection obligations and will maintain a current Subprocessor List.

Taking into account the nature of processing, Harvin will provide reasonable assistance to Customer in responding to valid Data Subject requests relating to Customer Personal Data. Where a Data Subject contacts Harvin regarding Personal Data controlled by Customer, Harvin may direct that person to Customer unless applicable law requires otherwise.

Harvin will notify Customer without undue delay after becoming aware of a confirmed Personal Data breach affecting Customer Personal Data where notification is required by applicable Data Protection Laws. Notification is not an admission of fault or liability.

Taking into account the nature of processing and information available to Harvin, Harvin will provide reasonable assistance with processing security, data protection impact assessments, regulatory consultations, Personal Data breaches and Data Subject rights where required by applicable law.

Harvin and its Subprocessors may process Customer Personal Data in countries other than the country in which Customer or the Data Subject is located. Where applicable Data Protection Laws require a transfer mechanism, the parties will use an appropriate lawful mechanism.

Upon termination or expiry of the applicable service agreement, Harvin will, subject to applicable law and technical limitations, return or make available Customer Personal Data where agreed and/or delete Customer Personal Data processed on behalf of Customer. Certain information may remain temporarily in backups, provider systems, security records or legally required records until expiration or deletion in accordance with applicable retention processes.

Harvin will make available information reasonably necessary to demonstrate compliance with applicable processor obligations. Any audit must be reasonably necessary, protect confidential information and other customers, avoid unreasonable disruption, and be subject to reasonable prior notice.

If this DPA conflicts with another agreement between Harvin and Customer regarding processing of Customer Personal Data, this DPA controls solely with respect to that processing issue.