Data Processing Addendum.

1. Scope and roles

Capitalised words have the meanings in section 2 of the MSA. For the Personal Data of Contacts and Prospects processed to deliver the Services:

• You are the Data Fiduciary. You decide whom to target (through your Segments and Do-Not-Contact List) and why.
• Vikaas (Banao Pvt Ltd) is your Data Processor. We process that data only on your documented instructions — the MSA, the Order Form and this DPA.

Where Vikaas processes Personal Data for its own purposes (for example, your Workspace users' login details or billing contacts), we act as a Data Fiduciary under our Privacy Policy, not under this DPA. On anything about Personal Data, this DPA prevails over the other contract documents (see MSA section 3).

2. Personal Data we process

2.1 Data Principals

Contacts in your Segments, and the Prospects among them. These are business professionals reached in a professional capacity.

2.2 Categories of Personal Data

• Public LinkedIn profile data — name, profile link, headline, current role and company, location, career history and education, as the person has made it public on LinkedIn
• Messages exchanged — connection notes and the messages sent and received between an Agent and the Contact for your engagement
• Contact details a Prospect chooses to share — such as a phone number or email address given in the conversation
• Service notes — status and classification of the conversation (for example interested, not now, asked not to be contacted) added by Agents or by AI and reviewed by Agents

2.3 What we do not process

We do not deliberately collect sensitive categories of data (such as health, religion, political views, sexual orientation or financial details), and we do not knowingly process data of anyone under 18. If such data arrives in a conversation unprompted, we use it only as needed to reply and do not add it to profiles.

3. Purposes and instructions

We process the Personal Data in section 2 only to:

• Find and prioritise Contacts who match your Segments
• Draft (with AI) and send (by hand) outreach messages and replies on your behalf
• Hand Prospects over to you, in your Workspace and, if agreed, your CRM
• Report to you on the engagement
• Keep Do-Not-Contact Lists and honour opt-outs
• Apply the cross-customer rule in MSA section 8, which protects Contacts from being approached by several customers at once

We will not sell this data, use it for our own marketing, or use it to train any general-purpose AI model. We may create anonymised, aggregated statistics from it (from which no person or customer can be identified); those are no longer Personal Data. If we believe an instruction from you breaks the DPDP Act, we will tell you and may decline to follow it.

4. Your responsibilities as Data Fiduciary

• You have a lawful basis for the outreach you direct, as described on our DPDP posture page
• Your Segments and lists do not target people whom it is unlawful to contact, and your Do-Not-Contact List is kept current
• You handle Prospects' Personal Data lawfully once we hand it over to you; from that point your own systems and policies apply to your copy
• You tell us promptly about any complaint or regulator enquiry relating to our processing

5. Retention and deletion

• During the engagement: we keep the Personal Data for as long as the engagement runs.
• After the engagement: we keep it for 30 days after the end date so you can export it, and then delete it from our production systems.
• Backups: encrypted backups are overwritten on their 90-day cycle, so the data is gone from all backups within 120 days of the end date.
• Opt-outs: to honour an opt-out, we keep the minimum needed to recognise that person (for example their profile link) on a suppression list so they are not contacted again for any customer.
• Anonymised aggregates may be kept, as they contain no Personal Data.
• Legal holds: data under a legal hold, court order or active dispute is kept until the hold ends, and we tell you where the law allows.

This 30-day commitment is shorter than the 90-day default post-engagement window in our Privacy Policy; for customers under the MSA, this DPA applies and counts as your standing written request for early deletion.

6. Security measures

We maintain reasonable security safeguards as required by Section 8 of the DPDP Act, including:

• Encryption in transit (TLS 1.3; minimum TLS 1.2 enforced)
• Encryption at rest (AES-256) for data stores and backups, with keys in AWS KMS
• Role-based access on a least-privilege basis, and mandatory multi-factor authentication for all Vikaas operator accounts with access to customer data
• Separation between customers: your Workspace shows only your engagement's data
• Annual third-party penetration testing and continuous vulnerability scanning
• Background verification and data protection training for personnel with access to customer data, under written confidentiality obligations
• Written data protection terms with every sub-processor
• A logged trail of AI drafts and human review, as described in our AI Policy

More detail is on our Trust page. We may improve these measures over time but will not reduce the overall level of protection.

7. Personal Data breach notification

If a Personal Data breach affects data we process for you, we will:

• Act to contain it and assess its scope straight away
• Notify you without undue delay — within 24 hours of confirming the breach and in any event no later than 72 hours after becoming aware of it
• Send a written incident report within 5 business days of first notice: what happened, what data and people are affected, what we did, and what we are changing
• Help you notify the Data Protection Board of India and affected Data Principals as the DPDP Act and its Rules require

8. Data Principal requests

• If a Contact or Prospect asks us directly to access, correct or erase their data, we will tell you and help you respond. We respond to your request for assistance within 5 business days.
• If a person asks not to be contacted, the Agent stops outreach to them immediately and we add them to the Do-Not-Contact List within 2 business days, as our Privacy Policy says.
• We help you meet grievance redressal timelines; our Grievance Officer details are on the DPDP posture page.

9. Sub-processors

You authorise us to use the sub-processors listed on our Sub-processors page. Each is bound by written data protection terms no less protective than this DPA, and we remain responsible for them.

We give active customers 30 days' advance notice by email before adding or replacing a sub-processor that will process your Personal Data. You may object within 15 days on reasonable data protection grounds; if we cannot reasonably accommodate the objection, you may end the affected Segment without any early-termination fee.

10. Cross-border transfer

Your engagement data is stored in India (AWS Mumbai, ap-south-1) by default, or in AWS Bahrain or UAE where the Order Form specifies a GCC region. Some processing happens outside India:

• AI drafting: the profile details and conversation text needed to draft a message are sent to our AI providers, which run in the USA, only to produce that draft
• Transactional email: service emails (such as notifications and reports to your Workspace users) are sent through a provider in the EU

You authorise these transfers. We transfer Personal Data only to countries not restricted by the Government of India under Section 16 of the DPDP Act, and we will adjust our practices if the Rules change.

11. Audit

Once a year, on at least 30 days' written notice, you may audit our compliance with this DPA. We will answer a reasonable security and privacy questionnaire, share relevant policies, sub-processor terms and summaries of our AI review logs, and make a knowledgeable person available to answer questions. Where the Order Form includes the on-site or remote right-to-audit described on our Trust page, or after a breach affecting your data, you may also inspect our processing directly, during business hours and without disrupting other customers. Each party bears its own audit costs, and audit findings are confidential.

12. Return and deletion on exit

13. Contact

Privacy and DPDP: privacy@vikaas.ai

Security incidents and trust: trust@vikaas.ai

Contracting: legal@vikaas.ai