Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service or other written agreement ("Agreement") between Tixi Intelligence Private Limited ("Tixi") and the business customer that accepts the Agreement ("Customer"). Tixi's registered office is 331/1946 - B, Road 6, Aurobindo Nagar, Chandrasekharpur, Bhubaneswar - 751016, Odisha, India.

This DPA applies when Tixi processes Personal Data on Customer's behalf in providing the Services. By accepting the Agreement, Customer also accepts this DPA. If this DPA conflicts with the Agreement on processing of Personal Data, this DPA controls. The Agreement otherwise remains in effect.

1. Definitions and roles

"Data Protection Law" means privacy and data-protection laws applicable to the processing, including, where applicable, the GDPR, UK GDPR, India's Digital Personal Data Protection Act and rules, and applicable US state privacy laws.

"Personal Data," "Controller," "Processor," "Data Subject," "Personal Data Breach," and "Processing" have the meanings given in applicable Data Protection Law. For Indian law, the parties' roles include the equivalent roles of Data Fiduciary and Data Processor. "Subprocessor" means a third party engaged by Tixi to process Customer Personal Data on Customer's behalf.

For Customer Personal Data, Customer is the Controller (or equivalent fiduciary/business) and Tixi is the Processor (or equivalent service provider), except where Customer itself is a Processor, in which case Customer is a Processor and Tixi is its Subprocessor. Tixi acts as an independent Controller for processing it determines for its own purposes, such as account administration, billing, fraud prevention, service security, and legal compliance. That processing is governed by the Privacy Policy and Agreement, not this DPA.

2. Scope and duration

Tixi will process Customer Personal Data only to provide, secure, support and maintain the Services, in accordance with this DPA, the Agreement, Customer's documented instructions, and applicable Data Protection Law. Processing details are set out in Annex 1.

This DPA remains in force while Tixi processes Customer Personal Data for Customer. The duration and nature of processing depend on the Services Customer uses and its account configuration.

3. Customer instructions and responsibilities

Customer instructs Tixi to process Personal Data as necessary to provide the Services, including receiving and storing inbound WhatsApp message bodies; processing customer prompts, files and content; generating outputs; maintaining customer-specific workspaces; and sending WhatsApp messages when Customer configures or authorises the Tixi bot to do so.

Customer may issue additional lawful instructions through its account configuration, support channel, or a signed order. Tixi will inform Customer if, in Tixi's reasonable opinion, an instruction violates applicable Data Protection Law. Tixi may suspend the relevant processing while the parties resolve the issue.

Customer is responsible for the lawfulness, accuracy, quality, source, notices, permissions, legal basis and instructions associated with Customer Personal Data. Customer will ensure that its instructions, including directions to send messages or use AI features, comply with Data Protection Law and applicable Meta/WhatsApp policies. Customer will not instruct Tixi to process sensitive or regulated data unless the Services and parties' written arrangements expressly support that processing.

4. Tixi's processing duties

Tixi will:

• process Customer Personal Data only on documented instructions, including instructions for international transfers, unless applicable law requires otherwise;
• not retain, use or disclose Customer Personal Data outside the documented business purposes of providing the Services, except as required by law;
• ensure personnel authorised to process Customer Personal Data are subject to confidentiality obligations;
• implement and maintain appropriate technical and organisational measures described in Annex 2;
• assist Customer, taking account of the nature of processing, with requests to exercise Data Subject rights;
• assist Customer with security, breach, impact-assessment and regulator-consultation obligations to the extent required by law and reasonably possible;
• notify Customer if Tixi believes an instruction infringes applicable Data Protection Law;
• make information reasonably necessary to demonstrate compliance available to Customer, subject to confidentiality, security and other customers' rights; and
• not sell Customer Personal Data or use it for targeted advertising.

5. Security incidents

Tixi will notify Customer of a confirmed Personal Data Breach affecting Customer Personal Data without undue delay after becoming aware of it. The notice will provide information reasonably available to Tixi to help Customer meet its own reporting duties. Tixi may provide information in stages as it becomes available and will take reasonable steps to contain, investigate and remediate the breach.

Customer is responsible for deciding whether and when to notify individuals or regulators, except where applicable law requires Tixi to notify directly. Tixi will not notify third parties about a breach concerning Customer Personal Data unless required by law or authorised by Customer.

6. Subprocessors

Customer gives Tixi general written authorisation to use Subprocessors to provide the Services. Tixi's Subprocessors include:

Meta Platforms/WhatsApp Cloud API and Razorpay may process information under their own terms and roles when Customer uses those services. They are not necessarily Subprocessors acting solely on Tixi's instructions. Meta provides the WhatsApp integration; Razorpay processes payments. Their applicable terms and privacy notices govern their independent processing.

Tixi will impose data-protection obligations on each Subprocessor that are materially no less protective than the applicable obligations in this DPA and remains responsible to Customer for its Subprocessors' performance, subject to the Agreement's liability provisions.

Tixi will give advance notice of intended additions or replacements through the Services or customer account notice. Customer may object in writing within 15 days on reasonable data-protection grounds. The parties will work in good faith to resolve the objection. If they cannot, Customer may stop using the affected feature or terminate the affected Services and receive a prorated refund of prepaid unused fees for that affected portion. This is Customer's remedy for the objection.

7. Data Subject requests and cooperation

If Tixi receives a request from an individual concerning Customer Personal Data, Tixi will direct the individual to Customer where reasonably possible and promptly notify Customer unless prohibited by law. Tixi will provide reasonable assistance to enable Customer to respond, taking account of the nature of processing and the information available to Tixi. Customer remains responsible for responding to the request.

At Customer's reasonable request and expense, Tixi will provide reasonable assistance with data-protection impact assessments and prior consultations with regulators, where required by law and relevant to Tixi's processing.

8. International transfers

Customer authorises Tixi and its Subprocessors to process Customer Personal Data in India and in other countries where Tixi or its Subprocessors operate, as described in the Agreement, Privacy Policy and Subprocessor information. Tixi will apply a legally recognised transfer mechanism and supplementary measures where required by Data Protection Law.

Where the GDPR or UK GDPR requires standard contractual clauses or another transfer mechanism, the parties will execute and complete the required clauses and transfer details before the relevant restricted transfer. This DPA alone does not replace a required transfer impact assessment or completed transfer instrument.

9. Retention, export and deletion

Customer can export available Customer Content from the authenticated web/app dashboard while its account is active. Customer is responsible for exporting data it wishes to retain before termination or account closure.

During an active account, Customer message content, prompts, uploaded files and generated outputs are retained until Customer requests deletion. On Customer's verified deletion instruction, Tixi will initiate deletion without undue delay and complete deletion from active systems within 30 days, unless a longer period is required by law or agreed in writing. Backups are retained for up to 150 days through the regular cycle. Audit logs, application logs, traces and metrics are retained for 150 days by default. Customer may request longer telemetry retention by written agreement.

At the end of the Services, Customer may export data through the dashboard and has 30 days to instruct Tixi to retain or delete it. If Customer gives no instruction, Tixi will delete active Customer Personal Data within 60 days after termination, subject to legal retention requirements; backup copies expire through the regular cycle within 150 days. Tixi will restrict any data it is legally required to retain.

10. Audit and compliance information

On reasonable written request, Tixi will make available information reasonably necessary to demonstrate compliance with this DPA. Customer may conduct an audit no more than once in any 12-month period, unless a Personal Data Breach or regulator requires an additional audit. Audits require at least 30 days' notice, occur during normal business hours, are limited to relevant processing, and must protect Tixi's security, confidential information and other customers' data. The parties will first use available security reports, certifications and written responses. Customer bears its audit costs unless the audit identifies a material breach by Tixi, in which case Tixi bears reasonable audit costs.

11. Government and legal requests

If Tixi receives a legally binding request for Customer Personal Data, Tixi will notify Customer where legally permitted and will disclose only the data legally required. Tixi may challenge a request where it reasonably believes there are grounds to do so.

12. Liability and order of precedence

Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement, except where applicable law does not allow that limitation. Nothing in this DPA limits an individual's statutory rights or a regulator's authority.

If the parties execute standard contractual clauses or another mandatory transfer instrument, that instrument prevails over this DPA to the extent of conflict for the relevant transfer.

13. Contact

Tixi privacy contact: legal@tixi.ai
Registered office: 331/1946 - B, Road 6, Aurobindo Nagar, Chandrasekharpur, Bhubaneswar - 751016, Odisha, India

Annex 1 — Processing details

Subject matter and purpose

Provision of Tixi's AI-assisted marketing and growth software, including WhatsApp Business Platform workflows, customer support, data storage, processing of prompts and files, AI-assisted analysis and generation, and operation of customer-authorised integrations.

Duration

For the term during which Tixi provides the Services and any post-termination period required by Customer's instructions, the Agreement or applicable law.

Nature of processing

Collection, receipt, recording, organisation, storage, retrieval, consultation, transmission to authorised Subprocessors, use, analysis, generation of outputs, disclosure through Customer-authorised integrations, restriction, deletion and destruction.

Categories of Data Subjects

• Customer's employees, contractors, account administrators and authorised users.
• Customer's leads, prospects, customers, message recipients and business contacts whose information Customer submits or connects.

Categories of Personal Data

• Names, business contact details, account identifiers and workspace roles.
• WhatsApp phone numbers, message bodies, templates, delivery/read status and conversation metadata.
• Customer prompts, files and submitted or generated marketing content that may contain personal data.
• Connected-platform identifiers, assets and campaign interaction or performance data.
• Technical, access, audit and usage information associated with use of the Services.

Special categories or sensitive data

Not intended. Customer must not submit special-category, sensitive or children's data unless Tixi has expressly agreed in writing and appropriate safeguards are in place.

Retention

During an active account, Customer message content, prompts, files and generated outputs are retained until Customer requests deletion. Audit logs, application logs, traces and metrics are retained for 150 days by default; backups are retained for up to 150 days. Customer may request longer telemetry retention by written agreement. After a verified deletion request, Tixi deletes active-system copies within 30 days and backup copies expire through the regular cycle within 150 days, subject to legal retention duties. On termination, Customer has 30 days to instruct Tixi; absent instructions, Tixi deletes active Customer Personal Data within 60 days.

Annex 2 — Technical and organisational measures

Tixi maintains measures appropriate to the nature and risk of its processing, including:

• Customer isolation: customer data is logically isolated by customer/workspace and access is scoped to the relevant customer. Tixi does not intentionally expose one customer's data to another customer.
• Access controls: access to systems and Customer Personal Data is limited to authorised personnel and service components that need it to provide or secure the Services.
• Confidentiality: personnel authorised to handle Customer Personal Data are subject to confidentiality obligations.
• Operational security: security and operational telemetry is retained for 150 days by default and used to investigate reliability and security events.
• Data lifecycle: deletion requests are handled through a documented process; active-system deletion is completed within 30 days after verification, and backup copies expire within 150 days through the normal cycle.
• Provider controls: Subprocessors are selected and contractually required to protect Customer Personal Data and use it only for the agreed service purposes.

Tixi may update these measures as technology and risks evolve, provided the overall level of protection is not materially reduced.