Data Processing Addendum

1.Scope and parties

This Data Processing Addendum ("DPA") forms part of the agreement between Pikorua Security Private Limited ("Pikorua Security") and the Customer for the Pikorua Security service (the "Agreement"), whether that is our Terms of Service or a signed master subscription agreement. It applies whenever Pikorua Security processes Customer Personal Data on the Customer's behalf and is incorporated into the Agreement automatically.

If this DPA conflicts with the Agreement, this DPA controls for the processing of personal data. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses control.

2.Definitions

• Customer Personal Data means personal data within Customer Data that Pikorua Security processes on behalf of the Customer.
• Data Protection Laws means all laws that apply to processing under the Agreement, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA) and other US state privacy laws, the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and India's Digital Personal Data Protection Act, 2023, in each case to the extent applicable.
• Standard Contractual Clauses or SCCs means the clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
• UK Addendum means the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• Subprocessor means any third party Pikorua Security engages to process Customer Personal Data.

Controller, processor, data subject, business, service provider and similar terms have the meanings given in Data Protection Laws.

3.Roles of the parties

The Customer is the controller (or, under US state laws, the business or controller) of Customer Personal Data, and Pikorua Security is its processor (or service provider). Where the Customer is itself a processor for another controller, for example a general contractor managing certificates on behalf of a project owner, Pikorua Security is a subprocessor and the Customer confirms it has authority to engage us.

The Customer is responsible for the lawfulness of its instructions and for giving any notices and obtaining any consents required, including toward vendors, subcontractors and brokers whose details appear in uploaded certificates.

4.Details of processing (Annex I)

5.Pikorua Security's obligations

Pikorua Security will:

• process Customer Personal Data only on the Customer's documented instructions, which are the Agreement, this DPA and the Customer's configuration of the Service, unless the law requires otherwise, in which case we will tell the Customer first unless the law prohibits it;
• tell the Customer if we believe an instruction infringes Data Protection Laws;
• ensure every person authorized to process Customer Personal Data is bound by confidentiality obligations;
• implement the technical and organizational measures in Annex II and maintain an annual SOC 2 Type II attestation;
• never use Customer Personal Data, or any other Customer Data, to train or fine-tune machine learning models; and
• assist the Customer, taking into account the nature of the processing, with data protection impact assessments and prior consultations with supervisory authorities.

6.US state law service provider terms

For Customer Personal Data subject to the CCPA and similar US state laws, Pikorua Security will not:

• sell or share it, as those terms are defined in the CCPA;
• retain, use or disclose it for any purpose other than the business purposes specified in the Agreement, including for any commercial purpose other than providing the Service;
• retain, use or disclose it outside the direct business relationship between Pikorua Security and the Customer; or
• combine it with personal data received from or on behalf of another person, or collected from our own interactions with consumers, except as the CCPA permits.

Pikorua Security will comply with its obligations under the CCPA, provide the level of privacy protection the CCPA requires, and notify the Customer if it determines it can no longer meet them. The Customer may take reasonable and appropriate steps to stop and remediate unauthorized use. Pikorua Security certifies that it understands and will comply with these restrictions.

7.Subprocessors

The Customer gives Pikorua Security general authorization to engage Subprocessors. The current list, with each Subprocessor's purpose and location, is published on our Subprocessors page.

We give at least 30 days' notice before a new Subprocessor processes Customer Personal Data, by updating that page and emailing customers who subscribe to updates. The Customer may object on reasonable data protection grounds within that period. We will then work in good faith to offer an alternative; if we cannot, the Customer may terminate the affected part of the Service and receive a refund of prepaid fees for it.

Each Subprocessor is bound by written data protection terms at least as protective as this DPA, and Pikorua Security remains responsible for its Subprocessors' performance.

8.Security measures (Annex II)

• Encryption of Customer Data at rest with AES-256 using keys in AWS Key Management Service, plus field-level encryption for taxpayer identification numbers
• Encryption in transit with TLS 1.3; TLS 1.2 is accepted only on legacy integration endpoints, and earlier protocol versions are refused
• Hosting in AWS us-east-1 across multiple Availability Zones, with failover to us-west-2
• Tenant isolation enforced in the application and database layers
• Role-based access, single sign-on and multi-factor authentication for all Pikorua Security staff, with quarterly access reviews and time-limited production access
• Centralized logging and monitoring, with security alerts triaged around the clock
• Vulnerability scanning, an annual third-party penetration test and defined remediation timelines
• Encrypted backups with point-in-time recovery and a disaster recovery test at least once a year
• Secure development practices including peer code review and automated security testing on every change
• Background checks where lawful, confidentiality agreements and annual security and privacy training for all staff

Our Security Policy describes these measures in more detail. We may update them provided the update does not reduce the overall level of protection.

9.Personal data breaches

Pikorua Security will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach. The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed.

We will keep the Customer updated as we learn more, take reasonable steps to contain and remediate the breach, and support the Customer's own notification obligations. Notification is not an admission of fault or liability.

10.Data subject requests

If Pikorua Security receives a request from a data subject about Customer Personal Data, we will forward it to the Customer within 5 business days and will not respond directly, other than to confirm that the request was forwarded. The Service lets the Customer access, correct, export and delete Customer Personal Data itself; where it cannot, we will assist.

11.Audits

The Customer may obtain our most recent SOC 2 Type II report, penetration test summary and completed security questionnaires through the Trust Center, under confidentiality.

If those materials do not reasonably demonstrate compliance with this DPA, or a supervisory authority requires it, the Customer may conduct an audit once every 12 months, with at least 30 days' notice, during business hours, at its own cost, through an independent auditor bound by confidentiality, and scoped so that other customers' data is not disclosed.

12.International transfers

Customer Data is hosted in the United States. Pikorua Security staff in India may access it remotely to provide support and security, under the controls in Annex II.

To the extent Customer Personal Data subject to the GDPR is transferred to a country without an adequacy decision, the SCCs are incorporated by reference as follows:

• Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) where the Customer is a processor.
• Clause 7 (docking clause) applies.
• Under Clause 9(a), Option 2 (general written authorization) applies, with the 30-day notice period in the Subprocessors section of this DPA.
• The optional wording in Clause 11 does not apply.
• Under Clauses 17 and 18, the law and courts of Ireland apply.
• Annex I is completed by the Details of processing section of this DPA, and Annex II by the Security measures section.

For transfers subject to the UK GDPR, the UK Addendum applies, with Tables 1 to 3 completed by the information in this DPA and Table 4 recording that neither party may end the Addendum under its Section 19.

For transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority for Swiss personal data, and references to member state law read as Swiss law where required.

For personal data subject to India's Digital Personal Data Protection Act, 2023, Pikorua Security will process it in line with the Act and any restriction the Government of India notifies on transfers to particular countries.

13.Return and deletion

When the Agreement ends, the Customer has 30 days to export Customer Data with the Service's export tools. Pikorua Security then deletes Customer Personal Data from production systems within 30 days, and it ages out of encrypted backups within a further 35 days, unless the law requires us to keep it. On request, we certify deletion in writing.

14.Liability

Each party's liability under this DPA is subject to the limitation of liability in the Agreement, including its specific cap for data protection and security obligations. Nothing in this DPA limits the rights of data subjects under the SCCs.

15.Signed copies

This DPA is effective on the date the Customer accepts the Agreement, without a separate signature. For a countersigned PDF for your records, email legal@pikoruasecurity.com with your workspace name and legal entity; we return it within 3 business days.