DPDP Addendum

1Scope

This Addendum forms part of the Terms between AOZO and the customer who has a workspace (“Customer”). It applies to personal data that the Customer or its users enter into or generate in AOZO (“Customer Personal Data”), and it follows India’s Digital Personal Data Protection Act, 2023 and its rules (“DPDP Law”).

If there is a conflict between this Addendum and the Terms about Customer Personal Data, this Addendum prevails.

2Roles

• The Customer is the Data Fiduciary and decides the purposes and means of processing Customer Personal Data.
• AOZO is the Data Processor and processes Customer Personal Data on the Customer’s behalf under a valid contract, as DPDP Law permits.
• For its own account, billing, security and website data, AOZO is a Data Fiduciary under the Privacy Policy.

3Customer responsibilities

• Make sure it has a lawful basis, such as valid consent or a permitted legitimate use, to process the personal data it enters into AOZO.
• Give any notices to data principals that DPDP Law requires.
• Make sure data it enters is accurate and that people who use the workspace are authorised.
• Manage roles, permissions and two-factor sign-in for its users.

4How AOZO processes data

• Only to provide, secure and support the apps the Customer subscribes to, and as the Customer instructs through its use of the Service and these terms.
• Not for AOZO’s own marketing and not sold to anyone.
• AOZO will tell the Customer if it believes an instruction breaches DPDP Law.
• Automated features such as lead scoring, ⌘K search and Copilot process Customer Personal Data only inside the Customer’s workspace to deliver the feature.

5Confidentiality

AOZO limits access to Customer Personal Data to people who need it to provide the Service, and requires them to keep it confidential.

6Security safeguards

AOZO maintains reasonable security safeguards appropriate to the risk, including two-factor sign-in (email OTP, authenticator apps and passkeys), roles and permissions, activity logs, and access controls for our team.

7Personal data breaches

If AOZO becomes aware of a personal data breach affecting Customer Personal Data, we will notify the Customer without undue delay, share what we know, and help the Customer meet its duty to inform the Data Protection Board of India and affected data principals as DPDP Law requires.

8Sub-processors

AOZO may use service providers, such as hosting, email delivery, payments and support tools, to help deliver the Service. We bind them to protections no less strict than this Addendum and remain responsible for them. We will give the Customer a reasonable way to find out about relevant providers on request.

9Cross-border transfers

AOZO will transfer Customer Personal Data outside India only as DPDP Law permits and not to any country or territory the Government of India restricts.

10Help with data principal requests

If a data principal contacts AOZO about Customer Personal Data, we will pass the request to the Customer and not respond on the Customer’s behalf unless the law requires it. We will reasonably help the Customer respond to access, correction, erasure and grievance requests. Contact support@aozo.in.

11Return and deletion

When a subscription ends, the Customer can export its Customer Personal Data for a reasonable period. After that, AOZO deletes it from our systems unless the law requires us to retain it. Backups are removed on their normal cycle.

12Information and audits

AOZO will give the Customer reasonable information needed to show compliance with this Addendum, and will cooperate with reasonable audit requests with notice, during business hours and without harming other customers’ security.

13Children’s data

If the Customer processes personal data of children, it is responsible for obtaining verifiable parental or guardian consent and for not carrying out processing that DPDP Law prohibits, such as tracking or targeted advertising directed at children.

14Contact

Questions about this Addendum? Write to support@aozo.in with the subject “DPDP”.