1. Introduction and Scope

This Data Processing Addendum ("DPA") supplements the Terms and Conditions between CFURST Solutions Pvt Ltd ("Processor", "Intauryx", "we", "us", "our") and the Organisation subscribing to the Intauryx platform ("Client", "Organisation", "Data Fiduciary"), governing the processing of personal data under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). Terms defined in the DPDP Act, the Terms and Conditions, or the Privacy Policy apply here unless otherwise defined.

This DPA applies to "Organisational Data" — personal data of the Organisation's own clients, personnel, and other individuals that the Organisation uploads to or manages through the Service, and for which the Organisation is the Data Fiduciary. It does not apply to Account Information or Usage Information collected directly from individual Users, which is addressed in the Privacy Policy.

This DPA is entered into by the Organisation's designated Administrator on behalf of the Organisation at the time of Organisation onboarding, and remains effective for as long as the Organisation uses the Service. It does not require separate acceptance by individual Users, whose relationship with us is governed by the Terms and Conditions and Privacy Policy.

2. Definitions

• Personal Data: any data about an identifiable individual, as defined under the DPDP Act.

• Data Principal: the individual to whom Personal Data relates.

• Processing: any operation performed on Personal Data, including collection, storage, use, disclosure, and erasure.

• Sub-processor: a third party engaged by the Processor to process Personal Data on the Processor's behalf, including infrastructure providers, email hosting and email and SMS communications providers and AI model providers used to power AI Features.

• Masked Data: Personal Data that has had identifying elements replaced with a reversible token or placeholder prior to transmission to a sub-processor, as described in Section 7.3.

3. Roles and Responsibilities

3.1 Organisation (Client) as Data Fiduciary

The Organisation is responsible for:

• Determining the purposes and means of processing Organisational Data;

• Obtaining valid consent from, and providing notice to, Data Principals as required under the DPDP Act;

• Ensuring a lawful basis exists for all Organisational Data it uploads or processes through the Service;

• Not permitting any individual below the age of 18 to access or use the Service under its account;

• Ensuring it has the authority to connect its organisational mailbox to the Service, and has given notice to, and has a lawful basis for processing the personal data of, individuals whose emails are processed (including its clients' personnel and other correspondents);

• Configuring the recipient, External Participant and Client Visible settings appropriately, maintaining accurate Client-level email addresses and mailbox whitelists (which determine which incoming emails are imported), and complying with applicable laws on electronic communications when sending emails through the Service; and

• Responding to, or coordinating with us to respond to, Data Principal requests concerning Organisational Data.

 3.2 Our Role as Data Processor

Intauryx processes Organisational Data only on the Organisation's documented instructions (including instructions given through ordinary use of the Service's configuration and settings), except where otherwise required by applicable law, in which case we will, where legally permitted, inform the Organisation of that legal requirement before processing. Connecting an organisational mailbox (through OAuth 2.0 or, where the email provider does not support it, an application-specific or account password) and enabling the email features constitutes the Organisation's instruction for us to read emails received in that mailbox from senders permitted under the Organisation's settings, apply labels to them, create Work Item comments and Email Action Items from them, and send emails from that mailbox on its behalf when its Users send comments or replies through the Service, in each case in accordance with the settings the Organisation configures.

4. Processing Details

• Subject matter: provision of the Intauryx practice-management and workflow platform.

• Duration: the term of the Organisation's agreement with us, plus the retention period described in Section 12.

• Nature of processing: storage, retrieval, organisation, transmission (including reading and labelling emails in, and sending emails from, a connected organisational mailbox), and AI-assisted processing (see Section 7.3) of Organisational Data.

• Categories of data: as determined by the Organisation; may include client records, project and work-item data, documents, and communications (including chatbot conversation history, and emails, attachments and related metadata processed through a connected organisational mailbox, and per-User read/resolved status records).

• Categories of Data Principals: the Organisation's clients, personnel, and other individuals whose personal data is uploaded to the Service, including individuals who correspond with the Organisation by email and key personnel of the Organisation's clients.

5. Processor Obligations

We shall:

• Process Organisational Data only on the Organisation's documented instructions, unless required otherwise by law;

• Ensure personnel authorised to process Organisational Data are bound by confidentiality obligations;

• Implement appropriate technical and organisational security measures (Section 6), including the redaction safeguard described in Section 7.3;

• Assist the Organisation in responding to Data Principal requests, within a reasonable time and subject to reasonable administrative effort;

• Notify the Organisation of a Personal Data breach without undue delay upon becoming aware of it (Section 9);

• Delete or return Organisational Data upon termination of the Organisation's use of the Service, subject to the export and deletion timelines in Section 12; and

• Make available information reasonably necessary to demonstrate compliance with this DPA.

6. Security Measures

We implement reasonable technical and organisational security safeguards, including:

• Encryption of data in transit and at rest, using industry-accepted standards TLS 1.3: AES_128 for data in transit and TLS 1.3: AES-256 for data encryption;

• Role-based access controls and multi-factor authentication;

• Secure handling of mailbox credentials: where the email provider supports OAuth 2.0, authorisation tokens are used instead of the mailbox password, with access limited to the permissions granted by the Organisation; otherwise, application-specific or account passwords supplied by the Organisation are stored in encrypted form, are accessible only to authorised application processes, and are used only to connect to the mailbox. In each case the Organisation can revoke access at any time through its email provider;

• Automated redaction/masking of personal identifiers before content is transmitted to AI sub-processors (Section 7.3);

• System monitoring and audit logging; and

• Incident response procedures.

7. Sub-processors

7.1 Authorisation and How Sub-processor Obligations Are Imposed

The Organisation authorises the engagement of the sub-processors listed in Schedule A for the categories of processing described in this DPA.

Sub-processors are not parties to this DPA and are not provided with a copy of it. Our sub-processors are established cloud, communications and AI providers, and the data-protection obligations that apply to each of them are ensured by that provider's standard terms and conditions, including its data-protection terms. We remain fully liable to the Organisation for processing carried out by a sub-processor on our behalf, to the same extent as if we had carried out the processing ourselves (see Section 7.5).

7.2 List of Sub-processors

A list of our current sub-processors — including infrastructure/hosting providers, email hosting, email delivery and SMS providers and AI model providers, and, for AI providers, the specific models in use — is set out in Schedule A to this DPA. Schedule A forms part of this DPA and is updated by us from time to time to reflect new sub-processors or changes to existing ones (including changes to the specific AI models used), in accordance with Section 7.4.

7.3 AI Sub-processors and Redaction

Where AI Features (as described in the Terms and Conditions, Section 4, and the Privacy Policy, Section 13) process Organisational Data, the AI sub-processor(s) identified in Schedule A act as our sub-processors for that processing. As described in Section 7.1, they process data under their standard terms and conditions, which include confidentiality and data-protection obligations, and are not bound by this DPA directly.

Before content is transmitted to an AI sub-processor, we apply an automated redaction/masking process designed to replace personal identifiers with reversible tokens before the content leaves our infrastructure. The identifiers and information currently masked include the following (a non-exhaustive list that may be updated from time to time):

•  Indian core identifiers: Aadhaar, PAN, GSTIN, TAN, DIN, CIN, LLPIN, IFSC, UPI, passport, driving licence, voter ID, bank account, mobile number, email, security PIN, date of birth

•  Names and addresses: names of individuals and parties, and postal and property addresses

•  Indian tax, GST and compliance: GST invoice number, e-way bill, IRN, GST ARN, TDS challan, ITR acknowledgement

•  CA and accounting: UDIN, ICAI membership number, CA FRN, GST practitioner ID, UAN, ESIC, accounting record IDs, UTR references, cheque numbers

•  Legal: CNR, FIR, advocate enrolment, court case numbers, legal party fields, property references

•  Global and financial: credit card, IBAN, SWIFT/BIC

•  Secrets and technical information: JWT, private keys, API keys, database URLs, Redis URLs with passwords, user file paths

 This masking is reversible: masked identifiers can be re-associated with the original data within our systems. Accordingly, the masked content sent to an AI sub-processor remains Personal Data for the purposes of the DPDP Act, and the cross-border transfer safeguards in Section 8 apply to it. The redaction process is a security safeguard that reduces the identifying information exposed to that sub-processor; it does not remove the data from the scope of this DPA. This safeguard applies regardless of which specific AI sub-processor or model is in use at a given time.

If automatic summarisation of emails is introduced, the masking described above will be applied while the summary is generated, and the summary will form part of Organisational Data.

7.4 New Sub-processors and Schedule A Updates

We will give the Organisation at least 30 days' notice before engaging a new sub-processor, including before replacing or adding an AI model provider or changing the specific AI models used. The Organisation may object on reasonable data-protection grounds within that period; if so, we will work in good faith to offer a commercially reasonable alternative, or permit the Organisation to terminate the affected Service without penalty.

Updates to Schedule A made in accordance with this Section 7.4 take effect on notice as described above and do not require the Organisation to re-execute or separately re-accept this DPA.

 7.5 Liability

We remain liable to the Organisation for processing carried out by a sub-processor on our behalf (Section 7.1), to the same extent we would be liable if we had carried out that processing ourselves.

8. Cross-Border Data Transfers

Organisational Data is primarily stored and processed within India, on Google Cloud Platform infrastructure in the Mumbai (asia-south1) region. Where content is submitted to an AI Feature, the redacted/masked version of that content (Section 7.3) may be transmitted to an AI sub-processor located outside India. The identity of the current AI sub-processor(s) and their processing location(s) are set out in Schedule A. Our other sub-processors listed in Schedule A are likewise engaged only for processing in, or transfers to, jurisdictions not restricted under Section 16 of the DPDP Act, and the location of each is set out in Schedule A.

Any such transfer is subject to the data-protection obligations in that sub-processor's standard terms and conditions. The transfer is limited to jurisdictions not restricted by the Central Government under Section 16 of the DPDP Act, and to the masked content necessary to provide the relevant AI Feature. AI Features are made available at platform level and are not configured separately for each Organisation. The Organisation and its Users may choose whether to use (a) the AI chatbot to access data within the Service, (b) the chatbot for general purposes outside the data in the Service, and (c) AI-assisted drafting of, and replies to, emails in Entity comments; content is transmitted to an AI sub-processor only when such a feature is used. An Organisation that does not wish to permit such a transfer may refrain from using these features.

9. Data Breach Notification

We will notify the Organisation of any Personal Data breach affecting Organisational Data without undue delay after becoming aware of it. The notification will describe, to the extent then known: the nature of the breach, the categories and approximate number of Data Principals and records affected, the likely consequences, and the measures taken or proposed to address it.

As the Organisation is the Data Fiduciary for Organisational Data, the Organisation is responsible for any onward notification to the Data Protection Board of India and to affected Data Principals, as required under the DPDP Act. We will provide reasonable cooperation and the information necessary to enable the Organisation to make such notifications. This is distinct from breaches affecting Account Information or Usage Information, for which we act as an independent Data Fiduciary — see the Privacy Policy, Section 10, for that scenario.

10. Data Principal Requests

Where we receive a request directly from a Data Principal concerning Organisational Data, we will redirect it to the Organisation, which is responsible for responding. We will provide the Organisation with reasonable technical assistance to fulfil access, correction, and erasure requests relating to Organisational Data. The Organisation acknowledges that emails already sent from the Service cannot be recalled by us, and that erasure of content within the Service does not delete copies held in recipients' mailboxes or in the Organisation's own mailbox.

11. Audits

We will make available information reasonably necessary to demonstrate compliance with this DPA. The Organisation may request a third-party audit, on reasonable notice and no more than once in any 12-month period, at the Organisation's expense, subject to confidentiality and security constraints. We may satisfy an audit request by providing audit reports, security certifications, or written summaries in place of an on-site audit, where reasonable. 

12. Data Retention and Deletion on Termination

Upon termination of the Organisation's use of the Service:

• The Organisation may export its Organisational Data for 30 days following termination;

• On termination (or earlier, if the Organisation disconnects its mailbox) we will stop accessing the mailbox and delete the stored mailbox credentials (OAuth tokens and any application-specific or account passwords). Emails, copies and "Intauryx" labels already in the Organisation's mailbox remain with the Organisation and are not removed by us;

• After that period, we will delete Organisational Data from production systems, unless retention is required by law, contract, or a legal hold; and

• Deletion from backup systems will be completed within 90 days of the production deletion.

13. Liability

Each party's liability under this DPA is subject to the limitations set out in the Terms and Conditions, save that nothing in this DPA excludes or limits liability for wilful misconduct or gross negligence.

14. Term

This DPA takes effect when accepted by the Organisation's Administrator on behalf of the Organisation and continues until all Organisational Data has been deleted or returned in accordance with Section 12. Provisions relating to confidentiality, liability, and audit rights survive termination.

15. Governing Law and Precedence

This DPA is governed by the laws of India, on the same basis as the Terms and Conditions. In the event of a conflict between this DPA and the Terms and Conditions or Privacy Policy on a matter concerning the processing of Organisational Data, this DPA shall prevail.

16. Contact

For questions about this Data Processing Addendum, please contact:

Email: support@intauryx.com  (Subject: "DPA Inquiry")

Schedule A: Sub-processors

Schedule current as of: 07 November 2026

This Schedule forms part of, and is incorporated into, the Data Processing Addendum. It lists our current sub-processors. It may be updated by us from time to time to reflect new sub-processors or changes to existing ones (including changes to the specific AI models used), in accordance with Section 7.4 of this DPA. Such updates take effect on notice as described in Section 7.4 and do not require the Organisation to re-execute or separately re-accept this DPA.

The email service provider that hosts an Organisation's connected mailbox is the Organisation's own service provider, engaged by the Organisation, and is not our sub-processor. It is therefore not listed in this Schedule.

Sub-processors:

Google Cloud Platform, operated by Google Cloud India Private Limited (having transitioned from Google Asia Pacific Pte Ltd)

Role / purpose: Application hosting, database, and storage infrastructure for the Service

Data processed: All personal data processed through the Service (Account Information, Usage Information, and Organisational Data)

Location of processing: India — Mumbai (GCP region asia-south1)

Ollama Inc.

Role / purpose: AI/LLM inference for AI Features, via the Ollama Cloud service, using: NVIDIA Nemotron 3 Super (general chat, RAG, SQL generation), OpenAI gpt-oss 120B (legal and tax-related drafting and guidance), and Google Gemma 4 (vision/document-image processing)

Data processed: Content submitted to AI Features, after the redaction/masking process described in Section 7.3

Location of processing: Outside India — Ollama Inc.'s cloud inference infrastructure, located across the United States, European Union, and Asia-Pacific regions. The specific region used for a given request is determined by Ollama's own routing and is not currently configurable by us.

Resend (resend.com)

Role / purpose: Email delivery API used to send system-generated emails from info@intauryx.com, such as account activation invitations and password-change links

Data processed: Recipient name and email address, and the content of the system email (for example, activation or password-change links)

Location of processing: Outside India — Japan (Tokyo, region ap-northeast-1)

Titan Email

Role / purpose: Email hosting for Intauryx's own mailboxes, info@intauryx.com and support@intauryx.com

Data processed: Emails sent to or received at these mailboxes, including support requests and privacy-related enquiries, and the names, email addresses and message content they contain

Location of processing: Outside India — Titan's hosting infrastructure, which may be located in the United States and other regions determined by Titan

Fast2SMS

Role / purpose: SMS delivery API used to send one-time passwords and other SMS notifications

Data processed: Mobile number and SMS message content (for example, the one-time password)

Location of processing: India

Jio TrueConnect (Reliance Jio Infocomm Limited)

Role / purpose: DLT (Distributed Ledger Technology) platform for registration of our SMS sender IDs and message templates under telecom regulations, and through which our SMS messages are sent

Data processed: Registered SMS sender IDs and templates, recipient mobile numbers and SMS message content

Location of processing: India