This Data Processing Addendum ("DPA") sets out standard terms between Eternyx Innovations Private Limited, registered in Bangalore, Karnataka, India ("Cllr"), and the business customer identified in an accepted order or services agreement ("Customer"). It becomes binding only when incorporated into that agreement or otherwise expressly accepted by both parties. Publication is not evidence that a DPA has been executed for a particular account. Contact connect@cllr.ai to arrange incorporation and the deployment schedules.
1. Scope and definitions
This DPA applies to personal data processed by Cllr on behalf of Customer to provide the contracted Services ("Customer Personal Data"). "Applicable Data Protection Law" means the privacy and data-protection laws applicable to that processing, including Indian legislation and rules to the extent their relevant provisions are in force. "Personal Data Breach" means a breach affecting the confidentiality, integrity or availability of Customer Personal Data within the meaning of applicable law. "Subprocessor" means a provider engaged by Cllr to process it on Customer's behalf.
Customer determines the purposes and means of its business workflows and acts as the Data Fiduciary or controller as applicable. Cllr acts as its processor for that data. Cllr's independently determined processing for account administration, billing, security and legal obligations is described in the Privacy Policy; it must have its own lawful basis and is not an unrestricted exception to this DPA. Carriers or customer-selected providers may have independent legal roles that must be identified in the schedule.
2. Processing instructions and required particulars
Cllr will process Customer Personal Data only on documented instructions in the agreement, processing schedule and authorised service configuration, unless law requires otherwise. Where lawful, Cllr will inform Customer of a legal requirement before processing. If an instruction appears to violate applicable law, Cllr will inform Customer and may pause the affected processing pending clarification. Customer must not instruct unlawful activity.
The agreed schedule must identify subject matter, duration, purposes, operations, categories of people and data, enabled channels, integrations, locations, retention, security requirements, authorised providers and contact details. Before sending data, Customer must confirm these particulars and any sector or jurisdiction restrictions with Cllr. Publishing these standard terms does not approve an unidentified provider or a restricted deployment.
Cllr will not sell Customer Personal Data or use it for unrelated advertising. General-purpose model training or unrelated product development using identifiable customer content requires a separately documented lawful authorisation; the standard service-processing permission alone does not supply it. The parties must verify and document relevant provider retention and training settings before transmitting data to that provider. Any use of anonymised statistics must prevent reasonably foreseeable re-identification and comply with law and the agreement.
3. Customer obligations
Customer is responsible for lawful collection and instructions, appropriate notices and permissions, data accuracy, minimisation, rights responses, sector requirements and determining the suitability of each deployment. Customer will provide only necessary data, protect its credentials, configure available access and retention controls, and keep instructions and contact information current. It must identify restricted data or residency requirements before processing begins. Both parties remain accountable for their own applicable obligations.
4. Confidentiality and security
Cllr will restrict access to persons who need it for authorised purposes and are bound by confidentiality duties, and maintain technical and organisational measures appropriate to the risks. Measures must address access management, protected transmission and storage, tenant access boundaries, logging, incident response and relevant data lifecycle controls, as specified in the agreed security schedule. Customer is responsible for controls within its own systems and configurations.
Security measures may evolve without materially reducing the agreed overall level of protection. The parties must document deployment-specific controls and any additional requirements. This DPA does not represent that an independent audit, penetration test, certification, particular recovery capability or universal privileged-user MFA is already in place. Roadmap features are not contractual safeguards unless expressly committed and implemented for the deployment.
5. Subprocessors
Customer authorises only the providers identified in the agreed subprocessor register, or subsequently authorised through its agreed change process. The register must give legal names, functions, relevant data categories, processing and access locations, and material retention or training restrictions. A list of functional categories is insufficient to authorise a provider.
Cllr will impose appropriate written data-protection and confidentiality obligations on subprocessors and remains responsible for their performance of the processing obligations required by applicable law and this DPA. For additions or replacements, Cllr will give advance notice under the agreed schedule and allow reasonable objections based on data-protection grounds. The parties will seek a practical alternative; if no compliant alternative is available, they will stop the affected processing and address the affected service and fees under their agreement. Urgent replacements must be handled through a lawful agreed process and communicated promptly.
6. Locations and international transfers
Cllr will comply with agreed location restrictions and applicable transfer requirements. All relevant storage, support access, backup, telemetry and provider locations must be considered; an India endpoint alone does not establish exclusive India residency. Where a transfer requires standard clauses, supplementary measures or another instrument, the parties must put it in place before the transfer. This India-centred DPA does not automatically incorporate EU standard contractual clauses, a UK addendum or a foreign-law certification.
7. Rights and regulatory assistance
Taking account of the nature of processing and information available, Cllr will reasonably assist Customer with applicable rights requests, grievances, security obligations, impact assessments and regulator enquiries. Cllr will promptly route requests concerning customer-controlled data to Customer and will not independently respond substantively or change its records except on authorised instructions or where law requires. Customer determines the lawful response and supplies timely directions.
The schedule must identify request-routing and escalation contacts and periods that support statutory deadlines. Reasonable charges may apply to exceptional assistance outside ordinary service scope if agreed in advance; assistance required to remedy Cllr's breach or satisfy Cllr's own mandatory obligations is not conditioned on such charges.
8. Personal Data Breaches
Cllr will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, through the agreed incident contact, and comply with applicable mandatory notification duties. Initial information may be incomplete. As information becomes available, Cllr will provide the nature and scope, affected data and people where known, likely consequences, mitigation and an appropriate contact, and will cooperate in containment and recovery.
Customer is responsible for its required notifications and decisions; Cllr remains responsible for its own reporting duties. Each party will preserve necessary evidence and coordinate communications where lawful. The schedule must state operational notification and update periods consistent with applicable deadlines. No universal seventy-two-hour initial reporting window is created by this DPA. Reporting an incident is not an admission of fault or liability.
9. Retention, return and deletion
Cllr will apply documented retention and deletion instructions consistent with applicable law. At the end of the Services, Cllr will, at Customer's choice and under the agreed schedule, return or delete Customer Personal Data and require applicable subprocessors to do the same, except legally required retention. The schedule must specify export format and availability, primary deletion windows, backup and provider lifecycles, residual-copy restrictions and any agreed charges.
Legally retained data will be restricted to the relevant purpose and protected until deletion is permitted. Residual backups must remain protected and follow their defined expiry; if restored, applicable deletion instructions must be reapplied before ordinary reuse. A primary-data retention setting is not a universal deadline for logs, consent evidence, backups or provider records. Cllr will provide reasonable confirmation of completed deletion based on available evidence when requested; no instant all-copy erasure is represented.
10. Evidence and audit
Cllr will make available information reasonably necessary to demonstrate its applicable processor obligations, subject to confidentiality, security and protection of other customers. Reviews should start with available documentation and remote evidence. Where further audit is required by law or reasonably justified, the parties will agree reasonable notice, scope, competent independent reviewers, access restrictions and scheduling that avoid unnecessary disruption. These arrangements must not prevent a legally required audit or regulator access.
Customer bears reasonable agreed costs of discretionary audits; Cllr bears its remediation costs for its own non-compliance. No access to another customer's information, unrelated confidential technology or unapproved intrusive security testing is authorised. No existing ISO or SOC report is implied.
11. Deployment schedules
Before processing begins, the parties must complete and maintain the following schedules in their order or a separate written record:
| Schedule | Required particulars |
|---|---|
| Parties and instructions | Customer identity, authorised contacts, roles, purpose, duration, processing operations, data and data-subject categories; approved channels and integrations. |
| Security | Implemented safeguards, customer configuration duties, restricted-data controls, access and incident arrangements; any expressly agreed additional controls. |
| Providers and transfers | Named subprocessors, roles, data, all relevant countries, retention and training settings, contractual restrictions and required transfer instruments; change notice and objection process. |
| Lifecycle and response | Retention by category, lawful exceptions, export and deletion windows, backups and restoration, request handling, incident contacts and update periods, audit arrangements and agreed fees. |
These schedules are not replaced by marketing material or a sample architecture. Changes to purposes, restricted data or jurisdictions require review and documented agreement before the new processing.
12. Precedence and liability
This DPA prevails over inconsistent general service terms for Customer Personal Data processing. A signed negotiated DPA or mandatory transfer instrument prevails to the extent applicable. The Terms of Service govern commercial liability, exclusions and limits unless a signed agreement expressly varies them, and claims under this DPA form part of the same aggregate cap. Nothing excludes non-waivable data-subject rights, regulatory powers or obligations imposed directly by law. Obligations continue for retained Customer Personal Data until it is lawfully returned or deleted.