Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between Klivo, a brand of Fidevia Technologies, a partnership firm ("Klivo", "we", "us", or "our"), and the customer ("Customer", "you") for the provision of the Services. It sets out the terms on which Klivo processes personal data on the Customer's behalf. This page reflects our standard DPA. The controlling version is the DPA executed with your organization and incorporated into the Master Services Agreement ("MSA"). In the event of any conflict between this DPA and the MSA, this DPA governs with respect to the processing of personal data, except where the MSA expressly states otherwise. Capitalized terms not defined here have the meaning given in the MSA or the Terms of Service.

1. Definitions

"Applicable Data Protection Law" means all laws and regulations applicable to the processing of personal data under this DPA, including the Digital Personal Data Protection Act, 2023 (India) ("DPDP"), the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR, and the California Consumer Privacy Act ("CCPA"), each as applicable. "Personal Data", "processing", "controller", "processor", "data subject", and "personal data breach" have the meanings given under Applicable Data Protection Law; "controller" includes "data fiduciary" and "data subject" includes "data principal" under DPDP. "Customer Personal Data" means personal data that Klivo processes on the Customer's behalf in providing the Services. "Sub-processor" means any third party engaged by Klivo to process Customer Personal Data.

2. Roles of the parties

For Customer Personal Data processed by Klivo in providing the Services, the Customer is the controller (or data fiduciary under DPDP) and Klivo is the processor (or data processor). Where the Customer is itself acting as a processor for a third-party controller, Klivo is a sub-processor. For personal data Klivo collects and determines the purpose of directly, such as data from its marketing website and sales activities, Klivo is the controller, and that processing is governed by Klivo's Privacy Policy rather than this DPA. Each party is responsible for its own compliance with Applicable Data Protection Law in its respective role.

3. Scope and instructions for processing

Processing Instructions and Legal Requirements

Klivo will process Customer Personal Data only on the documented instructions of the Customer, including as set out in this DPA, the MSA, and the Customer's configuration and use of the Services, unless required to process by law, in which case Klivo will inform the Customer of that legal requirement before processing, where legally permitted. The Customer instructs Klivo to process Customer Personal Data as necessary to provide, secure, maintain, support, and improve the Services, and as further instructed through the Customer's use of the Services.

Customer Responsibility and Compliance

The Customer is solely responsible for ensuring that its instructions and its use of the Services comply with Applicable Data Protection Law, and that it has a lawful basis and all necessary consents and notices for the processing. Klivo will inform the Customer if, in its reasonable opinion, an instruction infringes Applicable Data Protection Law, but Klivo is under no obligation to monitor the Customer's compliance.

4. Nature and purpose of processing, data, and data subjects

The subject matter of the processing is the provision of the Services. The nature and purpose of the processing is the hosting, storage, transmission, and processing of Customer Personal Data as needed to deliver the Services. The duration of processing is the term of the MSA plus any period required for return or deletion under this DPA. The categories of Customer Personal Data depend on the Customer's configuration and use of the Services and may include identifiers, contact and business details, employment information, conversation and interaction transcripts, and other content submitted by the Customer or its end users into the Services. The categories of data subjects may include the Customer's employees, contractors, agents, and the Customer's own end users. The Customer must not submit special categories of personal data, or protected health information subject to HIPAA, unless expressly agreed in writing (including, for HIPAA, a signed Business Associate Agreement), and the Customer is solely responsible if it does so without such agreement.

5. Confidentiality

Klivo will ensure that persons authorized to process Customer Personal Data are bound by appropriate confidentiality obligations and are made aware of the confidential nature of the data. Klivo will limit access to Customer Personal Data to personnel who need it to provide the Services.

6. Security measures

Encryption and Access Controls

Klivo maintains a security program with administrative, technical, and physical safeguards designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, appropriate to the risk. These measures include encryption of data in transit and at rest, access controls on a least-privilege basis, authentication controls for administrative access, logical tenant separation, logging, and vulnerability management.

Compliance Frameworks

Klivo's practices are aligned with recognized enterprise security frameworks including SOC 2 and ISO 27001, and the Services run on cloud infrastructure operated by established providers that are independently audited against those standards. Klivo undergoes independent web application penetration testing, most recently in October 2026. Klivo does not represent that it currently holds its own SOC 2 or ISO 27001 certification. Klivo may update its security measures from time to time provided the level of protection is not materially reduced.

7. Sub-processors

The Customer provides general authorization for Klivo to engage Sub-processors to process Customer Personal Data in connection with the Services, including providers of cloud infrastructure, model hosting, observability, security, communications, and email delivery. Klivo maintains a current list of Sub-processors and will make it available to the Customer on request. Klivo will impose data protection obligations on each Sub-processor that are substantially similar to those in this DPA, and remains responsible for its Sub-processors' performance of those obligations. Klivo will give the Customer reasonable prior notice of the addition or replacement of a Sub-processor and a reasonable period to object on legitimate data protection grounds. If the Customer objects and the parties cannot resolve the objection, the Customer's sole remedy is to terminate the affected Services in accordance with the MSA.

8. International transfers

Klivo processes and stores Customer Personal Data primarily in India, and also in the United States, and may transfer it to, or process it in, other locations where Klivo or its Sub-processors operate, including where a Customer requires a specific region at deployment. Where such transfers are subject to GDPR or UK data protection law and are made to a country without an adequacy decision, Klivo relies on appropriate safeguards, including the EU Standard Contractual Clauses (2021) and the UK International Data Transfer Addendum, together with supplementary measures as appropriate. The Customer authorizes such transfers as part of its instructions.

9. Assistance to the Customer

Data Subject Rights and Compliance Support

Taking into account the nature of the processing and the information available to Klivo, Klivo will provide the Customer with reasonable assistance to: (a) respond to requests from data subjects exercising their rights of access, correction, deletion, restriction, objection, and portability under Applicable Data Protection Law; (b) meet the Customer's obligations to keep Customer Personal Data secure; (c) notify personal data breaches and, where required, communicate them to data subjects; and (d) carry out data protection impact assessments and prior consultations where required.

Request Handling and Fees

Where a data subject sends a request directly to Klivo relating to the Customer's processing, Klivo will, where lawful, direct the data subject to the Customer and will not respond substantively except on the Customer's instructions. Klivo may charge a reasonable fee for assistance that is beyond the scope of what Applicable Data Protection Law requires a processor to provide without charge.

10. Personal data breach notification

Klivo will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and in any event within the timelines required by Applicable Data Protection Law. The notification will include the information reasonably available to Klivo to help the Customer meet its own notification obligations. Klivo will take reasonable steps to mitigate the effects of the breach. Klivo's notification of, or response to, a breach is not an acknowledgment of fault or liability.

11. Return and deletion of data

Upon termination or expiry of the Services, Klivo will, at the Customer's choice, return or delete Customer Personal Data within a reasonable period, and delete existing copies, except to the extent Klivo is required to retain the data by applicable law or for the establishment, exercise, or defense of legal claims. Where the Customer has an export option within the Services, the Customer is responsible for exporting its data before termination. Data retained in routine backups is deleted in the ordinary course of Klivo's backup cycle.

12. Audits

Klivo will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA. To satisfy audit rights under Applicable Data Protection Law, Klivo will provide, on request and subject to confidentiality, its security overview documentation and, where available, the relevant independent audit reports of its cloud infrastructure providers. Klivo does not provide its own SOC 2 or ISO 27001 audit report, as its own certification program is maturing. Where a Customer's regulator or Applicable Data Protection Law requires an on-site or additional audit that these materials do not satisfy, such audit will be conducted no more than once per twelve months, on reasonable prior written notice, during business hours, subject to confidentiality, in a manner that does not disrupt Klivo's operations, at the Customer's cost, and not extending to Klivo's confidential information or other customers' data.

13. Liability

Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the MSA or the Terms of Service, and any reference in those documents to a party's liability means the aggregate liability of that party under the MSA, the Terms, and this DPA together. Nothing in this DPA increases a party's liability beyond the caps and exclusions agreed between the parties.

14. General

This DPA is governed by the same law and dispute resolution provisions as the MSA, and where none is specified, by the laws of India with disputes resolved by arbitration seated in Mumbai. If any provision of this DPA is found unenforceable, the remainder continues in effect. In the event of a conflict between this DPA and the MSA regarding the processing of personal data, this DPA prevails. This DPA does not create third-party beneficiary rights. Klivo may update this DPA to reflect changes in Applicable Data Protection Law or its processing practices, provided the level of protection for Customer Personal Data is not materially reduced, and the controlling version remains the DPA signed with your organization.

15. Contact

For questions about this DPA or to request Klivo's current Sub-processor list or security documentation, contact support@getklivo.com, or write to Fidevia Technologies, 7th Floor, Skyline Icon, Andheri-Kurla Road, Chimatpada, Marol, Andheri East, Mumbai 400059, India.