Data Processing Addendum

1. DEFINITIONS

For purposes of this DPA:

“Applicable Privacy Laws” means United States federal and state privacy and data security laws that apply to Docxster’s processing of Customer Personal Data. These include the California Consumer Privacy Act as amended by the California Privacy Rights Act, and its regulations (the “CCPA”); the Texas Data Privacy and Security Act; and the comprehensive privacy laws of other US states, such as those of Virginia, Colorado, Connecticut and Utah.

“Customer Personal Data” means Personal Data contained in Customer Data that Docxster processes on behalf of Customer in providing the Services. It includes Personal Data in documents, emails, messages and attachments that Customer connects or uploads to the Services, and data extracted from them.

“Business,” “Controller,” “Service Provider,” “Processor,” “Consumer,” “Sell,” “Share,” “Business Purpose,” and “Process” have the meanings given in Applicable Privacy Laws. Where a law uses “controller” or “processor,” Customer is the controller and Docxster is the processor.

“Security Incident” means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Customer Personal Data in the possession or control of Docxster or its Sub-processors.

“Security Documentation” means the security summaries and related materials that Docxster makes available to Customer on request.

“Sub-processor” means any third party, including a Docxster affiliate, that Docxster engages to process Customer Personal Data in connection with the Services.

2. ROLES, SCOPE AND PURPOSE

2.1 Roles

Customer is the Business (controller) and Docxster is its Service Provider (processor) for Customer Personal Data.

2.2 Business Purposes

Docxster processes Customer Personal Data only for the specific Business Purposes in Annex A. These are to find, receive, classify, extract, validate and route data from Customer’s business documents; to deliver that data to the systems Customer chooses (such as ERP, CRM or spreadsheet integrations); and to provide, secure and support the Services, as the Agreement and Customer’s instructions describe.

2.3 Duration

Processing lasts for the Subscription Term, plus the period needed to export and delete data under Section 12.

2.4 Details

Annex A lists the types of Personal Data, the categories of Consumers, and the nature of the processing.

3. CUSTOMER INSTRUCTIONS AND RESPONSIBILITIES

3.1 Instructions

Docxster will process Customer Personal Data only on Customer’s documented instructions. The Agreement, this DPA, and Customer’s configuration and use of the Services are Customer’s complete instructions. Customer must agree any further instructions with Docxster in writing.

3.2 Unlawful Instructions

Docxster will tell the Customer if it believes an instruction violates Applicable Privacy Laws. Docxster may pause the affected processing until the Parties resolve the issue.

3.3 Customer’s Responsibilities

Customer is responsible for the rights, notices, permissions and consents described in Sections 4 and 6.3 of the Agreement. This includes having a lawful basis to share Customer Personal Data with Docxster, the accuracy of that data, and the documents and integrations Customer connects to the Services.

3.4 Sensitive Data

Customers will not submit protected health information governed by HIPAA, or payment card data, unless the Parties first agree in writing on additional safeguards.

4. CCPA/CPRA SERVICE PROVIDER TERMS

For Customer Personal Data subject to the CCPA, Docxster is a Service Provider and agrees that it will:

1. not sell or share Customer Personal Data;

2. use it only for the specified Business Purposes. Docxster will not retain, use or disclose Customer Personal Data for any purpose other than the Business Purposes in Annex A, or as the CCPA otherwise permits;

3. stay inside the relationship. Docxster will not retain, use or disclose Customer Personal Data outside the direct business relationship between Docxster and Customer;

4. not combine it. Docxster will not combine Customer Personal Data with personal information it receives from or on behalf of another person, or collects from its own interactions with consumers, except as the CCPA permits;

5. comply with the CCPA. Docxster will comply with the CCPA provisions that apply to service providers and give the same level of privacy protection the CCPA requires of Customer;

6. tell the customer if it cannot comply. Docxster will notify Customer within ten (10) business days if it determines that it can no longer meet its CCPA obligations;

7. let Customer verify and remediate. Customers may take reasonable and appropriate steps to confirm that Docxster uses Customer Personal Data consistently with the CCPA. On notice, Customer may take reasonable and appropriate steps to stop and remediate any unauthorized use;

8. support consumer requests, as Section 9 describes; and

9. support Customer’s regulatory duties. On request, Docxster will give reasonable help with Customer’s cybersecurity audits, risk assessments and automated decision-making technology obligations under the CCPA regulations, to the extent the Services are relevant.

Customers may disclose Customer Personal Data to Docxster only for the limited and specified Business Purposes in Annex A. Docxster certifies that it understands these restrictions and will comply with them.

Docxster will not use Customer Personal Data to build or improve its own products or AI models, or to build a profile about any Consumer (see Section 14).

5. OTHER US STATE PRIVACY LAWS

To the extent other Applicable Privacy Laws, including the Texas Data Privacy and Security Act, treat Docxster as a processor, Docxster will:

1. process Customer Personal Data only under Customer’s instructions, for the purposes in Annex A, and for the duration in Section 2.3;

2. make sure each person who processes Customer Personal Data is bound by a duty of confidentiality;

3. engage Sub-processors only under Section 8, with written contracts that impose the same obligations;

4. give reasonable help with consumer requests, security, Security Incident notice, and data protection assessments, as Sections 9 to 11 describe;

5. at Customer’s choice, delete or return Customer Personal Data at the end of the Services (Section 12); and

6. make available the information needed to show that it is meeting these obligations, and allow reasonable audits (Section 11).

If a processor-specific duty is not met by this DPA, the Parties will add it by written amendment.

6. CONFIDENTIALITY AND PERSONNEL

Docxster will limit access to Customer Personal Data to employees, contractors and Sub-processors who need it to provide the Services. Each of them must be bound by written confidentiality duties that continue after their engagement ends. Docxster will give them appropriate privacy and security training. Section 8 of the Agreement also applies to Customer Data.

7. SECURITY

7.1 Safeguards

Docxster will maintain reasonable administrative, technical and physical safeguards that fit the risk and nature of Customer Personal Data, including those in Annex B. These are designed to protect it from unauthorized or unlawful access, use, loss, alteration or disclosure.

7.2 Updates

Docxster may update its safeguards over time, but will not materially reduce the overall level of protection during the Subscription Term.

7.3 Customer’s Part

As Section 9 of the Agreement provides, the Customer is responsible for securing its own environment. This includes its accounts, credentials, and connected email, messaging and ERP systems, and managing which Authorized Users it grants access to the Services.

8. SUB-PROCESSORS

8.1 General Authorization

Customer authorizes Docxster to use the Sub-processors listed in Annex C, including Docxster’s India-based affiliate. Docxster’s current list is also available at sub-processor-list or on request.

8.2 Flow-down

Docxster will bind each Sub-processor by a written contract that meets the CCPA’s requirements and imposes data protection duties no less protective than this DPA. Docxster remains responsible for its Sub-processors’ performance of those duties.

8.3 Changes

Docxster will give Customer at least thirty (30) days’ notice before adding or replacing a Sub-processor, by updating its Sub-processor list or by email to Customer’s notice contact in the Order Form.

8.4 Objection

Customers may object on reasonable data protection grounds within fifteen (15) days of notice. The Parties will work in good faith to resolve the objection. If they cannot, customers may terminate the affected Services and receive a pro-rata refund of prepaid fees for the unused period.

9. CONSUMER REQUESTS

9.1 Forwarding

If Docxster receives a request from a Consumer about Customer Personal Data (to know, access, correct, delete, port, or opt out), it will not respond directly except to tell the Consumer to contact Customer. Docxster will pass the request to the Customer within five (5) business days.

9.2 Assistance

Taking into account the nature of the Services, Docxster will give Customer the tools and reasonable help it needs to respond to these requests. This includes locating, correcting, exporting or deleting the relevant information. When a correction is made, Docxster will help make sure it stays corrected.

9.3 Cost

Docxster provides this help at no extra charge unless a request needs effort beyond what is reasonable. In that case, Docxster may charge reasonable fees after telling the customer in advance.

10. SECURITY INCIDENTS

10.1 Notice

Docxster will notify Customer without undue delay, and in any event within 72 hours, after confirming a Security Incident, as Section 9 of the Agreement also provides. Docxster will send the notice to the security or notice contact in the Order Form or Annex A.

10.2 Content

The notice will describe the Security Incident and, as far as known, the types of information and approximate number of Consumers affected, the likely consequences, and the steps Docxster has taken or proposes. Docxster will provide updates as further relevant information becomes available.

10.3 Response

Docxster will promptly investigate, contain and remediate the Security Incident, and give Customer reasonable cooperation so that Customer can meet its own legal notification duties.

10.4 Notifications

Unless law requires Docxster to notify directly, the customer decides whether and how to notify Consumers and regulators. Customers will give Docxster a chance to review any public statement that names Docxster. A notice or response to a Security Incident is not an admission of fault.

11. AUDITS AND ASSESSMENTS

11.1 Information First

On Customer’s reasonable written request, Docxster will give Customer the information needed to show compliance with this DPA, such as the Security Documentation, summaries of its security testing, and any independent audit report or certification it holds.

11.2 Assessments

Customers may carry out an audit or assessment if (a) the information above does not reasonably answer its questions, (b) a Security Incident has occurred, or (c) a regulator requires it. Customers must give at least thirty (30) days’ written notice, scope the audit in advance, run it during business hours, and not run it more than once every twelve (12) months unless a regulator or a Security Incident requires otherwise.

11.3 Conditions

Auditors must be bound by confidentiality, must not access other customers’ data, and must not unreasonably disrupt Docxster’s operations. Each Party bears its own costs, but Customer will reimburse Docxster’s reasonable costs for audits beyond the first in a year.

11.4 Assessments Required by Law

Docxster will give reasonable help with Customer’s data protection assessments, risk assessments and regulator enquiries about the Services.

12. RETURN AND DELETION

12.1 During the Term

Customers can export or delete its Customer Personal Data through the Services at any time.

12.2 At the End

For 30 days after expiration or termination of the applicable Order Form, Customer may export Customer Personal Data using the Services’ export functionality or by written request to Docxster, as Section 19 of the Agreement provides. After that period, Docxster will delete Customer Personal Data within 90 days and will confirm deletion in writing on Customer’s request.

12.3 Backups

Copies in encrypted backups will be overwritten in the normal backup cycle, within ninety (90) days after deletion, and stay protected by this DPA until then.

12.4 Retention

Docxster may keep limited copies of Customer Personal Data only as Section 19 of the Agreement permits: where reasonably necessary to comply with law, resolve disputes, maintain security records, or satisfy backup and disaster-recovery processes. Docxster will keep them confidential and protected under this DPA for as long as it holds them.

13. INDIA AFFILIATE AND CROSS-BORDER PROCESSING

13.1 Location

Docxster’s engineering, support and operations teams are based in India. Docxster’s India-based affiliate, Docxster Private Limited, a company incorporated in India with its principal place of business at 9C, Block 1, HRBR Layout, Bengaluru, Karnataka 560045 (“Docxster India”), may access and process Customer Personal Data as a Sub-processor, from India, to provide the Services. Customer Personal Data is hosted on Amazon Web Services in the US East region (United States).

13.2 Same Standard

Docxster has a written agreement with Docxster India that requires it to meet the obligations in this DPA, including the CCPA service provider terms in Section 4. Docxster remains responsible for Docxster India’s compliance.

13.3 Access Controls

Docxster India personnel access Customer Personal Data only through Docxster’s controlled systems, only as far as needed for their role, and subject to the safeguards in Annex B.

13.4 Other Transfers

Docxster will not move Customer Personal Data to any other country except to a Sub-processor in Annex C, or as updated under Section 8.

14. AI AND NO-TRAINING COMMITMENT

14.1 No Training

Docxster will not use Customer Personal Data, or any documents or data that Customer submits, to train, fine-tune, evaluate or improve any artificial-intelligence, machine-learning, or OCR model, whether Docxster’s own or a third party’s. This Section applies in place of the exceptions in Section 6.4 of the Agreement for Customer Personal Data.

14.2 Third-Party AI

If Docxster uses a third-party AI or OCR provider as a Sub-processor, listed in Annex C, Docxster will make sure that provider is contractually barred from retaining Customer Personal Data beyond what it needs to deliver the output, and from using it to train its models.

14.3 Output

Extracted data and validation results are Customer Data and are covered by this DPA. Section 21 of the Agreement continues to govern Customer’s review of automated outputs.

14.4 Human Review

Where the Services route low-confidence extractions to human review, Docxster staff will access the content under review only if Customer asks for support in writing, and only as far as needed to resolve the request.

15. GENERAL TERMS

15.1 Liability

Each Party’s liability under this DPA is subject to the limitations and exclusions in Section 24 of the Agreement.

15.2 Term

This DPA starts on the Effective Date and lasts as long as Docxster processes Customer Personal Data. Sections that by nature should survive, including those on deletion, confidentiality and liability, survive termination.

15.3 Changes in Law

If Applicable Privacy Laws change in a way that requires different terms, the Parties will negotiate in good faith to amend this DPA. Docxster may update this DPA to reflect legal requirements by giving Customer thirty (30) days’ notice, and Customer may object on reasonable grounds. Section 27 of the Agreement otherwise governs changes.

15.4 Order of Precedence

If there is a conflict, this order applies: (1) any terms that Applicable Privacy Laws require, (2) this DPA including its Annexes, and (3) the Agreement. Section 1.4 of the Agreement continues to apply to the Order Form, the SLA and other documents.

15.5 Governing Law and Venue

Section 31 of the Agreement (Texas law, and the state and federal courts located in Travis County, Texas) applies to this DPA.

15.6 Notices

Section 32 of the Agreement applies to notices under this DPA. Privacy questions for Docxster may be sent to support@docxster.com.

15.7 Other Terms

Sections 34 (Severability), 35 (Waiver) and 36 (Entire Agreement) of the Agreement apply to this DPA.

15.8 Acceptance

This DPA does not require a separate signature. It is accepted when a customer signs or otherwise accepts an Order Form that incorporates it, as described in Section 1.3 of the Agreement.

ANNEX A: DETAILS OF PROCESSING