This Data Processing Addendum ("DPA") forms part of the agreement between Saney Pvt. Ltd. ("Saney") and the business customer ("Customer") that uses the Saney service under our Terms (the "Agreement"). By accepting the Terms, Customer agrees to this DPA. Customers who need a countersigned copy can request one at info@saney.io.

This DPA applies when Saney processes personal data on Customer's behalf, mainly data about Customer's own customers who chat with Customer's bot, message Customer's connected channels, or order from Customer's storefront.

• Customer Personal Data means personal data that Saney processes on Customer's behalf while providing the service.
• Data Protection Laws means the laws that apply to that processing, which may include Nepal's Individual Privacy Act, 2075 (2018), the EU and UK GDPR, and US state privacy laws.
• Controller, processor, data subject, personal data, and processing have the meanings given in the GDPR.
• Security Incident means a breach of Saney's security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
• Subprocessor means a third party that Saney engages to process Customer Personal Data.

Customer is the controller of Customer Personal Data, and Saney is its processor. Saney is a separate controller only for the account, billing, and usage data described in our Privacy Policy.

Saney will process Customer Personal Data only to provide the service, on Customer's documented instructions. The Agreement, this DPA, and Customer's configuration of the service (such as bot instructions, connected channels, and storefront settings) are Customer's complete instructions. Saney will tell Customer if it believes an instruction breaks Data Protection Laws.

Customer is responsible for:

• having a lawful basis for the processing, and giving its customers the notices and obtaining the consents that the law requires, including notice that they are talking to an AI chatbot where required;
• complying with Meta's platform terms and WhatsApp Business policies for the channels it connects;
• not using the service to collect sensitive data (such as health, financial account, or government ID numbers) unless the Agreement expressly allows it;
• keeping its own account credentials secure and controlling who on its team has access.

Saney will make sure that staff with access to Customer Personal Data are bound by confidentiality obligations and access only what they need for their role.

Saney will maintain the technical and organizational security measures described in Annex 2.

Saney will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe the incident, its likely impact, and the steps Saney is taking. Saney will reasonably help Customer meet its own notification duties.

Customer generally authorizes Saney to use subprocessors. The current list is on our Subprocessors page. Some subprocessors, such as AI model providers, are listed there by category and location; Saney will give Customer their names on request to info@saney.io.

Saney will bind each subprocessor to data protection terms at least as protective as this DPA, including a prohibition on using Customer Personal Data to train its own AI models. Saney remains responsible for its subprocessors' performance.

Saney will update the Subprocessors page and notify Customer by email at least 14 days before adding or replacing a subprocessor, including one listed by category. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer may terminate the affected part of the service and receive a pro-rata refund of prepaid fees for it.

If Saney receives a request from one of Customer's customers, Saney will forward it to Customer and will not respond directly unless Customer authorizes it or the law requires it. Saney will reasonably help Customer respond, including through the access, export, and deletion features in the service.

Saney will not use Customer Personal Data to train, fine-tune, or develop AI models, and will prohibit its AI model providers from doing so. Saney's AI features generate replies and assessments to help Customer serve its customers. They do not make decisions with legal or similarly significant effects on individuals unless Customer configures them to, in which case Customer is responsible for that use.

Saney and its subprocessors may process Customer Personal Data outside the country where it was collected, as described on the Subprocessors page. Where the GDPR or UK GDPR requires it, the parties agree that transfers are governed by the EU Standard Contractual Clauses (Module 2 or Module 3, as applicable) and the UK International Data Transfer Addendum, which are incorporated into this DPA by reference.

Saney will provide information reasonably needed for Customer to carry out data protection impact assessments and to demonstrate compliance with this DPA. Once a year, on 30 days' written notice, Customer may request a written description of Saney's security practices or, where required by law, an audit. Audits will be at Customer's cost, during business hours, and subject to confidentiality.

When the Agreement ends, Customer can export its data from the dashboard for 30 days. After that, Saney will delete Customer Personal Data within 30 days, except where the law requires Saney to keep it. Data in backups is deleted as the backups are overwritten.

This DPA lasts as long as Saney processes Customer Personal Data. If this DPA conflicts with the Agreement, this DPA prevails for data protection matters. The limitation of liability in the Agreement applies to this DPA. Saney may update this DPA when needed to comply with Data Protection Laws and will notify Customer of material changes.

• Subject matter and duration: providing the Saney service for the term of the Agreement.
• Nature and purpose: hosting, storing, and analyzing conversations; generating AI replies; managing contacts, leads, and orders; delivering messages through connected channels.
• Data subjects: Customer's customers, prospects, and website visitors who interact with Customer's bot, channels, or storefront; Customer's team members.
• Categories of data: names, phone numbers, email and delivery addresses, social media profile names and IDs, message content, images and files sent in chat, order and payment status, and custom fields configured by Customer.
• Sensitive data: none intended. Customer must not configure the service to collect sensitive data unless agreed in writing.
• Frequency: continuous.

• Encryption of data in transit with TLS and encryption at rest provided by our cloud infrastructure.
• Authentication through Clerk, with role-based access inside each workspace.
• Restricted staff access to production systems, limited to people who need it.
• Logical separation of each customer's data by workspace.
• Logging and monitoring of production systems.
• Regular backups and the ability to restore service.
• Vendor review before engaging a new subprocessor.