Data Processing Addendum

This Data Processing Addendum ("DPA") is part of your agreement with Zunderdog LLP, Velsao, P.O. Cansaulim, Goa 403712, India, which runs ZunderFlow ("we" or "us"). "You" or the "merchant" is the business that subscribes to the ZunderFlow platform. This DPA explains how we handle personal data for you. The Digital Personal Data Protection Act, 2023 (the "DPDP Act", whose main duties start in 2027) asks for a written contract like this between a business and the company that handles data for it.

It covers personal data that we process for you through the Partner App, the Client App and the Rider App: the data of your customers, riders, staff and sales agents ("Merchant Personal Data"). It doesn't cover personal data we collect through our own website or the details we need to run your account, such as the name, phone number and email address of the people who sign your order form, pay invoices or ask us for support. Our Privacy Policy covers those and we are responsible for them.

Roles. For Merchant Personal Data you decide why and how it is processed. You are the data fiduciary (and the "controller" where the UK GDPR or EU GDPR applies). We are your data processor.

When it applies. It applies from the day you sign an order form that refers to it or accept the Terms & Conditions or start using the platform. If you already use the platform when we send you the email about the new Terms, this DPA applies to you from the date in that email. It ends when we have deleted the data under section 9. If you need a signed copy ask at privacy@zunderflow.com.

• We process Merchant Personal Data only on your documented instructions. These are: this DPA; the agreement; what you and your users do in the platform or through its API; and your reasonable written instructions that fit how the platform works.
• We don't sell Merchant Personal Data or use it for our own marketing.
• If we think an instruction breaks the law we will tell you. We may pause carrying it out until you withdraw or change it or show us it is lawful.
• If a court or authority asks us for Merchant Personal Data we tell you first unless the law stops us. We give only what the order requires.
• You are responsible for your instructions being lawful and for giving your customers, riders and staff the notices and getting the consent that the law requires. The Terms & Conditions say more.

Only people at Zunderdog LLP who need Merchant Personal Data to run, support or secure the platform can reach it. Each is bound by a duty of confidentiality.

We protect Merchant Personal Data with reasonable security safeguards. At the date of this DPA they include:

• HTTPS (TLS) for traffic to and from the platform;
• role-based access so each role sees only what it needs, with sign-in by one-time code sent to the user's phone number and an account lock after repeated failed attempts;
• separation of each merchant's data from other merchants' data;
• access to production data limited to authorised people who need it;
• regular automated backups and logs of key actions such as sign-ins, setting changes and orders;
• tools for you to control your own users' access and permissions.

We may improve these measures over time and won't make the overall protection materially weaker. Our Security page describes our approach in general terms. It isn't part of this DPA.

You authorise us to use these sub-processors to process Merchant Personal Data. Each is bound by written terms that protect the data in substance as this DPA does. For some providers those are the provider's standard terms. We stay responsible to you for what they do.

Services that you connect, such as Zoho Inventory, Tally, Razorpay or another payment gateway or Google Maps, are your own providers and not our sub-processors. We send them data only because you switched them on.

Changes. We email you at least 30 days before a new sub-processor starts handling Merchant Personal Data. Moving from one provider to another in the same row above counts as adding a sub-processor and gets the same notice. We give shorter notice only to replace one that has failed or is unsafe and then we tell you as soon as we can.

Objecting. If you object on reasonable data protection grounds within that time, tell us at the notices address. We will try not to use the new sub-processor for your data until we have answered you. We answer within 14 days. If we can't resolve it, you may end the affected service within 30 days after our answer and we refund the prepaid fees for it for the period after it ends. The list above is always the current one. Where it describes a provider by what it does we give you its name within 7 days of a request to privacy@zunderflow.com.

• If someone asks us about their data in your account we tell them to ask you and we pass the request to you within 7 days. We don't answer it ourselves unless the law makes us.
• The platform lets you find, correct, export and delete data. Where the tools don't cover a request we give you reasonable help to answer it. If that takes unusual effort we may ask for a reasonable fee that we agree with you first.
• We also help you, as far as it concerns our processing, to deal with grievances, with nominations under the DPDP Act and with the other duties the law puts on you as the data fiduciary.

We tell you without undue delay after we become aware of a personal data breach affecting Merchant Personal Data. We aim to do so within 48 hours. Our notice says, as far as we know:

• what happened and when;
• what data and roughly how many people are affected;
• the likely consequences;
• what we have done and what we suggest you do;
• who to contact.

We keep you updated as we learn more and help you investigate and contain it. As the data fiduciary you decide how to notify the Data Protection Board of India and the people affected and whether you must report to CERT-In yourself. We give you what you need to do it. We report to CERT-In ourselves any incident on our own systems that the law makes us report. That can be before we have told you.

• Export. For 30 days after your subscription ends you can export your data from the platform in a common format. If the agreement ended because you didn't pay we open the account for export once the invoices that are overdue and not disputed in good faith are paid. The sum in the Terms & Conditions for ending the agreement early isn't a condition of export. You then have 30 days or the time left until day 120 after the agreement ended if that is shorter.
• Deletion. We delete Merchant Personal Data within 90 days after the export period ends. We delete it on day 120 after the agreement ended at the latest. This includes copies in our support mailbox. On your written instruction we also delete the data you name, apart from backups, which roll over. We confirm in writing if you ask. We keep only what the law requires us to keep. Copies in backups are overwritten in the normal backup cycle and aren't used meanwhile.
• Earlier. You can delete data yourself at any time with the platform's tools.

On request and no more than once a year we give you the information you reasonably need to check that we meet this DPA, such as answers to a security questionnaire.

You (or an independent auditor bound by confidentiality) may audit us if that information isn't enough or after a breach or when a regulator requires it. You give at least 30 days' written notice. The audit takes place in business hours. It doesn't reach other customers' data or our confidential information beyond what it needs. You pay its cost.

Our sub-processors may process Merchant Personal Data outside India and you agree to that. We will follow any restriction the Government of India puts on transfers to a particular country under section 16 of the DPDP Act.

If UK or EU data protection law applies to Merchant Personal Data and needs a transfer agreement we will agree the right clauses with you in good faith.

Liability under this DPA is governed by the liability section of the Terms & Conditions, including its cap on our liability.

If these documents conflict the order form comes first for what it covers. Next comes this DPA for personal data and then the Terms & Conditions. An order form changes this DPA only if it names the clause it changes.

We may update this DPA. We change the "Last updated" date and post the new version here. We email you at least 30 days before a material change takes effect, apart from a change the law requires sooner. If a change makes your position materially worse you can end your subscription as the Terms & Conditions say for a change to them.

Notices under this DPA go to the same addresses as notices under the Terms & Conditions. Questions about data protection go to our Grievance Officer, Zubin Souza, Founder & CEO, at privacy@zunderflow.com.