Data processing addendum

This Data Processing Addendum ("DPA") is entered into between Phyto Nex LLP, a limited liability partnership registered in India under the Limited Liability Partnership Act, 2008 with its registered office at 1209 Orange Street, Wilmington, DE 19801 and its principal place of business at 312, Thiruvalluvar Street, Vellakinar Pirivu, Gnanambika Mills, Coimbatore North, Coimbatore, Tamil Nadu 641029, India ("Phyto Nex AI"), and the customer that has agreed to the Phyto Nex AI Terms of Service or a master subscription agreement ("Customer").

This DPA forms part of, and is incorporated by reference into, the Terms of Service at /legal/terms or any other written agreement between the parties for the Phyto Nex AI service (the "Agreement"). It takes effect on the date Customer accepts the Agreement and continues for as long as Phyto Nex AI processes Customer Personal Data. This version is effective from January 15, 2026 and was last updated on September 1, 2026.

Customers who require a countersigned copy may request one from privacy@phytonexai.com. A countersigned copy is not required for this DPA to be binding.

Capitalized terms not defined here have the meanings given in the Agreement. In this DPA:

• "Data Protection Laws" means all laws applicable to the processing of Customer Personal Data under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), other US state privacy laws, and India's Digital Personal Data Protection Act, 2023 ("DPDP Act").
• "Customer Personal Data" means personal data within Customer Data that Phyto Nex AI processes on behalf of Customer.
• "Controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in the GDPR, and include equivalent terms under other Data Protection Laws (such as "business" and "service provider" under the CCPA, and "data fiduciary", "data processor" and "data principal" under the DPDP Act).
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• "Subprocessor" means any third party, including a Phyto Nex AI affiliate, engaged by Phyto Nex AI to process Customer Personal Data.
• "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914.

Customer is the controller (or, where Customer acts on behalf of another controller such as an affiliate, a processor) of Customer Personal Data. Phyto Nex AI is a processor (or subprocessor) acting on Customer's behalf.

Customer's instructions are set out in the Agreement, this DPA and Customer's configuration of the Service, including its choice of connectors, policy rules, retention settings and message approvals. Phyto Nex AI will process Customer Personal Data only on those documented instructions, unless required to do otherwise by law, in which case Phyto Nex AI will inform Customer before processing unless the law prohibits it. Phyto Nex AI will inform Customer promptly if, in its opinion, an instruction infringes Data Protection Laws.

Customer is responsible for the lawfulness of its instructions, for providing any notices to employees and other data subjects, and for having a valid legal basis for processing.

In accordance with Article 28(3) of the GDPR, Phyto Nex AI will:

1. process Customer Personal Data only on Customer's documented instructions, including with regard to international transfers;
2. ensure that persons authorized to process Customer Personal Data are bound by confidentiality;
3. implement the technical and organizational measures described in section 8 and Annex II;
4. respect the conditions in section 7 for engaging Subprocessors;
5. taking into account the nature of processing, assist Customer by appropriate measures in responding to data subject requests;
6. assist Customer in meeting its obligations relating to security, breach notification, data protection impact assessments and prior consultation;
7. at Customer's choice, delete or return Customer Personal Data at the end of the services, as described in section 13;
8. make available to Customer the information necessary to demonstrate compliance with Article 28 and allow for audits as described in section 12.

Phyto Nex AI will not use Customer Personal Data to train foundation models or any model offered to other customers, and will not combine it with personal data received from other customers or sources.

Phyto Nex AI will ensure that all personnel with access to Customer Personal Data have signed written confidentiality undertakings, have received appropriate privacy and security training, and access Customer Personal Data only to the extent required to perform the Service or provide support that Customer has requested. Support access to Customer workspaces requires a time-limited grant from Customer within the application.

Customer gives general authorization for Phyto Nex AI to engage the Subprocessors listed at /legal/subprocessors. Phyto Nex AI will impose on each Subprocessor, by written contract, data protection obligations no less protective than those in this DPA, and remains fully liable to Customer for the performance of each Subprocessor's obligations.

Notice of new Subprocessors

Phyto Nex AI will give at least 30 days' notice before authorizing a new Subprocessor, by email to subscribers of the subprocessor notification list and by updating the subprocessor page. In an emergency affecting the security or continuity of the Service, Phyto Nex AI may replace a Subprocessor with shorter notice and will explain the reason.

Right to object

Customer may object to a new Subprocessor on reasonable data protection grounds by writing to privacy@phytonexai.com within the 30-day notice period. The parties will discuss the objection in good faith. If Phyto Nex AI cannot offer a commercially reasonable alternative (for example, avoiding use of the Subprocessor for Customer's data) within 30 days, Customer may terminate the affected part of the Service and receive a pro rata refund of prepaid fees.

Phyto Nex AI implements and maintains the measures set out in its Security Policy at /legal/security-policy, which may be updated provided that the overall level of protection is not materially reduced. They include:

• Encryption of Customer Personal Data with AES-256 at rest and TLS 1.2 or higher in transit, with keys managed in AWS KMS and per-tenant keys for Enterprise customers.
• Data residency in the region selected by Customer: AWS us-east-1 (N. Virginia) or AWS ap-south-1 (Mumbai).
• Read-only connector scopes, and truncation of card numbers to the last four digits at ingestion.
• Single sign-on, phishing-resistant multi-factor authentication, least-privilege and just-in-time production access, and quarterly access reviews.
• Logging and monitoring with immutable audit trails, PII-scrubbed operational logs and 24x7 alerting.
• Secure development lifecycle with code review, dependency and secrets scanning, and twice-yearly independent penetration tests.
• Business continuity with multi-zone deployment, RPO of 1 hour and RTO of 4 hours.
• Annual SOC 2 Type II audit and ISO/IEC 27001:2022 certification.

Phyto Nex AI will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach. The notice will be sent to Customer's designated security and privacy contacts and will describe, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a point of contact. Where information is not yet available, Phyto Nex AI will provide it in phases as it becomes available.

Phyto Nex AI will take reasonable steps to contain, investigate and mitigate the breach, and will cooperate with Customer in meeting its obligations to notify supervisory authorities (including within 72 hours under Article 33 GDPR), the Data Protection Board of India and affected individuals. Phyto Nex AI will not notify Customer's data subjects or regulators directly about a breach of Customer Personal Data without Customer's approval, unless required by law. Notification is not an acknowledgement of fault or liability.

The Service allows Customer to search, export, correct and delete Customer Personal Data relating to an individual. If Phyto Nex AI receives a request directly from a data subject relating to Customer Personal Data, it will forward the request to Customer within five business days without responding substantively, unless Customer authorizes it to do so.

Phyto Nex AI will provide reasonable assistance to Customer, taking into account the nature of processing and the information available to Phyto Nex AI, with data protection impact assessments and prior consultations with supervisory authorities. Phyto Nex AI maintains a standard DPIA support pack, including data flow diagrams, the Annex I description and a summary of AI safeguards, available on request.

Customer Personal Data is stored in the region Customer selects. Where processing involves a transfer of personal data from the EEA, the UK or Switzerland to a country that has not been recognized as providing adequate protection, the parties agree that the following apply and are incorporated by reference:

• EU transfers: the SCCs, Module 2 (controller to processor) where Customer is a controller and Module 3 (processor to processor) where Customer is a processor. Clause 7 (docking clause) applies; under Clause 9 option 2 (general written authorization) applies with the notice period in section 7; the optional language in Clause 11 does not apply; Clause 17 option 1 applies with the law of Ireland; and under Clause 18 disputes are resolved in the courts of Ireland. Annex I is section 4 of this DPA, and Annex II is section 8.
• UK transfers: the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0), with Table 4 permitting either party to end the Addendum as set out in its Section 19.
• Swiss transfers: the SCCs as amended so that references to the GDPR include the FADP, the competent supervisory authority is the Federal Data Protection and Information Commissioner, and the term "member state" includes Switzerland for the purposes of Clause 18(c).

Phyto Nex AI has assessed the laws of the countries to which Customer Personal Data is transferred and will challenge any government access request it considers unlawful, disclose only the minimum data required, and notify Customer of any request unless legally prohibited.

Phyto Nex AI will make available, on request and under confidentiality, its most recent SOC 2 Type II report, ISO/IEC 27001:2022 certificate, penetration test executive summary and responses to reasonable security questionnaires. Customer agrees that these materials will be used first to satisfy its audit rights.

If Customer reasonably believes the materials are insufficient to demonstrate compliance, or a supervisory authority requires it, Customer may conduct an on-site or remote audit no more than once in any 12-month period, on at least 30 days' written notice, during business hours, by Customer or an independent auditor bound by confidentiality who is not a competitor of Phyto Nex AI. The parties will agree the scope, timing and duration in advance, and Customer will bear its own costs. Audits after a confirmed Personal Data Breach are not subject to the annual limit.

For 30 days after termination of the Agreement, Customer may export Customer Personal Data using the export tools in the Service. Phyto Nex AI will then delete Customer Personal Data from production systems within 30 days, and it will expire from encrypted backups within 35 days thereafter, unless retention is required by applicable law, in which case Phyto Nex AI will keep it confidential and process it only for that purpose. Phyto Nex AI will certify deletion in writing on request.

To the extent the CCPA applies, Phyto Nex AI is a service provider and Customer discloses personal information to Phyto Nex AI for the limited and specified business purposes of auditing expense reports and preparing communications as described in the Agreement. Phyto Nex AI will not:

• sell or share Customer Personal Data, as those terms are defined in the CCPA;
• retain, use or disclose Customer Personal Data for any purpose other than the business purposes specified in the Agreement, including any commercial purpose other than providing the Service;
• retain, use or disclose Customer Personal Data outside the direct business relationship between Phyto Nex AI and Customer;
• combine Customer Personal Data with personal information it receives from or on behalf of another person, except as permitted by the CCPA regulations.

Phyto Nex AI will comply with applicable CCPA obligations, provide the same level of privacy protection the CCPA requires of businesses, and notify Customer if it can no longer meet its obligations. Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data. Phyto Nex AI certifies that it understands and will comply with these restrictions.

Where the DPDP Act applies, Customer is the data fiduciary and Phyto Nex AI is a data processor engaged under a valid contract within the meaning of section 8(2). Phyto Nex AI will process digital personal data only to provide the Service on Customer's behalf, will implement reasonable security safeguards to prevent personal data breach as required by section 8(5), will notify Customer of any personal data breach so that Customer can inform the Data Protection Board of India and affected data principals, and will erase personal data when Customer withdraws instructions or the specified purpose is no longer served, as required by section 8(7).

Phyto Nex AI will assist Customer in responding to requests from data principals and in meeting any obligations Customer has as a significant data fiduciary, including data audits and impact assessments. Customer data hosted in AWS ap-south-1 (Mumbai) remains in India at rest. Phyto Nex AI's Grievance Officer, Meenakshi Raghunathan, can be reached at privacy@phytonexai.com.

Each party's liability arising out of or related to this DPA, whether in contract, tort or otherwise, is subject to the limitations and exclusions of liability in the Agreement, except that nothing in this DPA limits either party's liability to data subjects under the SCCs or Data Protection Laws where such limitation is not permitted.

In the event of conflict, the following order of precedence applies: (1) the SCCs or UK Addendum, where applicable; (2) this DPA; (3) the Agreement. Except as amended by this DPA, the Agreement remains in full force and effect.