Data Processing Addendum

Scope and roles

This Data Processing Addendum (DPA) applies whenever GONATURELLE PRIVATE LIMITED processes personal data contained in Customer Data. For that processing the customer is the controller (Data Fiduciary under the DPDP Act, business under the CCPA) and GONATURELLE is the processor (Data Processor, service provider). Where the customer is itself a processor for its own clients, GONATURELLE acts as its subprocessor and the customer passes on equivalent obligations.

Categories of data subjects typically include the customer's end users, patients, applicants, policyholders and staff whose data appears in test cases or traces. Categories of personal data are whatever the customer chooses to include; customers are encouraged to use de-identified data or GONATURELLE Synthetic Cases wherever possible, and the platform's ingest detectors can redact identifiers before storage. Special categories such as health data may be processed only where the customer has a lawful basis and, for US PHI, a BAA is in place.

Processing instructions

GONATURELLE processes personal data only on the customer's documented instructions, which are the customer agreement, this DPA and the configuration the customer sets in the Services (suites, retention periods, regions, model endpoints). GONATURELLE will inform the customer if it believes an instruction infringes applicable data protection law, and will not process personal data for its own purposes, sell it, share it for cross-context behavioural advertising, or combine it with data from other sources, except as the law permits for a service provider.

GONATURELLE does not use Customer Data to train machine learning models and requires zero data retention from model providers it calls on the customer's behalf.

Confidentiality and security

Every person at GONATURELLE with access to Customer Data is bound by confidentiality obligations and completes privacy and security training. Access to production data is granted on a least-privilege, just-in-time basis and logged.

GONATURELLE maintains the technical and organisational measures described in Annex II of this DPA, including encryption at rest (AES-256) and in transit (TLS 1.2+), tenant isolation, sandboxed execution, SSO with multi-factor authentication, vulnerability management, annual third-party penetration testing, logging and monitoring, business continuity and backup testing, and an annual SOC 2 Type II audit. GONATURELLE may update these measures as long as the overall level of protection does not decrease.

Subprocessors

The customer gives general authorisation for GONATURELLE to engage the subprocessors listed on the Subprocessors page. GONATURELLE will give at least 30 days' notice of a new subprocessor by updating that page and emailing subscribers to subprocessor notifications. The customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the customer may terminate the affected Services and receive a refund of prepaid fees for the remaining term.

GONATURELLE imposes data protection terms on each subprocessor that are no less protective than this DPA and remains liable for its subprocessors' performance.

International transfers

Customer Data is stored in the region the customer selects (United States or India) or, on Enterprise, in the customer's own cloud account. Where a transfer of personal data from the EEA, UK or Switzerland to a country without an adequacy decision occurs, the parties agree to the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor) or Module Three (processor to processor) as applicable, and the UK International Data Transfer Addendum, which are incorporated by reference. GONATURELLE has completed a transfer impact assessment for these transfers, available on request.

Transfers of personal data out of India comply with the DPDP Act, including any country restrictions notified by the Central Government under section 16.

Assistance, breach notice and audits

GONATURELLE will assist the customer, by appropriate technical and organisational measures, in responding to data subject and Data Principal requests, and will promptly forward any request it receives directly. Most requests can be handled by the customer in the application through search, export and deletion of cases and traces. GONATURELLE will also provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities.

GONATURELLE will notify the customer of a personal data breach affecting Customer Data without undue delay and in any case within 48 hours of becoming aware of it, with the information the customer needs to meet its own notification duties under GDPR Articles 33 and 34, the DPDP Act and applicable US breach laws.

GONATURELLE will make available its current SOC 2 Type II report, penetration test summary and responses to standard security questionnaires to demonstrate compliance. Where these are insufficient or a regulator requires it, the customer may conduct an audit once a year on 30 days' notice, during business hours, at its own cost, subject to confidentiality.

Return and deletion

During the subscription the customer can export and delete Customer Data at any time. At termination, GONATURELLE will make Customer Data available for export for 30 days and will then delete it from active systems within a further 30 days and from backups within 35 days after that, unless the law requires retention. GONATURELLE will certify deletion in writing on request.

This DPA prevails over the Terms of Service on matters of personal data protection. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses prevail.