Data Processing Addendum

This Data Processing Addendum ("DPA") is entered into between Parwal AI (operating from DDU Nagar, Raipur 492001, Chhattisgarh, India) and Customer. This DPA governs the processing of Personal Data in connection with the Parwal AI voice agents, WhatsApp integrations, and computational services.

Customer is the Data Controller / Data Fiduciary and Parwal AI is the Data Processor:

• Parwal AI shall process Customer Personal Data solely on documented instructions from Customer, including as specified in the Agreement, this DPA, and via customer agent dashboard configurations.
• Parwal AI shall not process Customer Personal Data for any secondary purpose, commercial advertising, or to train public foundation AI models.
• Customer represents and warrants that it has all necessary rights, legal bases, and consents to provide Customer Personal Data to Parwal AI for processing.

Parwal AI ensures that any personnel authorized to access Customer Personal Data are committed to confidentiality through binding agreements and receive data protection and security training. Access to raw production data is strictly restricted on a least-privilege basis.

Parwal AI implements robust technical safeguards to ensure a level of security appropriate to the risk:

Customer grants general authorization for Parwal AI to engage sub-processors listed in our active Sub-processor Inventory.

Parwal AI imposes data protection obligations on each sub-processor no less protective than those in this DPA. Parwal AI will provide at least 30 days notice of new sub-processors, allowing Customer reasonable opportunity to object on documented security grounds.

Taking into account the nature of processing, Parwal AI provides self-service features in the dashboard (exporting transcripts, purging call records) and technical assistance to help Customer fulfill its obligations to respond to data subject requests under the Indian DPDP Act 2023, GDPR, or applicable state laws.

In the event of a confirmed personal data security incident affecting Customer Personal Data, Parwal AI will notify Customer without undue delay (and in any case within seventy-two (72) hours of becoming aware of the incident) and provide reasonable information and mitigation updates.

Upon termination of the Agreement, Parwal AI will, at Customer's election, delete or return all Customer Personal Data within thirty (30) days, except to the extent that retention is mandated by applicable statutory laws (such as tax invoices retained under Indian statutory rules).

Where Customer Personal Data is transferred internationally across borders, Parwal AI ensures appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and adherence to cross-border transfer rules prescribed under the DPDP Act 2023 and GDPR.

This DPA is automatically incorporated by reference into Customer's agreement with Parwal AI upon account creation. Enterprise customers requiring an executed, countersigned bilateral DPA may email: