Data Processing Addendum

1. Scope and roles

This Data Processing Addendum ("DPA") forms part of the Terms of Service or Master Subscription Agreement between TWINJAM 9PEARL PRIVATE LIMITED and Customer. It applies when TWINJAM processes personal data contained in Customer Data on Customer's behalf.

Customer is the controller (data fiduciary under the DPDP Act 2023) and TWINJAM is the processor (data processor). Where Customer is itself a processor for its own clients, TWINJAM is a subprocessor and Customer will pass on relevant instructions.

2. Details of processing

3. Processing on instructions

TWINJAM processes personal data only on Customer's documented instructions, which are the agreement, this DPA and Customer's configuration of the service. TWINJAM will tell Customer if it believes an instruction infringes applicable law.

4. Confidentiality of personnel

Everyone at TWINJAM with access to Customer Data is bound by written confidentiality obligations, completes security and privacy training at hire and annually, and accesses production only through audited, time-limited just-in-time grants.

5. Security measures

TWINJAM maintains the technical and organisational measures described in its Security Architecture document, including:

• AES-256 encryption at rest with per-tenant keys in AWS KMS, and TLS 1.3 for data in transit.
• Read-only OAuth scopes wherever the integration allows, with channel allow-listing enforced before processing.
• In-memory processing of non-flagged messages and ticket descriptions, with no persistence.
• Logical tenant isolation, network segmentation and hardened container images.
• Annual SOC 2 Type II examination and annual third-party penetration testing.

6. Subprocessors

Customer gives general authorisation for TWINJAM to engage the subprocessors listed in the Subprocessors register. TWINJAM will give at least 30 days' notice of a new subprocessor by email to subscribed administrators. Customer may object on reasonable data protection grounds; if the parties cannot resolve the objection, Customer may terminate the affected service and receive a pro-rata refund.

7. Data subject requests and assistance

TWINJAM will promptly forward to Customer any request it receives from a data subject relating to Customer Data, and will provide self-service export and deletion tools plus reasonable assistance with data protection impact assessments and consultations with authorities.

8. Personal data breach notification

TWINJAM will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will describe the nature of the breach, likely consequences, measures taken and a contact point. TWINJAM will support Customer in meeting its own notification duties, including intimation to the Data Protection Board of India under the DPDP Act 2023 and to EU supervisory authorities within 72 hours.

9. Return and deletion

On termination, Customer may export Customer Data for 30 days. TWINJAM then deletes Customer Data from production systems within 30 days and from backups within 35 days thereafter, and certifies deletion on request.

10. Audits

TWINJAM will make its current SOC 2 Type II report and penetration test summary available under NDA. Where those are not sufficient to demonstrate compliance, Customer may conduct one audit per year on 30 days' notice, during business hours, at its own cost and subject to confidentiality.

11. International transfers

For transfers of personal data from the EEA, the parties incorporate Module 2 (controller to processor) and, where applicable, Module 3 (processor to processor) of the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, with Ireland as the governing law and competent courts for the Clauses. For UK transfers, the UK International Data Transfer Addendum applies. Customers who select EU or India data residency keep Customer Data in that region at rest.