Data processing agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Skode Technologies Private Limited, a private limited company incorporated in India (CIN: U62011KL2026PTC102406) with registered office at Thirumangalath, Chelavur, Kozhikode – 673571, Kerala, India ("SkedX," "Processor," "we," "us") and you ("Controller," "you," "your") for the use of our Services, as defined in our Terms of Service. This DPA applies to the extent that SkedX processes Personal Data on your behalf in the course of providing the Services.

This DPA is entered into pursuant to Article 28 of the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"), Article 28 of the UK GDPR (as incorporated by the UK Data Protection Act 2018), and equivalent provisions under the Indian Digital Personal Data Protection Act, 2023 ("DPDPA"). It sets out the terms on which the Processor shall process Personal Data on behalf of the Controller.

1Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person, as defined by applicable Data Protection Laws.
• "Data Protection Laws" means all applicable laws relating to data protection and privacy, including the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA), and the Indian Digital Personal Data Protection Act, 2023.
• "Processing" means any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Sub-Processor" means any third party engaged by SkedX to process Personal Data on behalf of the Controller.
• "Data Subject" means the identified or identifiable natural person to whom the Personal Data relates.
• "Security Incident" means any unauthorized or unlawful access, acquisition, use, disclosure, alteration, or destruction of Personal Data.

2Scope and purpose of processing

2.1Subject matter

SkedX processes Personal Data on behalf of the Controller to provide the Services, which include customer relationship management, invoicing, lead management, AI-powered analytics, calling (SkedX Call: call metadata, voice audio where the Controller enables recording, transcripts and AI outputs, whether originated by SkedX Call or ingested from a third-party calling platform the Controller has connected), omnichannel messaging through SkedX CRM and SkedX Flow, and attribution through SkedX Signal (recording how a person reached the Controller across its website, ads, messages, emails and calls, so the Controller can see which campaign brought them).

2.2Categories of data subjects

• Your customers and prospective customers (leads).
• Your business contacts and partners.
• Your employees and team members who use the Services.
• End users who interact with your widgets, forms, or messaging channels.
• Shoppers of an online store you connect to the Services (Shopify, WooCommerce).

2.3Types of personal data

• Contact information (name, email, phone number, address).
• Business information (company name, job title, industry).
• Communication records (emails, chat messages, call logs, notes).
• Transaction data (invoices, payment history, deal information).
• Store data from a connected online store (orders, items, totals, shipping addresses, delivery status, abandoned checkouts, marketing consent). Card and other payment details are never received.
• Usage data (interactions within the CRM, activity logs).
• Online identifiers and activity: website visitor IDs, ad click IDs, Instagram and Facebook page-scoped IDs, and the visits, chats, emails and calls linked to them, which the Services join to one person only when they share an identifier such as an email address, phone number, click ID or one of these IDs.
• Any other Personal Data you choose to store in the Services.

2.4Duration

Processing continues for the duration of your subscription to the Services, plus any retention period required to fulfill our obligations under this DPA and applicable law.

3Obligations of the processor

SkedX shall:

• Process Personal Data only on documented instructions from the Controller, unless required by applicable law.
• Ensure that persons authorized to process Personal Data are bound by obligations of confidentiality.
• Implement appropriate technical and organizational measures to ensure the security of Personal Data.
• Not engage a Sub-Processor without prior written authorization from the Controller (general or specific).
• Assist the Controller in responding to requests from Data Subjects exercising their rights under Data Protection Laws.
• Assist the Controller in ensuring compliance with obligations related to security of processing, data protection impact assessments, and prior consultations with supervisory authorities.
• At the Controller's choice, delete or return all Personal Data upon termination of the Services, unless retention is required by law.
• Make available to the Controller all information necessary to demonstrate compliance with this DPA.

4Data subject rights

SkedX will assist the Controller in fulfilling its obligations to respond to Data Subject requests, including:

• Right of access to Personal Data.
• Right to rectification of inaccurate data.
• Right to erasure ("right to be forgotten").
• Right to restriction of processing.
• Right to data portability.
• Right to object to processing.

We will promptly notify you if we receive a request from a Data Subject directly. We will not respond to Data Subject requests without your prior authorization, unless required by applicable law.

5Security measures

SkedX implements and maintains appropriate technical and organisational security measures, including:

• Encryption: Data is encrypted in transit using TLS 1.2 or higher. At rest, the database and customer files stored on AWS (Hyderabad, ap-south-2, and Mumbai, ap-south-1) are protected by AWS-managed encryption; payment-gateway credentials are Fernet-encrypted inside our database; user passwords are stored as PBKDF2-SHA256 hashes.
• Access Controls: Role-based access controls with workspace (org_id) isolation and fail-closed query filters; SAML 2.0 and OIDC single sign-on for enterprise customers; principle of least privilege for administrative access. Two-factor authentication for end-user accounts is on our roadmap and not yet available.
• AI Connector Security: API keys are stored as SHA-256 hashes with 90-day automatic expiry. Mutual TLS (mTLS) is validated on inbound requests from OpenAI Connectors (mtls.connectors.openai.com). Sensitive personal fields are pseudonymised server-side before being returned to third-party AI assistants.
• Network Security: Rate limiting on public API endpoints (300 req/min sustained, 15 req/sec burst), per-workspace bulk-operation caps, and standard cloud network controls provided by AWS.
• Monitoring: Application logging retained for 30 days; audit trail of AI Connector actions retained for 30 days (failed events retained longer for investigation).
• Employee Training: Regular security awareness training for all personnel with access to Personal Data.
• Physical Security: Services are hosted on Amazon Web Services in India, in the Hyderabad (ap-south-2) region for application servers, databases, newer media and call recordings, and the Mumbai (ap-south-1) region for older stored files and backup copies. AWS operates that infrastructure within a SOC 2 Type II-attested environment; Skode Technologies Private Limited does not itself hold a SOC 2 attestation today.
• Business Continuity: Regular backups, disaster-recovery plans, and business-continuity procedures.
• Secure Development: Security-by-design principles in software development, including code review and security testing.

6Sub-processors

The Controller provides general written authorization for SkedX to engage Sub-Processors for the purpose of providing the Services. A current list of Sub-Processors is maintained at /legal/sub-processors/ (for calling, this includes the telecommunications carrier and transcription providers). SkedX affiliates operating SkedX products are engaged under the same obligations as SkedX itself. Where a regulator, carrier or law-enforcement authority lawfully requires SkedX to disclose Controller data — including call records or verification documents — SkedX discloses only what is legally required and notifies the Controller before disclosure where legally permitted, or as soon as permitted afterwards; requests concerning the lawfulness of the Controller's own calls are, wherever the demand allows, routed to the Controller as the sender of record.

SkedX shall:

• Notify the Controller of any intended changes to the list of Sub-Processors, providing an opportunity to object within 30 days of notification.
• Ensure that any Sub-Processor is bound by data protection obligations no less protective than those in this DPA.
• Remain fully liable for the acts and omissions of its Sub-Processors.

If the Controller objects to a new Sub-Processor within the 30-day notice period and SkedX cannot reasonably accommodate the objection, either party may terminate the affected Services with 30 days' written notice.

When you activate AI connectors, the following additional sub-processors may process your data: OpenAI, Inc. (ChatGPT connector), Anthropic, PBC (Claude connector), and Google LLC (Gemini connector). See our Sub-Processors page for full details.

7International data transfers

7.1 Where data is processed. SkedX processes and stores Customer Personal Data in India, in Amazon Web Services regions Hyderabad (ap-south-2) and Mumbai (ap-south-1). Sub-Processors listed on our Sub-Processors page may process data in the locations stated there. See also Where your data is stored.

7.2 European Economic Area. Where the Controller is subject to the GDPR and Personal Data is transferred to SkedX in India, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("SCCs") are incorporated into this DPA by reference, without further signature, as follows:

1. Module Two (controller to processor) applies where the Controller is a controller; Module Three (processor to processor) applies where the Controller is itself a processor.
2. Clause 7 (docking clause) applies. Clause 9: option 2, general written authorisation, with 30 days' notice of changes (Section 6). Clause 11: the optional wording does not apply.
3. Clause 13: the competent supervisory authority is that of the Controller's establishment in the EU or, where there is none, the Irish Data Protection Commission.
4. Clauses 17 and 18: the law and courts of Ireland.
5. Annexes I and II are as set out in this DPA; Annex III is the list on our Sub-Processors page.

7.3 United Kingdom. For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0) applies, completed with the information in Section 7.2 and the Annexes. Either party may end the Addendum as its Section 19 permits.

7.4 Switzerland. For transfers subject to the Swiss Federal Act on Data Protection, the SCCs in Section 7.2 apply with these changes: the competent authority is the Federal Data Protection and Information Commissioner; references to Member State law include Swiss law; and data subjects in Switzerland may bring claims in Switzerland.

7.5 New Zealand. SkedX holds Personal Data solely as the Controller's agent for storage and processing, within the meaning of section 11 of the Privacy Act 2020, and does not use or disclose it for its own purposes. Where Information Privacy Principle 12 applies, this DPA provides safeguards comparable to those of that Act.

7.6 United Arab Emirates and Saudi Arabia. Transfers to SkedX are made on the basis of the contractual safeguards in this DPA: under the cross-border transfer provisions of UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data; for Controllers in the Dubai International Financial Centre or Abu Dhabi Global Market, under DIFC Data Protection Law No. 5 of 2020 or the ADGM Data Protection Regulations 2021, with the SCCs serving as the appropriate safeguards; and, for Saudi Arabia, under the Personal Data Protection Law and its regulation on transfers of personal data outside the Kingdom.

7.7 Data that must stay in-country. The Services are not designed for data that applicable law requires to be stored in a particular country — for example, health information subject to UAE Federal Law No. 2 of 2019 on the use of information and communications technology in health fields. The Controller must not upload such data unless SkedX has agreed in writing to host it in that country.

7.8 Calling data. Transfers of call recordings and transcripts are covered by the mechanisms in this Section. Model-training use of call audio is prohibited to all Sub-Processors.

7.9 Transfer risk assessment. SkedX maintains a written assessment of transfers to India and provides it to the Controller on request, or a summary where confidentiality requires.

7.10 Onward transfers. SkedX transfers Personal Data to a Sub-Processor outside India only under terms that give the same protection as this Section.

8Data breach notification

In the event of a Security Incident, SkedX shall comply with all applicable breach notification requirements, including jurisdiction-specific timelines:

1. Notify the Controller without undue delay, and in any event within 72 hours of becoming aware of the Security Incident (as required by GDPR Article 33 and UK GDPR).
2. India CERT-In Requirement: For Security Incidents affecting data subjects located in India, SkedX shall report the incident to the Indian Computer Emergency Response Team (CERT-In) within 6 hours of becoming aware of the incident, in accordance with CERT-In Directions dated April 28, 2022. This includes cyber security incidents such as unauthorized access to systems, data breaches, and data leaks. SkedX shall simultaneously notify the Controller of any such report.
3. Provide sufficient information to enable the Controller to meet its obligations to report the Security Incident to supervisory authorities and Data Subjects, including:
   • The nature of the Security Incident, including categories and approximate number of Data Subjects affected.
   • The likely consequences of the Security Incident.
   • The measures taken or proposed to address the Security Incident and mitigate its effects.
   • The name and contact details of a designated point of contact for further information.
4. Take immediate steps to contain, investigate, and remediate the Security Incident.
5. Cooperate with the Controller and provide reasonable assistance in investigating and resolving the Security Incident.

9Audit rights

SkedX shall make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits conducted by the Controller or an independent auditor appointed by the Controller.

• Audit requests must be made in writing with at least 30 days' prior notice.
• Audits shall be conducted during normal business hours and shall not unreasonably interfere with SkedX's operations.
• The Controller shall bear the cost of any audit, unless the audit reveals material non-compliance by SkedX.
• SkedX may satisfy audit requests by providing security documentation, architectural descriptions, penetration-test summaries, and compliance attestations held by its upstream hosting and infrastructure providers (for example, AWS SOC 2 Type II reports for the Hyderabad and Mumbai regions). Skode Technologies Private Limited does not currently hold its own SOC 2 attestation; SOC 2 readiness is on our security roadmap.

10Data deletion and return

Upon termination of the Services:

• SkedX will provide the Controller with the ability to export all Personal Data for 30 days following termination.
• After the 30-day export period, SkedX will delete all Personal Data within a further 90 days, subject to the limited carve-outs below.
• Tax and accounting carve-out. SkedX retains billing and invoice records for 7 years from the end of the relevant financial year, as required by the Indian Income-tax Act, 1961 and Section 36 of the Central Goods and Services Tax Act, 2017 (72-month statutory retention). Equivalent tax-retention obligations in other jurisdictions may also apply. These records are stored separately and are not used to provide the Services.
• Legal-hold carve-out. SkedX may retain Personal Data as necessary to comply with a binding legal process, preserve evidence of a reported Security Incident, or defend legal claims. Such retention is limited to the minimum period and scope required for that purpose.
• Upon request, SkedX will certify in writing that Personal Data has been deleted, identifying any records retained under a carve-out and the basis for that retention.

11Liability

Each party's liability under this DPA is subject to the limitations of liability set forth in the Terms of Service, except that neither party excludes or limits its liability for breaches of its data protection obligations to the extent such limitation is prohibited by applicable Data Protection Laws.

12Governing law and jurisdiction

This DPA, and any non-contractual obligations arising from or connected to it, are governed by and construed in accordance with the laws of India, without regard to conflict-of-law principles. The parties submit to the exclusive jurisdiction of the courts at Kozhikode, Kerala, India, with appeals lying to the Kerala High Court at Ernakulam, for any dispute arising out of or in connection with this DPA.

Nothing in this clause limits the rights of Data Subjects under the GDPR, UK GDPR, the Indian Digital Personal Data Protection Act, 2023, or any other applicable Data Protection Law to bring proceedings before a supervisory authority or court in the jurisdiction of their habitual residence or place of the alleged infringement.

Where EU or UK Data Subjects’ personal data is transferred outside the EEA or United Kingdom, the incorporated Standard Contractual Clauses (and UK Addendum, where applicable) are governed by the law and subject to the jurisdiction specified in those clauses, notwithstanding this section.

12ABrowser extension

This DPA applies to all SkedX Flow client surfaces accessed by Customer’s Authorised Users, including the SkedX Flow Chrome browser extension. The extension is a client of the SkedX Flow backend and introduces no new sub-processors beyond those listed on our Sub-Processors page. Personal Data the extension transmits to Customer’s SkedX Flow account is processed by SkedX under the same processor obligations, security controls, retention rules, and audit rights set out in this DPA. Customer remains the data controller for all Personal Data accessed through the extension; SkedX acts as a processor. The Extension Privacy Notice describes the extension-specific data flows in detail.

12BOnline store connections (Shopify and WooCommerce)

This DPA applies to Personal Data that reaches the Services when Customer connects an online store, through the SkedX for Shopify app or the SkedX WooCommerce plugin. Customer is the controller of its shoppers’ Personal Data and SkedX processes it as Customer’s processor, only to provide the store features Customer switches on. In addition to Section 10:

• Shopify privacy requests. SkedX acts on Shopify’s customer deletion request (“customers/redact”) and shop deletion request (“shop/redact”, which Shopify sends about 48 hours after the app is uninstalled) when it receives them, deleting the matching data from SkedX’s store records. SkedX shows Shopify’s customer data requests (“customers/data_request”) to Customer with a due date 30 days after receipt, and provides an export of that shopper’s store data for Customer to answer the request.
• Other copies. A customer deletion request also deletes that shopper’s data in Customer’s inbox, automation history and store analytics; a shop deletion request also deletes the products copied from the store, its reviews, its automation history and the analytics recorded on its web addresses. Opt-out records are retained as proof of the shopper’s objection. Archived analytics events and data already delivered on Customer’s instruction to third parties are deleted on Customer’s instruction.
• Uninstall and disconnect. When the Shopify app is uninstalled, SkedX stops receiving store data and erases its access credentials immediately. Data from a disconnected WooCommerce store is kept until Customer instructs SkedX to delete it or the Services end.
• Security. Shoppers’ names, phone numbers, email addresses and shipping addresses in SkedX’s store records are encrypted at the application level before storage, and reads of them are logged.

The SkedX for Shopify Privacy Policy describes these data flows in detail.

Annex I — description of the transfer

• Data exporter: the Controller named in the order or account, acting as controller (Module Two) or processor (Module Three).
• Data importer: Skode Technologies Private Limited (CIN: U62011KL2026PTC102406), Thirumangalath, Chelavoor (P.O), Calicut, Kerala – 673571, India; role: processor; contact: [email protected].
• Data subjects: the Controller's authorised users; the Controller's leads, contacts and customers; people who message, call or submit forms to the Controller through the Services.
• Categories of data: name, email address, phone number, company and job details; message, chat and email content; form submissions; call audio, recordings and transcripts (SkedX Call); files the Controller uploads; usage and device data.
• Sensitive data: not intended. Data that must be stored in-country is excluded (Section 7.7); any other special-category data only as the Controller chooses to upload, protected by the measures in Annex II.
• Frequency: continuous, for the life of the subscription.
• Nature and purpose: hosting, storage and processing to provide CRM, Flow (WhatsApp and social messaging), Forms, Automate, SkedX Call and the AI features the Controller turns on.
• Retention: for the subscription term, then deleted under Section 10. Backup copies age out on their own schedule: 14-day point-in-time recovery and nightly copies kept for 30 days.
• Sub-Processors: as listed on our Sub-Processors page, for the purposes stated there.

Annex II — technical and organisational measures

• Encryption: database and storage encrypted at rest with AWS-managed keys; TLS for data in transit; third-party connector credentials encrypted at the application level.
• Tenant isolation: every request is tied to one workspace; the CRM enforces database row-level security per workspace.
• Access control: role-based access in every product; re-authentication for sensitive account actions; staff cloud access through single sign-on with multi-factor authentication; no long-lived access keys on servers.
• Network: web traffic through Cloudflare with DDoS protection; servers have no open SSH and are reached only through AWS Systems Manager; automatic blocking of abusive addresses.
• Resilience: 14-day point-in-time recovery; backups replicated from Hyderabad to Mumbai; nightly copies in versioned, write-protected storage.
• Monitoring: error and uptime monitoring with alerts; AWS CloudTrail audit logging.
• Certification: SkedX does not hold SOC 2 or ISO 27001 certification today; AWS's certifications cover the infrastructure layer.

13Contact

For questions or concerns regarding this DPA, please contact:

• Email: [email protected]
• Legal: [email protected]
• Post: Skode Technologies Private Limited, Thirumangalath, Chelavur, Kozhikode, Kozhikode – 673571, Kerala, India

Related policies & documents

This DPA forms part of our agreements and should be read alongside the following, all collected in our Legal & Compliance Center:

• Privacy Policy — how we handle personal data.
• Sub-Processors — third parties that process data on our behalf.
• SkedX for Shopify Privacy Policy — data from connected online stores.
• Security — technical and organisational measures.
• GDPR & UK GDPR Rights, CCPA, and EU/UK Representative — regional compliance.
• Data Deletion Policy and Data Subject Access Requests.
• Terms of Service — the master agreement.