Data Processing Addendum

1. Scope, parties and roles

This Data Processing Addendum (“DPA”) applies when an organization (the “customer”) uses a Dehurdle organization plan (Team, Scale or Enterprise). It is between the customer and THRIVING BILLIONS PRIVATE LIMITED, India (“Dehurdle”, “we”), and forms part of our Terms of Service (the “Terms”).

For personal data that Dehurdle processes on the customer's behalf (“customer personal data”), the customer is the controller and Dehurdle is the processor. Where India's Digital Personal Data Protection Act, 2023 applies, the customer is the data fiduciary and Dehurdle is its data processor. For individual accounts (Free and Pro) and website visitors, Dehurdle is the controller and our privacy policy applies instead of this DPA.

“Data protection law” means the EU General Data Protection Regulation (“GDPR”), the UK GDPR and any other privacy law that applies to customer personal data. Terms such as “personal data”, “processing” and “personal data breach” have the meaning given in the GDPR.

If these documents conflict, the Standard Contractual Clauses in section 10 prevail over this DPA, and this DPA prevails over the Terms.

2. Processing on documented instructions

Dehurdle processes customer personal data only on the customer's documented instructions, including for transfers outside the EEA and the UK. The instructions are the Terms, this DPA and the settings the customer and its admins choose in the product, such as which members they invite, who is an admin, whether camera analysis is allowed, whether Slack is connected, whether members may connect AI assistants, whether practice calls may run longer than 10 minutes, whether HubSpot or Zoho CRM is connected and the retention period. The customer can give further written instructions that are consistent with the Terms.

Dehurdle uses customer personal data only to provide, support and secure the service. It does not use customer personal data to train or fine-tune AI models.

If a law requires Dehurdle to process customer personal data in any other way, we tell the customer before doing so, unless that law forbids it. We tell the customer straight away if we believe an instruction breaks data protection law.

3. Confidentiality

Dehurdle gives access to customer personal data only to staff who need it to run, support and secure the service. Everyone with access is bound by a duty of confidentiality, by contract or by law.

4. Security

Dehurdle protects customer personal data with the technical and organizational measures in Annex II, which take into account the risks of the processing as Article 32 GDPR requires. We may update these measures as long as the overall level of protection doesn't go down.

The customer is responsible for the parts it controls: whom it invites, whom it makes an admin, how its admins use members' scores and transcripts, and keeping its own sign-in credentials secure.

5. Subprocessors

The customer gives Dehurdle general authorization to use subprocessors. The current subprocessors are listed in Annex III and on our subprocessors page.

Before a new subprocessor starts processing customer personal data, Dehurdle gives at least 30 days' notice by email to the customer's organization admins and by updating the subprocessors page.

The customer can object to a new subprocessor during the notice period on reasonable data protection grounds. We will then discuss the objection in good faith. If we can't resolve it, the customer can end the affected services by written notice before the new subprocessor starts processing its data.

Dehurdle puts each subprocessor under a written contract with the same data protection obligations as this DPA. Dehurdle remains fully liable to the customer for each subprocessor's performance of those obligations.

AI assistants. If the customer turns on AI assistants for its organization, its users can connect an AI assistant such as ChatGPT (OpenAI) or Claude (Anthropic) to their account. A user who connects one instructs Dehurdle, within the customer's permission, to send that assistant the data described in Annex I. The assistant's provider receives the data under the terms of the account the user signed in with, not as Dehurdle's subprocessor, so this section doesn't apply to it. AI assistants are off for every organization until the customer's owner turns them on. Turning them off ends every user's assistant access straight away. Dehurdle isn't responsible for how the provider processes data it has received.

The customer's CRM. If the customer connects its HubSpot account or Zoho CRM organization, Dehurdle reads deal data from it and writes practice results to it, as described in Annex I. Each is the customer's own provider, not Dehurdle's subprocessor, so this section doesn't apply to it. The customer decides who can see deals in its CRM, and so who can see practice results written there. Dehurdle writes nothing to it while the customer's admins see company-wide figures only.

6. Assistance

Taking into account the nature of the processing and the information available to us, Dehurdle helps the customer meet its own obligations:

• Data subject requests. Depending on what the customer chooses, organization admins see company-wide figures only, each member's progress and scores, or also session transcripts in the product, and every transcript an admin opens is logged. On the customer's request, we export, correct or delete a user's data. If a person contacts Dehurdle directly about customer personal data, we forward the request to the customer without undue delay and don't answer it ourselves unless the customer asks us to.
• Impact assessments and prior consultation. We give the customer the information it reasonably needs for a data protection impact assessment (Article 35 GDPR) and for any prior consultation with a supervisory authority (Article 36 GDPR).
• Security. We maintain the measures in Annex II and notify personal data breaches as set out in section 7 (Articles 32 to 34 GDPR).

7. Personal data breaches

Dehurdle notifies the customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting customer personal data. We send the notice by email to the customer's organization admins.

The notice includes, as far as it is available, the information listed in Article 33(3) GDPR: what happened, the categories and approximate number of people and records concerned, the likely consequences, the measures taken or proposed, and a contact for more information. If we don't have all of it yet, we send what we have and the rest as soon as we have it.

We take reasonable steps to contain the breach and limit its effects. The customer decides whether to notify supervisory authorities and the people affected. Dehurdle doesn't notify them about customer personal data unless the customer asks us to, or a law requires us to report an incident ourselves.

8. Return and deletion

During the agreement. Each organization has a retention period in days (at least 1 day; 365 days by default), which Dehurdle sets on the organization's request. A daily job deletes transcripts (including the spoken words kept for voice analysis), coach chats (messages with the in-app coach and coaching chats about practice sessions) and written feedback once they are older than that period. Scores and summary metrics stay for progress tracking. Practice audio isn't stored after the session ends.

When a user's account is deleted, we remove their name, email address and phone number, remove them from the organization and delete their sign-in account. Their practice records stay with the organization without those identifiers. Deleting the organization deletes all of its data, including the accounts of users who belonged only to that organization.

When the agreement ends. Users can download a copy of all their personal data in the app (profile, transcripts, scores, written feedback, speaking and camera metrics, coach chats and preferences), and the customer can ask for a full export at reach@dehurdle.com. Dehurdle deletes customer personal data within 30 days after the agreement ends, so customers who want a full export should ask before then.

Deleted data can remain in encrypted database backups for up to 7 days, after which the backups expire. We keep customer personal data longer only where a law requires us to (for example, billing records), and we keep protecting it under this DPA while we do.

9. Audits and information

Dehurdle makes available to the customer the information necessary to demonstrate compliance with Article 28 GDPR and this DPA, such as descriptions of our security measures, subprocessors and data flows.

The customer, or an independent auditor it appoints who is bound by confidentiality, can audit Dehurdle's compliance with this DPA once a year, with at least 30 days' written notice and at the customer's own cost. More frequent audits are possible where a supervisory authority requires them. Audits take place during business hours and must not disrupt the service or expose other customers' data. Instead of an audit, the customer may choose to rely on the information and reports Dehurdle provides.

10. International transfers

Dehurdle hosts customer personal data on Amazon Web Services in Mumbai, India. Live voice conversations are processed by Google in the USA (through its us-central1 region, Iowa, or its US multi-region when Iowa has no capacity for a call), and speech-to-text runs on Google's global endpoint. The other subprocessors and their locations are listed in Annex III. India doesn't have an EU adequacy decision, so personal data from the EEA and the UK is transferred under the terms below.

EU Standard Contractual Clauses. The standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914 (the “SCCs”) are incorporated into this DPA by reference. Module 2 (controller to processor) applies, with the customer as data exporter and Dehurdle as data importer. The parties make these choices:

• Clause 7 (docking clause) applies.
• Clause 9: option 2, general written authorization, with 30 days' notice as set out in section 5.
• Clause 11: the optional wording on an independent dispute resolution body doesn't apply.
• Clause 13: the competent supervisory authority is that of the data exporter, as set out in Annex I.
• Clause 17: option 2, the law of the EU Member State in which the data exporter is established; where that law does not allow third-party beneficiary rights, the law of the Netherlands.
• Clause 18: the courts of that Member State.
• Annexes I, II and III of this DPA complete Annexes I, II and III of the SCCs.

Onward transfers. When Dehurdle passes customer personal data to a subprocessor outside the EEA, it does so under the SCCs (Module 3, processor to processor) included in that subprocessor's data processing terms.

UK transfers. For personal data protected by UK data protection law, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (the “UK Addendum”) also applies. The information it requires is in this DPA and its annexes.

Requests from public authorities. If a public authority asks Dehurdle for customer personal data, we handle the request as Clause 15 of the SCCs requires, including telling the customer where the law allows it.

Transfer impact assessments. On request, Dehurdle gives the customer the information it needs for its transfer impact assessment, including where customer personal data is processed, by which subprocessors, and the measures in Annex II.

11. Liability, term and governing law

Each party's liability under this DPA is subject to the limitations of liability in the Terms. Those limitations don't limit any party's liability to data subjects under the SCCs, or liability that the law doesn't allow to be limited.

This DPA applies for as long as Dehurdle processes customer personal data, including after the Terms end until deletion under section 8 is complete.

This DPA is governed by the same law as the Terms, except that the SCCs are governed by the law and courts chosen in section 10.