Data Processing Addendum

1. Parties and roles

This addendum is between the customer that holds an AmDital workspace (the “Customer”) and Diginnovators Solutions Pvt Ltd, Bengaluru, India (“AmDital”, “we”). It forms part of the agreement under which the Customer uses AmDital, including our terms of service.

For the content the Customer and its team put into a workspace, the Customer is the controller and AmDital is the processor under the GDPR, and the Data Processor under India's Digital Personal Data Protection Act, 2023 (DPDP Act). We call this “workspace content”. It covers CRM records, tasks, documents, HR data and Ami conversations, which we treat as the Customer's data.

For our own account, billing, marketing-site and product-telemetry data, AmDital is the controller (the Data Fiduciary under the DPDP Act). That data is governed by our privacy policy, not by this addendum.

2. Scope and processing instructions

AmDital processes workspace content only to provide the AmDital service to the Customer. The Customer's documented instructions are this addendum, the agreement, and the Customer's use and configuration of the service. We will tell the Customer if we believe an instruction infringes data protection law.

Some features run only when a workspace admin turns them on, and that choice is the Customer's instruction. Examples are semantic search, which sends text from the workspace to an embedding provider, and team activity monitoring, which does not capture anything until the admin has recorded consent.

3. Processor obligations (GDPR Art 28(3))

AmDital, as processor, agrees to the following.

(a) Documented instructions

We process workspace content only on the Customer's documented instructions described in section 2, including as regards transfers to a third country, unless law requires us to process it otherwise. In that case we tell the Customer before processing, unless the law prohibits it.

(b) Confidentiality

We ensure that the people we authorise to process workspace content are committed to confidentiality or are under an appropriate statutory obligation of confidentiality.

(c) Security of processing (Art 32)

We take the measures required by Article 32 of the GDPR. Our current measures are described on our security page, which is also where we state plainly which certifications we do and do not hold.

(d) Subprocessors

We engage other processors only on the conditions in section 4 and remain responsible to the Customer for their performance.

(e) Assistance with data subject requests

Taking into account the nature of the processing, we assist the Customer, by appropriate technical and organisational measures, in responding to requests from data subjects to exercise their rights. Section 6 describes how that works today.

(f) Assistance with Articles 32 to 36

We assist the Customer in meeting its obligations on security, personal data breaches, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to us. We notify the Customer of a personal data breach affecting workspace content without undue delay after becoming aware of it.

(g) Deletion or return

At the Customer's choice, we delete or return workspace content when the service ends, and delete existing copies unless law requires us to keep them. Section 7 describes how that works today.

(h) Information and audits

We make available to the Customer the information necessary to demonstrate our compliance with Article 28 of the GDPR, and we allow for and contribute to audits, including inspections, conducted by the Customer or by an auditor the Customer mandates. To arrange this, email legal [at] amdital.com.

4. Subprocessors (Annex III)

The Customer gives AmDital general authorisation to engage the subprocessors listed in the annex below. The same list is published on our trust centre. When the list changes, we update it on this page and on the trust centre, and the date below changes. The Customer may object to a subprocessor by emailing legal [at] amdital.com.

Annex III: authorised subprocessors

Integrations a workspace admin turns on, such as GreytHR attendance sync, move data only because the Customer enabled them, and only for that purpose. Annex last updated: October 27, 2026.

5. International transfers and SCCs

Where the GDPR applies and a restricted transfer of workspace content occurs, the parties incorporate by reference the EU standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914: Module Two (controller to processor) between the Customer and AmDital, and Module Three (processor to processor) for onward transfers to subprocessors where needed. For Customers in the United Kingdom, the UK International Data Transfer Addendum applies as well.

For an executed copy of the clauses, email legal [at] amdital.com.

6. Data subject requests, export and deletion

Any member of a workspace can download their own data as a JSON file from Settings, Account, Privacy tab (“Download my data”), and can erase their own account there with their password. A full export of a workspace, or deletion of a workspace, is request-only: the Customer emails privacy [at] amdital.com, and we answer within 30 days. Requesters on a Customer's helpdesk can make requests by email to the same address.

If a data subject contacts us about workspace content, we direct the request to the Customer or handle it on the Customer's instruction.

7. Return and deletion at end of service

We keep workspace and account data for the life of the subscription plus 30 days. We delete or return it on the Customer's request, by a manual process: the Customer emails privacy [at] amdital.com. We do not currently run an automated workspace deletion. Billing records are kept for 7 years because tax law requires it, as AmDital's own records as controller.

8. How to sign or negotiate this DPA

1. Email legal [at] amdital.com with your company name and the workspace this concerns.
2. We send you a signed copy, or discuss the changes you need.
3. Security questionnaires also go to the same address.

Until a signed copy is issued, this page is a template that has not yet been reviewed by our legal counsel.

Last updated: October 27, 2026. For questions, contact legal [at] amdital.com.