Data Processing Addendum

1. What this addendum covers

This addendum applies whenever we process personal data for you as your processor ("customer personal data"): the personal data in what you put in the service - your machines and what they hold, their files and backups, your secrets, and an organisation's audit log.

For the personal data we decide about ourselves - your account, sign-ins, billing and the security of the service - we are the controller, and our Privacy Policy applies.

If this addendum and the Terms of Service differ about personal data, this addendum applies; where the standard contractual clauses apply, they come before both. Words such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" mean what the EU's General Data Protection Regulation (GDPR) says they mean.

2. Roles and instructions

• You are the controller of customer personal data, or a processor acting for another controller. We are your processor, or your subprocessor.
• We process customer personal data only on your documented instructions: these Terms, your use and settings of the service, and any other written instructions we agree to - transfers abroad included. If the law requires us to process it otherwise, we tell you first, unless that law forbids it.
• We tell you at once if we believe an instruction breaks data protection law.
• You are responsible for having a lawful basis for the personal data you put in the service, and for your instructions following the law.

3. Confidentiality

Everyone we allow to process customer personal data is bound to keep it confidential.

4. Security

We take the technical and organisational measures in Annex 2 to protect customer personal data, as Article 32 of the GDPR requires. We may improve them, but never lower the protection they give overall.

5. Subprocessors

• You give us general authorisation to use the subprocessors on our Subprocessors page.
• We tell you at least 30 days before a new subprocessor starts to process customer personal data, on that page and by e-mail. You may object within that time, on reasonable grounds of data protection. If we cannot resolve your objection, you may stop using the part of the service concerned, or end the agreement, and we refund the credit you bought and have not used.
• We bind each subprocessor by written contract to data protection obligations that protect customer personal data as this addendum does, and we stay responsible to you for its work.

6. Helping you

• Requests from data subjects. The service lets you see, export and delete the data in it. If a data subject writes to us about customer personal data, we pass the request on to you and do not answer it ourselves, unless you ask us to. We help you answer such requests, as far as we reasonably can.
• Your other duties. We help you meet your duties on security, breach notification, data protection impact assessments and prior consultation, taking into account what the processing is and what we know.

7. Personal data breaches

We tell you without undue delay, and within 48 hours of becoming aware of it, of a personal data breach that affects customer personal data. We give you what we know - what happened, the kinds and rough numbers of data and people affected, its likely consequences, and what we have done and will do - and add the rest as we learn it. Telling you is not an admission of fault.

8. Deletion at the end

When the agreement ends, you can take your data as the Terms of Service say. Then we delete customer personal data, unless the law requires us to keep it; what we must keep, we keep locked, and use for nothing else. We erase what stored files and backups are encrypted with at once, so nobody can read them again; their encrypted pieces can stay in our storage until we clear them.

9. Information and audits

We give you the information you need to show that we meet Article 28 of the GDPR, and allow audits, inspections included, by you or by an auditor you choose who is bound to confidentiality. Ask with at least 30 days' notice; audits are at most once a year, unless an authority requires one or after a breach. We may first answer in writing and with documents. An audit is at your cost, in business hours, and must not harm the service or other customers' data.

10. Transfers out of the EU and the UK

We are a company in India, and our team works from India; our servers are in Finland, and our storage is in the EU. The European Commission and the UK have not found India's protection adequate.

So, where customer personal data from the European Economic Area is processed in India, or in another country without such a finding, the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914 apply, and form part of this addendum: Module Two (controller to processor) where you are a controller, and Module Three (processor to processor) where you are a processor. In them: clause 7 applies; under clause 9, option 2 (general written authorisation) applies, with the notice period above; the optional wording in clause 11 does not apply; under clause 13, the supervisory authority is the one that clause names for you, as the data exporter; and under clauses 17 and 18, the law and the courts of Ireland apply. Their Annex I is Annex 1 below, their Annex II is Annex 2, and their Annex III is our Subprocessors page.

For data from the UK, the UK's International Data Transfer Addendum to the European Commission's standard contractual clauses (version B1.0) applies, its tables filled in from this addendum. For data from Switzerland, the clauses apply with the changes the Swiss Federal Data Protection and Information Commissioner requires. If the clauses and this addendum differ, the clauses apply.

11. Liability

Each party's liability under this addendum is as the Terms of Service set it, except where the standard contractual clauses or data protection law do not allow it to be limited.

12. How long it lasts

This addendum lasts as long as we process customer personal data for you.

13. Annex 1: The processing

Data exporter

The customer, as named on its account, with the account's owners as its contact. Its role: controller, or processor.

Data importer

Antelligen Private Limited, Assessment No. 207, Survey No. 42, Rajaveedhi, Narava Village, Gantyada Mandal, Vizianagaram, Andhra Pradesh 535215, India. Contact: privacy@wheelmachine.ai. Its role: processor.

Subject matter

Providing the service under the Terms of Service.

Nature

Storing, running and sending what the customer puts in its machines, making its backups, and support.

Purpose

To provide the service, as the customer instructs.

Data subjects

Whoever the customer's data is about, such as its staff, its users and its customers.

Personal data

Whatever the customer puts in the service: the customer decides.

Sensitive data

None, unless the customer puts it in the service; then the measures in Annex 2 apply, with any the customer adds.

Frequency

Continuous, while the customer uses the service.

Retention

Until the customer deletes it, or as the Terms of Service say once the agreement ends.

Subprocessors

As listed on our Subprocessors page.

14. Annex 2: Security measures

• Data in transit is encrypted, over HTTPS or SSH.
• Each machine is a virtual machine of its own.
• Machines' files in our storage are sealed with a key of their account's own, which the storage company does not hold.
• Secrets and AI keys are kept encrypted. A secret the customer gives a machine is inside it; AI keys and secrets kept outside are not.
• API keys and sign-in cookies are kept only as digests. Keys can be limited to what they need, and to some projects.
• Each machine's internet can be on, off, or open only to the sites the customer lists. Off, it can still look up names and reach some sites we host.
• An audit log records what is done in each account, kept as it was written.
• Access to our servers is limited to the staff who need it, and everyone with access is bound to confidentiality.
• Logs are kept for 180 days, to find and investigate incidents; incidents are reported to India's CERT-In within 6 hours, and to the customer as this addendum says.
• Reports of vulnerabilities are welcomed and handled under our Security policy.

15. Annex 3: Subprocessors

The subprocessors are those on our Subprocessors page, as it stands from time to time under Subprocessors above.

16. Contact

For anything about this addendum, write to privacy@wheelmachine.ai. To keep a copy, print this page or save it as a PDF.