Data Processing Addendum (DPA)

This DPA applies exclusively when and to the extent that SATIA LLC processes Customer Personal Data in connection with the provision of the Satia AI Operating System (Dynamic ERP V3, Satia Docs, voice and messaging agents, automations, and browser agents).

This document becomes legally binding upon the Customer's acceptance of the Terms of Service or upon the Customer uploading or transmitting end-user personal data through Satia APIs, dynamic tables, or channels.

With respect to Customer Personal Data processed under this agreement:

• Customer as Data Controller: Customer independently determines the lawful bases, purposes, and means of processing personal data regarding its end-users, prospective leads, and contacts interacting with Satia.
• SATIA LLC as Data Processor: Satia acts strictly as a Data Processor (or Service Provider under US privacy laws), processing such data solely on behalf of Customer and in accordance with its documented instructions.

Satia contractually covenants to:

• Process Customer Personal Data only on documented instructions from Customer as set out in the Terms of Service, agent configurations, and this DPA, unless required by mandatory applicable law.
• Ensure that all personnel authorized to access customer data are bound by strict contractual confidentiality commitments or professional secrecy obligations.
• No Commercial Data Exploitation: Satia will not monetize, sell, or rent customer personal data or utilize it for independent marketing purposes outside the provision of the Service.

Satia maintains enterprise-grade technical and organizational safeguards designed to protect personal data against accidental or unlawful destruction, loss, alteration, or unauthorized disclosure:

• Cryptographic Multitenancy & Mandatory RLS: Every tenant operates under mandatory PostgreSQL Row Level Security (RLS) policies that isolate database records and prevent cross-tenant exposure without verified session token signatures.
• Advanced Encryption: TLS 1.3 encryption in transit and AES-256 encryption at rest for databases and knowledge base object storage buckets (Satia Docs).
• Principle of Least Privilege: Role-based access controls (RBAC) and mandatory multi-factor authentication (MFA) for administrative and engineering access to cloud environments.
• Resilience & Backups: Automated daily backups and business continuity procedures ensuring prompt recovery and service availability.

Customer provides general authorization for Satia to engage the following sub-processors for technical service delivery:

Subprocessor Guarantees: Satia executes binding data processing agreements with each subprocessor imposing data protection terms no less protective than those in this DPA.

Notice of Changes: Satia will update this subprocessor roster with at least ten (10) days' prior notice, enabling Customer to object on reasonable data protection grounds.

In the event of a confirmed Personal Data Breach impacting Customer Personal Data:

• Notification Window: Satia will notify Customer without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the confirmed breach.
• Incident Details: Notification shall detail the nature of the breach, affected records, immediate remedial actions taken, and primary security contacts.
• Regulatory Assistance: Satia will reasonably cooperate with Customer to fulfill regulatory breach notification obligations to authorities (including the Delaware Attorney General or European supervisory bodies).

Taking into account the nature of the processing, Satia provides reasonable technical and operational assistance to allow Customer to fulfill Data Subject requests (access, correction, deletion, portability, and opt-out under DPDPA):

• Self-Service Features: Satia provides direct UI controls within the Dynamic ERP and Satia Docs to inspect, export, edit, or purge end-user records and transcripts.
• Direct Inquiries: If a Data Subject submits a request directly to Satia, Satia will instruct the individual to direct their request to Customer as the responsible Controller.

Upon contract termination or upon Customer's written request:

Satia shall, at Customer's election, securely delete or return all Customer Personal Data stored within the platform, including ERP rows, RAG vectorized vectors, transcripts, and channel tokens, within thirty (30) days, unless applicable federal or state law requires prolonged retention.