Data Processing Addendum

1. Parties, roles and precedence

Definitions: personal data is information about an identified or identifiable person (the data subject). Processing includes collection, storage, use, disclosure and deletion. An affiliate controls, is controlled by, or is under common control with a party. A subprocessor is a processor engaged by FastCollab to process customer personal data. A security incident is accidental or unlawful destruction, loss, alteration, disclosure of or access to that data. The EU Area means the EU, EEA, UK and Switzerland; a third country is a destination without the relevant adequacy decision. Controller, processor, business and service provider have their applicable legal meanings.

This Addendum is between FastCollab Systems Private Limited and the customer identified in the applicable service agreement (Agreement). The customer is the controller, or a processor authorised by its controller; FastCollab is the processor or subprocessor accordingly. Customer Personal Data means personal data processed on that customer’s behalf. Applicable Data Protection Law means the data protection laws that apply to that processing.

A separately agreed DPA continues to govern existing customers unless validly amended. For conflicts about processing, applicable mandatory transfer clauses prevail, followed by the applicable DPA and then the general Agreement. This page alone does not execute transfer clauses or replace their required annexes.

2. Customer instructions and responsibilities

The Agreement, configured service settings and documented lawful requests comprise the customer’s instructions. The customer determines the permitted purposes, ensures a lawful basis, provides required notices, obtains necessary permissions and limits data to what is needed. A customer acting as processor must have its controller’s authorisation. Special-category or other unusually sensitive processing requires specific instructions and agreed safeguards.

3. FastCollab’s processing obligations

FastCollab will process Customer Personal Data only on documented instructions, including for transfers, unless legally required otherwise. In that case, it will inform the customer before processing unless the law prohibits notice. FastCollab will promptly inform the customer if it considers an instruction infringes applicable data protection law.

Authorised personnel must be bound by confidentiality and access limited to their duties. FastCollab will not sell Customer Personal Data or use it for unrelated purposes outside the instructions. Customer content is not authorised for unrelated model training by this DPA. Any proposed additional AI processing must be specified and agreed.

4. Security and assistance

FastCollab will implement technical and organisational measures appropriate to the processing risk, as documented in the applicable security schedule. Measures must address access control, confidentiality, integrity, availability, recovery, secure handling and evaluation of safeguards. Any encryption, testing, monitoring or certification commitments must be specified for the actual service.

Taking into account the processing and information available, FastCollab will assist the customer with individual rights requests, security obligations, breach notifications, data protection impact assessments and prior consultation with authorities. Requests received directly will be referred to the customer unless a response is legally required.

5. Subprocessors

Only subprocessors authorised under the Agreement may process Customer Personal Data. Under general written authorisation, FastCollab will provide advance notice of additions or replacements and an opportunity to object on reasonable data protection grounds. The applicable schedule specifies the notice period. The parties will seek a reasonable resolution before the affected processing proceeds; if unresolved, they will agree an alternative or termination of the affected service under the Agreement.

FastCollab will impose equivalent applicable data protection obligations by written agreement and remains responsible for its subprocessors’ performance. The service-specific register must identify each entity, purpose, data involved and processing locations. Authorisation is specific to the relevant service and does not automatically extend to other FastCollab products.

6. Personal data breaches

FastCollab will notify the customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data and comply with any shorter or specific deadline in the applicable Agreement. Notice will include available details of the incident, affected data and individuals, likely consequences, response measures and a contact point. Information may be supplied in stages as the investigation progresses.

FastCollab will take appropriate containment and remedial steps and assist the customer with its notification obligations. Notification is not an admission of liability. A controller’s regulatory notification deadline is not a waiting period for processor notification.

7. International transfers

Processing locations and cross-border transfers must be identified in the service schedule. Where required, the parties must establish a valid transfer mechanism before a restricted transfer, such as applicable adequacy arrangements or completed standard contractual clauses with the appropriate module, annexes and any required UK provisions. Relevant assessments and supplementary measures must be addressed for the actual transfer.

8. Return, deletion and duration

Processing continues for the agreed service duration and any authorised wind-down or legally required retention. At the customer’s choice, FastCollab will return or delete Customer Personal Data at the end of the processing services and delete existing copies, unless law requires retention. The schedule must specify export arrangements, deletion timing and backup expiry. Retained data remains protected and restricted to the reason it is retained.

9. Compliance information and audits

FastCollab will provide information necessary to demonstrate compliance with this DPA and allow and contribute to audits, including inspections, by the customer or its mandated auditor. Reasonable arrangements may protect confidentiality, other customers and system security without preventing an effective audit or regulator access. Liability and commercial arrangements follow the Agreement, subject to mandatory law.

Schedule 1. Processing by service

The descriptions below identify the relevant processing scope. Only contracted services and enabled features apply. The parties must confirm the precise data, locations, duration and safeguards for their engagement.

Eva: AI Assistant for Travel & Expenses

People: employees, travellers, approvers, finance and travel administrators, and relevant business contacts. Data: identity and employment details, travel requests, itineraries, booking references, receipts, expense and payment records, approvals and communications; passport or visa details only where required for the agreed travel service. Purpose and operations: collect, organise, analyse, retrieve and share authorised information to support travel, expenses, policy checks and approvals. Travel providers’ controller or processor roles must be assessed for the particular arrangement.

Cleo: AI Agents for Support

People: customer end users, support staff, engineers and others identified in authorised issue context. Data: support messages, attachments, contact details, knowledge records, issue activity and authorised code or application log context. Purpose and operations: collect, classify, analyse and retrieve context for triage, suggested responses, investigation and proposed fixes or pull requests for review.

Joya: AI Agents for Sales

People: prospects, business contacts, customer sales users and message participants. Data: names, professional contact details, company and job information, research and signals, email and other outreach content, replies, engagement records, qualification and handoff notes. Purpose and operations: research, organise, prioritise, generate and deliver authorised outreach, analyse replies and transfer conversation context to the customer’s sales team.

Product engineering

People: project contacts and individuals whose data appears in customer-authorised systems. Data: project communications and the specific development, testing or support data agreed in the statement of work. Purpose and operations: access, analyse and handle data only as necessary for the agreed engineering activities. Production access and use of personal data in testing require specific authorisation; use minimised or synthetic data where appropriate.

Schedule 2. Service-specific details

Before processing under this framework, the parties must document the applicable security measures; authorised subprocessors and locations; transfer arrangements; retention, return and deletion periods; incident contacts and deadlines; and subprocessor change notice period. Request the relevant schedule from support@fastcollab.com. This common framework does not substitute for those operational details or assert that every product has identical controls.

Contact

Data processing enquiries: support@fastcollab.com. Contract enquiries: support@fastcollab.com. See the Privacy Policy, Terms of Service and Contact Us.

Eva: processing terms and subprocessors

This section applies to personal data processed for Eva. A separately signed DPA takes precedence where its terms conflict with this section.

Parties: the customer is the exporter and controller/business, or an authorised processor; FastCollab Systems Private Limited is the importer and processor/service provider. The customer may act for authorised affiliates without separate agreements and is responsible for communications to those affiliates and its own notification obligations. FastCollab’s current office is alt.f Meenakshi Tech Park, 8th Floor, B & C Block, Phase 2, Gachibowli, Hyderabad, India.

Additional data and purposes: contractors, authorised users, vendors and shared-service finance users; phone numbers, employee IDs, departments, grades, travel preferences, loyalty numbers, passport/visa details where needed, itinerary/PNR data, login credentials and usage metadata. Processing also supports reimbursement, analytics/reporting, account administration and platform security.

Subprocessor changes: email notice at least 30 days in advance; objections on reasonable grounds; termination of affected services without penalty if no resolution is found. Equivalent written obligations and FastCollab responsibility for subprocessor performance continue.

Incidents: notification without undue delay and within 24 hours of awareness, including nature, approximate numbers of affected people and records, consequences, response measures and a contact point.

California processing: no sale or sharing of Customer Personal Data as defined under CCPA/CPRA; no processing outside the business relationship or combining with other sources except as necessary to perform the services. Business purposes cover security/integrity, debugging, services on behalf of the customer, internal technological research, quality/safety and investigation of incidents or unlawful activity. These purposes remain subject to documented instructions.

Travel providers: for bookings with providers directly contracted by the customer, travel management companies, airlines and hotels act as independent controllers. FastCollab transmits and secures the minimum necessary fulfilment information; the customer is responsible for its chosen providers’ compliance.

Transfers: Eva’s transfer arrangements specify EU SCC Module Two under Irish law for EU/EEA controller-to-processor transfers, the UK Transfer Addendum for UK transfers, and Swiss modifications for Swiss transfers. Applicable executed documents, required annexes and mandatory law control.

Warranties and liability: both parties undertake compliance with applicable data protection law. FastCollab undertakes appropriate safeguards and equivalent subprocessor obligations. Agreement liability terms apply, without limiting individuals’ non-waivable rights. To the extent legally permitted, the customer’s defence and indemnity for its breach of the DPA or data protection law extends to FastCollab and its affiliates.

Eva subprocessor register

The following subprocessors support Eva. Their processing purposes and available location details are listed below. Service-specific schedules identify the applicable entities and configured processing locations.

• Amazon Web Services, Inc. (AWS): cloud infrastructure and services. India (Mumbai).
• Zilliz Inc. (Milvus Cloud): managed vector database for AI embeddings. United States.
• OpenAI, L.L.C.: large language model API for AI assistance. United States.
• OVHcloud (OVH): cloud hosting and infrastructure for Eva. India. The applicable service schedule identifies the contracting entity.
• Google LLC (Google Workspace): corporate productivity suite. United States and EU data centres.
• GitHub, Inc.: source hosting and version control. United States.
• Anthropic (Claude): AI model services. The applicable service schedule identifies the contracting entity, delivery arrangement, and processing locations.

Eva security schedule

Eva’s security commitments include the controls below. Contact support@fastcollab.com for service-specific security documentation.

• Security personnel, annual policy reviews and third-party risk assessments, and penetration testing. Any ISO 27001 certification status and scope must be established by the applicable certification documentation.
• Personnel background checks, confidentiality agreements, privacy/security training and immediate access revocation on departure.
• Multi-factor authentication, least privilege, complex password policies, periodic access reviews and audit trails.
• Cloud hosting, multi-availability zones, TLS/HTTPS, virtual firewalls, network segregation, intrusion detection and DDoS protection.
• Encryption in transit and at rest, key management, logical isolation, minimisation and pseudonymisation where applicable.
• Vulnerability management, patching, secure development, 24/7 monitoring, logging, incident response, change management, automated backups and disaster recovery.

Changes and severability: updates must not materially reduce protection; materially adverse changes are notified in advance where practicable. An unenforceable provision does not invalidate the remainder. Data Protection Officer: Naresh Komirishetty, support@fastcollab.com.

Cleo: processing commitments

Cleo subprocessor register

• DigitalOcean, LLC: cloud hosting and infrastructure. India.
• Resend (Plus Five Five, Inc.): email delivery. Processing locations are identified in the applicable service schedule.
• Anthropic (Claude): AI model services. The applicable service schedule identifies the contracting entity, delivery arrangement, and processing locations.

Cleo customer data is not used to train general AI models shared with other customers. On account deletion, account information is deleted within 30 days, synced support data is removed, and repository and log access is revoked immediately. Retention exceptions apply for legal or legitimate business purposes.

Cleo’s authorised subprocessors, processing locations and security details must be documented in the applicable service schedule. Contact support@fastcollab.com for these details. Customer-connected integrations are governed by their applicable roles and permissions.

Joya: processing commitments

Joya subprocessor register

• DigitalOcean, LLC: cloud hosting and infrastructure. India.
• Resend (Plus Five Five, Inc.): email delivery. Processing locations are identified in the applicable service schedule.
• Anthropic (Claude): AI model services. The applicable service schedule identifies the contracting entity, delivery arrangement, and processing locations.

For a personal data breach affecting Joya customer data, FastCollab will notify the customer without undue delay and in any event within 72 hours of becoming aware of the breach.

Joya’s security commitments include encryption in transit and at rest, regular assessments and penetration testing, access controls/authentication, backups/disaster recovery, employee security training, and incident response/notification procedures.

Joya authorises subprocessors generally, requires a current list, notice of intended changes, equivalent data protection obligations and FastCollab liability for their acts and omissions. The applicable service schedule must specify subprocessor entities, locations and the change-notice period. For Joya processing enquiries, contact support@fastcollab.com.

Restricted transfers require a documented, applicable safeguard, such as standard contractual clauses or an adequacy decision. Any reliance on binding corporate rules requires an approved arrangement covering the transfer. Rights assistance includes access, correction, erasure, restriction, portability and objection. Audit and inspection rights, compliance information and return/deletion at the customer’s choice continue throughout the service term.

Product engineering: engagement schedule

The relevant statement of work and DPA schedule must identify customer data, access, processing locations, providers, safeguards and deletion arrangements.