#Data Processing Agreement (DPA-GL-001)

This Data Processing Agreement ("this Agreement" or "DPA") is made with effect from 31 July 2026 between:

(1) Edsol Edtech Pvt. Ltd., a Private Limited Company incorporated in India, CIN [TO BE SUPPLIED], having its registered office at 28, Jamunather Bulandshahar Uttar Pradesh India ("Pensieve", the Data Processor); and

(2) Customer legal name, a Customer entity type, having its registered office at Customer address formatted ("Customer", the Data Fiduciary),

each a "Party" and together the "Parties".

This Agreement is incorporated into and forms part of the Master Services Agreement between the Parties ("MSA"). Terms defined in the MSA and not defined here carry the MSA meaning. This Agreement has no independent commercial effect: it exists to govern the processing of Personal Data under the MSA.

Where a conflict is genuinely irreconcilable, the following order applies, higher prevailing over lower, and only to the extent of the conflict:

1. The applicable jurisdiction Annexure to this Agreement (Annexures IV to VII), and, where incorporated, the Standard Contractual Clauses in the form set out in Annexure V;
2. This Agreement (body and Annexures I to III);
3. The Security Addendum (ADD-GL-001);
4. The Order Form (ORD-GL-001);
5. The Service Level Agreement (SLA-GL-001);
6. The Master Services Agreement (MSA-IN-001);
7. Any policy or disclosure referenced in this Agreement.

Nothing in a lower-ranked document reduces a protection given to Data Principals by a higher-ranked one. Where the Standard Contractual Clauses are incorporated, they prevail over everything else in the event of conflict, as required by their own Clause 5.

This Agreement takes effect on 31 July 2026 and continues for so long as Pensieve Processes any Personal Data on behalf of the Customer, including any period after termination or expiry of the MSA during which Pensieve retains Personal Data pending return, deletion or a Legal Hold. 14, 15, 16 and 17 survive termination for the periods stated in them.

Pensieve does not charge the Customer for performing its obligations under 9 (Data Principal rights), 10 (Personal Data Breach), 11 (Assessments) or 14 (Return and Deletion) at the volumes and frequencies stated in those clauses. Charges apply only where this Agreement expressly says so, and are then charged at the professional services rate in the Order Form.

<DefinedTerm term="Applicable Data Protection Law" />: every law relating to the protection of personal data that applies to the Processing, including the laws identified in the Applicability table above.

<DefinedTerm term="Customer Personal Data" />: Personal Data contained in Customer Data that Pensieve Processes on behalf of the Customer under the MSA. Described in Annexure I.

<DefinedTerm term="Data Fiduciary" />: a person who alone or in conjunction with others determines the purpose and means of Processing of Personal Data (DPDP Act s.2(i)). The Customer is the Data Fiduciary.

<DefinedTerm term="Data Principal" />: the individual to whom the Personal Data relates (DPDP Act s.2(j)), and in the case of a child, includes her parent or lawful guardian, and in the case of a person with a disability, her lawful guardian.

<DefinedTerm term="Data Processor" />: a person who Processes Personal Data on behalf of a Data Fiduciary (DPDP Act s.2(k)). Pensieve is the Data Processor.

<DefinedTerm term="Deployment Model" />: the model recorded as DM-1 in the Order Form, being one of DM-1, DM-2, DM-3 or DM-4, as described in the Deployment Models disclosure (WPR-GL-004).

<DefinedTerm term="Legal Hold" />: a suspension of deletion applied to a record because retention is required by law, or because the record is subject to a medico-legal case flag, legal notice, consumer complaint, insurance dispute, regulatory proceeding or court order. See 14.6.

<DefinedTerm term="Personal Data" />: data about an individual who is identifiable by or in relation to such data (DPDP Act s.2(t)), and where the Processing is subject to the GDPR, personal data as defined in GDPR Article 4(1).

<DefinedTerm term="Personal Data Breach" /> means any unauthorised Processing of Personal Data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to Personal Data, that compromises the confidentiality, integrity or availability of Personal Data (DPDP Act s.2(u)).

<DefinedTerm term="Platform" />: Pensieve, the operating platform supplied under the MSA.

<DefinedTerm term="Processing" /> means a wholly or partly automated operation or set of operations performed on digital personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction (DPDP Act s.2(x)). "Process" and "Processed" are construed accordingly.

<DefinedTerm term="Service Operations Data" />: data generated by the operation of the Platform that does not identify a Data Principal and is not derived from Customer Personal Data in identifiable form: infrastructure telemetry, error rates, latency, capacity, feature-usage counts, and the identity and contact details of the Customer's own authorised administrative users. Governed by 3.6.

<DefinedTerm term="Sub-processor" /> means a third party engaged by Pensieve that Processes Customer Personal Data on Pensieve's behalf in the performance of the MSA. Listed in Annexure III and maintained in the Subprocessor Register (DIS-GL-009).

<DefinedTerm term="Supervisory Authority" />: the Data Protection Board of India, and in another jurisdiction the authority named in the applicable jurisdiction Annexure.

This Agreement uses DPDP vocabulary in its body. Where the Processing is subject to another law, the following terms are to be read as equivalent. This table is interpretive; it does not alter the substance of any obligation.

Two mapping points matter in practice and are stated rather than left to inference:

(a) DPDP has no sensitive-data tier; the SPDI Rules and the GDPR do. Rule 3 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 expressly includes "physical, physiological and mental health condition" and "medical records and history" in sensitive personal data or information. GDPR Article 9(1) treats data concerning health as a special category. Pensieve therefore applies the higher of the two standards to all Customer Personal Data in every market, and does not operate a two-tier control set.

(b) DPDP's nomination right has no equivalent elsewhere and is a product feature, not a policy. See 9.7.

The Customer determines the purposes and the means of the Processing of Customer Personal Data. The Customer decides which individuals are registered, which clinical, financial and administrative modules of the Platform are enabled, which retention periods apply, who within its organisation may access what, which third-party systems the Platform connects to, and to whom Customer Personal Data is disclosed. The Customer is accordingly the Data Fiduciary, and remains responsible under DPDP Act s.8(1) for compliance "in respect of any processing undertaken by it or on its behalf by a Data Processor", irrespective of any agreement to the contrary.

Pensieve Processes Customer Personal Data only on behalf of the Customer and only on the Customer's documented instructions. Pensieve does not determine the purposes of the Processing of Customer Personal Data. Pensieve determines only the technical means by which the Platform performs the Processing the Customer has instructed, within the design and control commitments in Annexure II and the Security Addendum (ADD-GL-001).

This is the position, stated without qualification: Pensieve does not Process Customer Personal Data for any purpose of its own. Specifically, and for the avoidance of any doubt, Pensieve does not:

(a) use Customer Personal Data to train, fine-tune, evaluate or improve any machine-learning model, whether Pensieve's own or a third party's;

(b) combine, benchmark or analyse Customer Personal Data across the tenancies of two or more customers in identifiable or re-identifiable form;

(c) sell, licence, rent, share or otherwise make available Customer Personal Data to any third party except as a Sub-processor engagement permitted under 8 or on the Customer's documented instruction;

(d) market to, profile, or advertise to any Data Principal;

(e) use Customer Personal Data to develop a product or feature for a third party's benefit; or

(f) retain any re-identification key, mapping table or salt that would permit Pensieve to reverse an aggregation or de-identification performed under 3.4.

Pensieve is therefore not a Data Fiduciary in respect of Customer Personal Data, and does not seek to become one. Where a prospective customer requires Pensieve to perform Processing that would make Pensieve a Data Fiduciary, Pensieve will decline the requirement rather than accept it and misdescribe it.

Pensieve generates operational and product statistics. It does so under three cumulative constraints, each of which is technically enforced and auditable:

1. Aggregation and de-identification occur inside the Customer's tenant boundary, before any data leaves it. What leaves the tenant boundary is a count, a rate, a distribution or a duration, never a record, and never a value from which an individual could be singled out.
2. No re-identification key is created or retained. There is no mapping table, no pseudonym, and no hashed identifier that Pensieve holds outside the tenant boundary. The de-identification is not reversible by Pensieve.
3. A minimum-cell rule applies. Any statistic derived from fewer than the threshold number of Data Principals recorded in Annexure I Section I-8 is suppressed and is not emitted from the tenant boundary.

The output of that process is not Personal Data, because it is not data about an identifiable individual within DPDP Act s.2(t) or GDPR Article 4(1) read with Recital 26. It falls outside Applicable Data Protection Law and outside this Agreement.

The Customer may switch this off. The Customer may, by written notice at any time and at no charge, require Pensieve to cease emitting aggregated statistics from its tenancy other than those strictly necessary to operate, secure, bill for and support the Platform. Pensieve gives effect to that notice within ten (10) Business Days.

Pensieve does not rely, and will not rely, on the research, archiving or statistical purposes exemption at DPDP Act s.17(2)(b) as a basis for Processing Customer Personal Data.

The commonest way a processor accidentally becomes a fiduciary is not a strategy document; it is a log line, a crash dump or a support screenshare. Pensieve therefore commits that:

(a) application, infrastructure and error logs are redacted of Personal Data by default, and where a Personal Data field cannot be redacted without destroying the diagnostic value of the log, that field is tokenised;

(b) diagnostic exports, crash dumps and performance traces taken from a Customer environment are treated as Customer Personal Data, are stored inside the boundary described in Annexure I Section I-6, and are subject to every obligation in this Agreement;

(c) support sessions that require sight of Customer Personal Data are conducted under 6.4 and are recorded; and

(d) screenshots, extracts and record copies taken during support are deleted on closure of the support ticket and in any event within thirty (30) days.

Pensieve is a Data Fiduciary in its own right for exactly two categories of Personal Data, neither of which is Customer Personal Data:

For those two categories only, Pensieve determines the purpose and means, publishes a notice, operates a grievance mechanism (POL-GL-066) and names a grievance officer, [TO BE SUPPLIED], contactable at info@pensievelabs.org.

Patient, clinician and other Data Principal records are never in either category. No clinical, diagnostic, financial or demographic record of a Data Principal is Processed by Pensieve as a Data Fiduciary under any circumstance.

Where the Customer instructs the Platform to transmit Customer Personal Data to a system operated under the Customer's own credentials, including ABDM, NHCX, an insurer or TPA, a payment gateway, a messaging or e-mail provider, a laboratory, a PACS or a government registry, the recipient acts on the Customer's authority and is not a Sub-processor of Pensieve. See 8.6, the Integration Boundary Statement (DIS-GL-024) and the BYOK/BYOC Credential Handling Disclosure (DIS-GL-025).

Nothing in this Agreement makes the Parties joint Data Fiduciaries or, where the GDPR applies, joint controllers within GDPR Article 26.

The Customer warrants that it has a lawful basis for the Processing it instructs, that it has issued any notice and obtained any consent required of it under Applicable Data Protection Law, and that its instructions to Pensieve do not require Pensieve to act unlawfully. Pensieve is entitled to rely on that warranty and is not required to conduct a legal review of the Customer's basis for Processing.

Pensieve supplies the mechanism; the Customer sets the policy. The Customer is responsible for:

(a) issuing the notice required of a Data Fiduciary: under DPDP Rule 3 an itemised description of the personal data, the specified purposes, and links by which the Data Principal may withdraw consent, exercise rights and complain to the Board, using the notice capability the Platform provides;

(b) configuring retention periods per record class against its own legal advice, taking the retention matrix at Annexure I Section I-9 as a default and not as legal advice;

(c) determining which of its personnel and which of its contracted clinicians hold which roles in the Platform, and reviewing those entitlements at the frequency it has adopted;

(d) applying and releasing Legal Holds under 14.6;

(e) responding to Data Principals, and to the Supervisory Authority, as the Data Fiduciary;

(f) supplying and maintaining the third-party credentials described at 3.7, and revoking them when a third-party relationship ends; and

(g) not entering into the Platform any Personal Data outside the categories described in Annexure I without first agreeing an amendment to Annexure I under 20.3.

The Customer must not enter into the Platform, and must not instruct Pensieve to Process, any of the following unless it is recorded in Annexure I Section I-3 or agreed under 20.3: biometric templates used for identification, genetic sequence data, data relating to a national identity system beyond the identifier fields listed in Annexure I, or payment card data in a form that would bring the Platform into the scope of the Payment Card Industry Data Security Standard.

The Customer is responsible for the security of its own network, its endpoints, its identity provider where one is federated to the Platform, its user credential hygiene, and its physical premises. The Security Addendum (ADD-GL-001) records the split of responsibility line by line.

Pensieve Processes Customer Personal Data only on the Customer's documented instructions. The documented instructions consist of, and are limited to:

(a) this Agreement, including Annexure I; (b) the MSA, the Order Form and the Statement of Work; (c) the configuration the Customer sets, and the actions the Customer's authorised users take, within the Platform; (d) written instructions issued by a person authorised in the Customer's escalation matrix, delivered under 19; and (e) instructions given in a support ticket by an authorised user, which are treated as documented because the ticket is a durable record.

Pensieve may Process Customer Personal Data where required to do so by a law to which it is subject. In that case Pensieve informs the Customer of the legal requirement before Processing, unless that law prohibits the disclosure on important grounds of public interest. 17 governs government and law-enforcement demands specifically.

If Pensieve forms the view that an instruction infringes Applicable Data Protection Law, it informs the Customer without undue delay and may suspend performance of that instruction until the Customer confirms or withdraws it. Pensieve is not obliged to conduct a general legal review of the Customer's Processing, and a failure to identify an unlawful instruction is not a breach of this clause unless the illegality was apparent on the face of the instruction.

Pensieve does not use a Customer production environment, or a copy of it, for demonstration, sales, training, load testing or development. Non-production environments are populated with synthetic data. Where a defect can only be reproduced against real data, Pensieve requests the Customer's specific written instruction, works inside the Customer's own environment, and deletes any artefact under 3.5(d).

Pensieve ensures that every person authorised to Process Customer Personal Data, whether employee, contractor or individual engaged through a Sub-processor, is bound by a written confidentiality undertaking that survives the end of their engagement, or is under an appropriate statutory obligation of confidentiality. For personnel engaged in India, that undertaking expressly records the position under section 72A of the Information Technology Act, 2000, under which disclosure of personal information secured under a lawful contract, without consent and with intent to cause or knowledge of likely wrongful loss or gain, is a criminal offence attracting imprisonment of up to three years, a fine, or both, and which reaches the individual and not only the company.

Personnel with access to Customer Personal Data complete privacy and security training before access is granted and at least annually thereafter. Background verification is performed to the standard in the Personnel Security Disclosure (DIS-GL-020).

Access to Customer Personal Data is limited to the individuals who need it to deliver the MSA, is granted by named individual and never by shared account, is scoped to the minimum data set required, and is reviewed at the frequency stated in Annexure II. Standing production access is not granted by default; elevation is just-in-time, time-bound and expires automatically.

Where a support or engineering task requires sight of Customer Personal Data:

(a) access is requested against a ticket that records the reason and the scope; (b) the session is time-bound and expires automatically; (c) the session is logged and, where Annexure II records session recording for the Deployment Model, is recorded; (d) the access event is visible to the Customer in the Platform's access log; and (e) the Customer may require, as a configuration option at no charge, that every such session be approved in advance by a named Customer approver ("break-glass approval"), which is the default under DM-3 and DM-4.

The Offshore/Remote Access & Support Model Disclosure (DIS-GL-033) states who may access Customer Personal Data, from which countries, and under what controls, for each Deployment Model.

Where a jurisdiction Annexure requires that access be limited to named individuals resident in a stated territory, that restriction prevails over this clause and is implemented as an access-control rule, not as a policy statement.

Pensieve implements and maintains appropriate technical and organisational measures to protect Customer Personal Data against Personal Data Breach, having regard to the state of the art, the costs of implementation, the nature, scope, context and purposes of the Processing, and the risk to Data Principals. The measures are set out in Annexure II, per Deployment Model, and in the Security Addendum (ADD-GL-001), which is the controlling technical document.

Rule 6(1) of the Digital Personal Data Protection Rules, 2025 sets a closed list of minimum safeguards that a Data Fiduciary must secure, expressly including in respect of a Data Processor's computer resources. Annexure II maps each of those seven items to a specific implemented control. Rule 6(1)(f) requires "appropriate provision in the contract between Fiduciary and Processor for taking reasonable security safeguards"; this clause, Annexure II and ADD-GL-001 together are that provision.

Pensieve's control set is mapped to ISO/IEC 27001:2022 Annex A control objectives and to the Cloud Security Alliance CAIQ. Pensieve is not certified to ISO/IEC 27001, is not SOC 2 audited, and holds no HITRUST certification. Rule 8(1) of the SPDI Rules 2011 requires a documented, comprehensive information security programme commensurate with the information assets protected; Rule 8(2)'s reference to IS/ISO/IEC 27001 is illustrative of one such standard rather than a mandate. Pensieve relies on the former and does not represent that it has the latter. The compensating evidence available to the Customer is listed at 15.2.

Pensieve may update the measures in Annexure II provided the update does not materially reduce the level of protection. Where an update does materially reduce protection, Pensieve notifies the Customer at least thirty (30) days in advance and the Customer may terminate the affected Services under the MSA if the reduction is not remedied.

Customer Personal Data is encrypted in transit and at rest. Key custody differs by Deployment Model and is stated in Annexure II. The Encryption Disclosure (DIS-GL-011) is the source of truth for algorithms, key lengths, rotation intervals and key-management architecture; this Agreement does not restate them.

Under DM-1 the Customer's tenancy occupies a dedicated cloud project with dedicated compute services, a dedicated database, dedicated storage and dedicated encryption keys. Isolation is at the infrastructure boundary. No other customer's workload executes in that project.

Pensieve maintains logs sufficient to determine who accessed which Personal Data, when, and from where, and makes an access report available to the Customer through the Platform. Log retention, immutability and storage location are stated at Annexure II and in the Log Retention & Localisation Disclosure (DIS-GL-034). Where the Processing is subject to Indian law, logs are retained for not less than three hundred and sixty-five (365) days and are stored within the territory of India, which satisfies both the one-year floor in DPDP Rules 6(1)(e) and 8(3) and the rolling 180-day in-India requirement in Direction (iv) of the CERT-In Directions of 28 April 2022.

Pensieve operates the vulnerability management and patching regime described in DIS-GL-017, and commissions an independent security assessment at least once every twelve months. The summary is made available to the Customer under 15.2.

The Customer gives Pensieve a general written authorisation to engage Sub-processors, subject to this clause. The Sub-processors engaged as at 31 July 2026 are listed in Annexure III. The live, dated register of Sub-processors is the Subprocessor Register (DIS-GL-009), published at https://trust.pensievelabs.org. Annexure III records the position at the date of this Agreement; DIS-GL-009 records the current position, and prevails for the purpose of identifying who is engaged today.

Pensieve engages each Sub-processor under a written contract that imposes data protection obligations which are, in substance, no less protective than those in this Agreement, including the security obligations at 7, the breach notification obligations at 10 and the deletion obligations at 14. Where the Standard Contractual Clauses are incorporated under Annexure V, Pensieve enters into the Clauses with the Sub-processor on the applicable module.

Pensieve remains fully liable to the Customer for the performance of each Sub-processor's data protection obligations, as if the acts and omissions of the Sub-processor were Pensieve's own.

Pensieve gives the Customer thirty (30) days' prior notice of the intended addition or replacement of a Sub-processor. Notice is given by e-mail to the Customer's notified privacy contact and by publication in the Sub-Processor Change Log (DIS-GL-010), to which the Customer may subscribe. The Customer may subscribe more than one address.

The Customer may object, on reasonable data-protection grounds, within fifteen (15) days of the notice. An objection must state the grounds. On objection, the Parties act as follows, in order:

1. Pensieve explains the role of the Sub-processor and the safeguards applied, within five (5) Business Days.
2. If the objection stands, Pensieve uses reasonable efforts to make available a change in configuration or a commercially reasonable alternative that avoids the Sub-processor Processing the Customer's Personal Data.
3. If no such alternative is available within thirty (30) days, the Customer may terminate the affected Services on written notice, without penalty, with a pro-rata refund of prepaid fees for the terminated Services covering the period after termination. Termination on this ground is the Customer's sole remedy for the objection.

If the Customer does not object within the fifteen (15) day window, the change is deemed accepted.

Where a Sub-processor must be replaced urgently to preserve the security or availability of the Platform, Pensieve may make the change immediately and gives notice as soon as it can, and in any event within three (3) Business Days. The Customer's objection right at 8.4 then applies from the date of that notice.

A third-party system that the Platform connects to using the Customer's own credentials, on the Customer's own authority, is not a Sub-processor of Pensieve. Pensieve is not a party to the Customer's relationship with that system, does not hold participant status in the networks concerned, and does not represent that it does. This applies to ABDM and its registries, NHCX, insurers and third-party administrators, payment gateways, SMS, WhatsApp and e-mail providers, laboratories and analyser vendors, PACS providers, and government registries.

Pensieve's obligations in respect of those credentials (encrypted storage in a per-tenant vault, scope of use, rotation, revocation and destruction on offboarding) are set out in the BYOK/BYOC Credential Handling Disclosure (DIS-GL-025) and the corresponding Addendum (ADD-GL-007). The allocation of responsibility is in the ABDM/NHCX Responsibility Matrix (DIS-GL-026).

The consequence for the Customer is direct and is stated plainly: the Customer, not Pensieve, is the Data Fiduciary's counterparty to those systems, and the Customer must have its own basis and its own contracts with them.

Pensieve may engage individual contractors under direct written engagement, subject to 6. Individual contractors working under Pensieve's direction and control, on Pensieve's systems, are treated as Pensieve's personnel and are not separately listed as Sub-processors; the countries from which they work are disclosed in DIS-GL-033.

The Data Principal's rights run against the Customer as Data Fiduciary. Pensieve does not respond to a Data Principal directly, and if it receives a request from a Data Principal it forwards it to the Customer within two (2) Business Days and tells the Data Principal that the request has been forwarded, without answering it.

Pensieve provides, as standard functionality and at no charge, the capabilities the Customer needs to answer a rights request itself:

Where the Customer cannot complete a rights request using the Platform, Pensieve assists. Pensieve acknowledges a request for assistance within two (2) Business Days and delivers the assistance within seven (7) Business Days of the acknowledgement, unless the request is disproportionate in volume, in which case Pensieve tells the Customer within the same two (2) Business Days what it can deliver and by when.

These periods are set so that the Customer can meet its own deadlines with time to spare: the ninety-day outer limit for grievance redressal in DPDP Rule 14(3), the one-month period in GDPR Article 12(3), and the reasonable period the OAIC expects under APP 12.

Pensieve does not verify the identity of a Data Principal. The Customer verifies identity and instructs Pensieve. Where a nominee or a lawful guardian exercises a right, the Customer verifies the nomination or the guardianship.

An erasure instruction never silently destroys a record that law requires to be kept. DPDP Act s.8(7) excepts retention "necessary for compliance with any law for the time being in force", and Indian medico-legal retention obligations frequently require it. On an erasure instruction the Platform produces an Erasure Decision Record stating: the request received and its date; the records in scope; which records were erased; which records were retained, under which legal citation and until when; and the identity of the person who approved the decision. The Erasure Decision Record is exportable and is the Customer's evidence to the Data Principal and to the Supervisory Authority.

Where the Processing is subject to the GDPR, Pensieve additionally assists the Customer with the rights at Articles 15 to 22, including restriction of processing and portability in a structured, commonly used and machine-readable format, within the periods at 9.3.

The nomination right at DPDP Act s.14 has no equivalent in the other markets in which the Platform is sold. It is implemented as a product capability rather than a manual process: a Data Principal may nominate one or more individuals to exercise her rights in the event of death or incapacity, and the Platform records the nominee's name, relationship, contact details and identifier, and supports a nominee-invoked access flow subject to the Customer's verification under 9.4.

Where a right is exercised in respect of a child or a person with a disability who has a lawful guardian, Annexure I Section I-4 governs, and the Customer verifies the parental or guardianship status.

The Customer's statutory clocks are short and they run from the Customer's awareness. Pensieve's commitment is therefore set materially inside every one of them, so that the Customer receives what it needs while it still has time to act:

On becoming aware of a Personal Data Breach affecting Customer Personal Data, Pensieve notifies the Customer:

(a) Initial notification: without undue delay and in any event within four (4) hours of becoming aware. Four hours is chosen deliberately: it leaves the Customer two hours to make CERT-In's six-hour report, which is the shortest statutory deadline any Customer of Pensieve faces in any market.

(b) Supplementary information: within twenty-four (24) hours of the initial notification, or sooner as facts are established.

(c) A consolidated report, within forty-eight (48) hours of the initial notification, containing the content at 10.4 in a form the Customer can use directly in its own filing, so that the Customer can meet the seventy-two-hour detailed reporting obligations under DPDP Rule 7(2)(b) and GDPR Article 33 without redrafting.

(d) A final incident report, within fifteen (15) Business Days of closure, containing root cause, the full timeline, remedial measures taken and the measures adopted to prevent recurrence.

Notification is given by e-mail to the Customer's notified security and privacy contacts and by telephone to the Customer's notified incident contact. Pensieve does not delay the initial notification in order to complete its investigation. An initial notification that says "we know this much and no more" is delivered on time rather than a complete one delivered late.

Pensieve becomes aware of a Personal Data Breach when Pensieve's security function has a reasonable degree of certainty that a security incident has occurred that has led to Customer Personal Data being compromised. The time of awareness is recorded, is disclosed to the Customer in the initial notification, and is available to the Customer's auditor under 15.

Each notification contains, to the extent known at the time and updated as facts are established:

(a) the nature of the Personal Data Breach, including its extent and timing, and the location of its occurrence; (b) the categories and approximate number of Data Principals affected, and the categories and approximate number of records affected; (c) the likely consequences for the affected Data Principals; (d) the measures taken or proposed to address the breach, including measures to mitigate its adverse effects; (e) the measures the affected Data Principals may themselves take to protect their interests; (f) findings, so far as established, regarding the person who caused the breach; (g) the remedial measures adopted to prevent recurrence; and (h) the name and business contact details of the Pensieve person who can answer the Customer's questions.

Items (a) to (h) are drafted to meet the content requirements of DPDP Rules 7(1) and 7(2), GDPR Article 33(3), and the statement requirement in s.26WK of the Privacy Act 1988 (Cth), so that one report serves every filing the Customer must make.

Within forty-eight (48) hours of the initial notification, or as soon after as the facts permit, Pensieve supplies: the list of affected Data Principals with the identifiers the Customer needs to reach them; the affected-record extract; the forensic timeline; and a draft of the notice the Customer must issue, in the form required by the applicable jurisdiction Annexure. The Customer issues the notice; the Customer owns the patient relationship and the communication channel.

Pensieve preserves all evidence relevant to the Personal Data Breach, including logs, images and artefacts, until the Customer confirms in writing that preservation may end or for twelve (12) months, whichever is later. Pensieve cooperates with the Customer's investigation, with any investigation by a Supervisory Authority or by CERT-In, and with any forensic investigator the Customer appoints, and provides a single named point of contact reachable at all hours for the duration of the incident.

Pensieve is a body corporate in its own right and has independent obligations. Where an incident affecting Pensieve's own systems is reportable to CERT-In under Direction (ii) and Annexure I of the CERT-In Directions of 28 April 2022 (which include data breach, data leak, unauthorised access, ransomware and attacks affecting cloud computing systems), Pensieve makes that report within six (6) hours and informs the Customer that it has done so. Pensieve coordinates with the Customer so that the two reports are consistent, and does not treat its own filing as a substitute for the Customer's.

Under DM-1 and DM-2 Pensieve operates the monitoring and detection stack described in Annexure II and is ordinarily the Party that detects an incident first. The commitments at 10.2 are meaningful in full.

Neither Party makes a public statement identifying the other in connection with a Personal Data Breach without the other's prior written consent, except where and to the extent disclosure is required by law or by a Supervisory Authority, in which case the disclosing Party gives the other as much prior notice as is lawful and practicable.

A notification under this clause is not, and is not to be construed as, an acknowledgement by Pensieve of fault or liability.

Pensieve provides the Customer with the information in its possession that the Customer reasonably requires to carry out a data protection impact assessment, a risk assessment or an equivalent exercise, and to consult a Supervisory Authority where one is required. Information is provided within ten (10) Business Days of a written request.

The relevant obligations differ by market and Pensieve does not conflate them: GDPR Articles 35 and 36 apply in the EU/EEA; DPDP Rule 13(1) requires an annual data protection impact assessment and an annual audit only of a Data Fiduciary designated as a Significant Data Fiduciary, and as at 31 July 2026 the Central Government has notified no Significant Data Fiduciary and no class of Significant Data Fiduciaries; and in Australia the OAIC expects a privacy impact assessment as good practice rather than as a general statutory duty for private-sector entities.

To remove the delay that a bespoke information request creates, Pensieve maintains a standing pack that the Customer's assessor may take as the starting point: the Architecture & Technical Overview (WPR-GL-002), the Network & Data Flow Diagram (DIS-GL-006), the Data Residency Statement (DIS-GL-008), the Subprocessor Register (DIS-GL-009), the Encryption Disclosure (DIS-GL-011), the Audit Logging & Traceability Disclosure (DIS-GL-013), the Incident Response & Breach Notification Commitment (DIS-GL-016), the Offshore/Remote Access & Support Model Disclosure (DIS-GL-033), and the completed CAIQ self-assessment. Annexure I doubles as the processor record of processing activities required by GDPR Article 30(2).

Pensieve voluntarily performs, and publishes the summary of, an annual data protection impact assessment, an annual independent security assessment, and an annual statement of due diligence that the technical measures used to Process Customer Personal Data, including any algorithmic software, do not pose a risk to Data Principals' rights. That package mirrors what DPDP Rule 13 would require of a Significant Data Fiduciary. Pensieve is not a Significant Data Fiduciary, is not designated as one, and does not claim to be; it runs the programme because it is the most useful substitute available for a certification it does not hold.

Where a Supervisory Authority, CERT-In or an equivalent body makes an inquiry of the Customer that concerns the Processing, Pensieve provides the information and personnel reasonably required to respond, within the time the authority allows and in any event within ten (10) Business Days.

Pensieve does not transfer Customer Personal Data outside the territory in which it is hosted under Annexure I Section I-6 except as permitted by this clause and by the applicable jurisdiction Annexure. Remote access to Customer Personal Data from another country is a transfer and is treated as one throughout this Agreement; it is not excluded on the basis that the data remains at rest in its home region.

Section 16(1) of the DPDP Act empowers the Central Government to restrict, by notification, transfer to a notified country or territory; Rule 15 adds a condition in respect of making Personal Data available to a foreign State or to a person or entity under the control of, or an agency of, such a State. This is a negative-list model: transfer is permitted unless restricted. As at 31 July 2026 no country or territory has been notified as restricted.

Pensieve's position for a Customer whose Processing is subject to Indian law is nevertheless stricter than the law requires, because the sectoral rules preserved by s.16(2) are stricter: Customer Personal Data and system logs are stored and Processed in the India region recorded at Deal data region, and are not transferred outside India. Pensieve commits to give effect to any future notification under s.16(1) within the period the notification specifies, and to inform the Customer of the change.

There is no adequacy decision under GDPR Article 45 in respect of India, and none is in prospect. Where Customer Personal Data subject to the GDPR is transferred to Pensieve in India, or accessed from India, the transfer is made under Article 46(2)(c) on the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), incorporated by Annexure V, together with the transfer impact assessment and the supplementary measures recorded there. Where the Customer is itself a processor, Module Three (processor to processor) applies instead.

[UNVERIFIED as at 31 July 2026] The European Commission has announced work on an additional set of standard contractual clauses for importers whose processing is already subject to the GDPR under Article 3(2). Those clauses had not been adopted as at the date of this Agreement. If and when they are adopted, Annexure V is amended under 20.3 if they are the correct instrument for the transfer.

Pensieve makes an onward transfer to a Sub-processor only where the transfer is permitted by the applicable jurisdiction Annexure and is covered by an appropriate mechanism: where the GDPR applies, the Standard Contractual Clauses on the applicable module, or a transfer to a country benefiting from an adequacy decision. Annexure III records, for each Sub-processor, its location and the transfer mechanism relied on.

Where the applicable jurisdiction Annexure requires it, the supplementary measures that make a support transfer defensible are implemented as controls and not as undertakings: administrative access terminated on a jump host inside the permitted territory; no direct path from outside that territory to a production system; pseudonymous-by-default support views where a mapping table is held under a key the Customer controls; named-individual, just-in-time, time-bound access with session recording; and per-session approval by a Customer approver. Which of these apply to which Deployment Model and which market is stated in Annexure II and in the applicable jurisdiction Annexure.

17 governs the receipt of, response to and challenge of a demand by a public authority for Customer Personal Data. Where the Standard Contractual Clauses are incorporated, Clauses 14 and 15 of those Clauses apply and prevail.

Localisation obligations are territorial, not risk-based. They cannot be satisfied by encryption, by pseudonymisation or by a contract. Pensieve states its position per market rather than making a single claim that would be false in at least one of them.

Under DM-1 and DM-2 the hosting region is selected and controlled by Pensieve and is recorded at Deal data region. Pensieve does not change the region of an existing tenancy without the Customer's prior written consent.

Pensieve's default product hosting is Google Cloud Platform. Where a market's localisation law cannot be satisfied on that stack, the UAE is the present case, because there is no Google Cloud region in the UAE Pensieve delivers on an alternative architecture listed in the applicable jurisdiction Annexure, and Annexure III identifies the infrastructure Sub-processor that applies to that market. The Data Residency Statement (DIS-GL-008) is the source of truth for the per-market hosting matrix.

Pensieve retains Customer Personal Data for as long as the Customer's configured retention policy requires, and no longer, except where a Legal Hold applies or where a law binding on Pensieve requires longer retention.

Annexure I Section I-9 records the statutory retention defaults the Platform ships with for the Indian market, with the citation for each record class. The Customer may vary any of them. The matrix is supplied so that the Customer does not have to build one, and so that the Customer's accreditation obligation to define retention periods can be evidenced. It is not legal advice, and the Customer remains responsible for the periods it adopts.

The Customer may export its data at any time during the term, without notice and at no charge, through the Platform. On expiry or termination of the MSA the Customer has an export window of thirty (30) days, during which Pensieve maintains the export capability and, if the Customer requests, produces a complete structured export in the formats stated in the Data Deletion & Return Disclosure (DIS-GL-023). The Customer may extend the export window by written request, and Pensieve may charge for an extension beyond sixty (60) days at the rate in the Order Form.

Pensieve does not withhold, degrade or condition the export on payment of a disputed invoice.

Unless the Customer instructs return rather than deletion, or a Legal Hold or a legal retention requirement applies, Pensieve deletes Customer Personal Data as follows:

Two categories survive deletion, and Pensieve states them rather than implying that deletion is absolute:

(a) Logs. Where the Processing is subject to Indian law, DPDP Rules 6(1)(e) and 8(3) require personal data, associated traffic data and processing logs to be retained for not less than one year from the date of the Processing, and Direction (iv) of the CERT-In Directions of 28 April 2022 requires ICT system logs to be retained for a rolling 180 days within India. Pensieve therefore retains access and processing logs for 365 days from the date of the relevant Processing, in an access-restricted state, and deletes them on expiry. Logs are not used for any purpose other than security, statutory production and the Customer's own enquiries.

(b) Customer business records. Direction (v) of the CERT-In Directions requires a service provider to retain validated subscriber records: the Customer's legal name, contract period, allotted tenant identifiers, onboarding e-mail, IP and timestamp, stated purpose, validated address, contacts and ownership pattern, for five (5) years after termination. These are records about the Customer as an organisation and about its administrative users. They contain no Data Principal record. Pensieve also retains executed contracts, invoices and tax records for the period required by company, tax and limitation law.

The Customer may apply a Legal Hold to a record, a record class or the whole tenancy by written notice, and applies holds itself within the Platform for the record classes the Platform supports. A record under Legal Hold is not deleted by a retention rule, by an erasure instruction under 9.5 or by the timetable at 14.4. The Customer releases the hold in writing. Pensieve does not release a Legal Hold on its own initiative and does not apply one except where required by a law binding on it, in which case it informs the Customer unless prohibited from doing so.

Within ten (10) Business Days of completing deletion, Pensieve issues a Certificate of Data Deletion & Destruction (CRT-GL-011), signed by an authorised signatory, stating what was deleted, from which systems, on which dates, by which method, what was retained under 14.5 or a Legal Hold and until when, and the identity of the person who verified the deletion. The Certificate is the Customer's evidence to its own auditors and to a Supervisory Authority.

The Customer may instruct deletion of a specified data set during the term. Pensieve gives effect to the instruction within thirty (30) days, subject to Legal Holds, and issues a Certificate on request.

Under DM-1 and DM-2 Pensieve controls the data stores, the backups and the keys, and performs and certifies the whole of 14.4. Under DM-1 the deletion includes decommissioning the dedicated project.

Pensieve holds no SOC 2 report and no ISO/IEC 27001 certificate. This clause does not pretend otherwise and does not offer a certificate in place of an audit. It gives the Customer three things instead: a standing evidence pack that answers most questions without anyone having to ask; a documented information request process with a committed response time; and a genuine right to audit.

The following are published or made available to the Customer at https://trust.pensievelabs.org, are versioned, and carry the date on which each was last reviewed:

The Customer may make a written request for information necessary to demonstrate compliance with this Agreement. Pensieve responds within ten (10) Business Days, or, where the request is substantial, tells the Customer within five (5) Business Days what it will provide and by when. There is no charge for up to two (2) such requests in any twelve-month period, plus one further request following a Personal Data Breach affecting the Customer or a direction from a Supervisory Authority. Further requests are charged at the professional services rate in the Order Form.

A security questionnaire is an information request. Pensieve answers the Customer's own questionnaire within the same period, and does not require the Customer to accept a standard questionnaire in place of its own.

The Customer, or an independent auditor it appoints, may audit Pensieve's compliance with this Agreement:

(a) once in any twelve-month period, and additionally after a Personal Data Breach affecting the Customer or where a Supervisory Authority directs an audit; (b) on thirty (30) days' prior written notice, or such shorter notice as a Supervisory Authority requires; (c) during business hours, for a period not exceeding three (3) Business Days unless the Parties agree otherwise; (d) conducted remotely by default, with an on-site component where the audit scope cannot be satisfied remotely; (e) by an auditor who is not a competitor of Pensieve and who has signed a confidentiality undertaking on terms no less protective than the MSA; (f) against a scope agreed in advance in writing, which may cover the measures in Annexure II, the controls in ADD-GL-001, the access logs relating to the Customer's tenancy, the Sub-processor arrangements, and the deletion and retention processes.

Cost. The Customer bears its own costs and the auditor's costs. Pensieve bears its own costs of cooperating with one audit in any twelve-month period. Where an audit follows a Personal Data Breach caused by Pensieve's breach of this Agreement, or where an audit identifies a material non-compliance by Pensieve, Pensieve bears the Customer's reasonable audit costs.

An audit may not: access the personal data or systems of another customer; obtain a copy of Pensieve's source code or of another customer's contract or commercial terms; extract personnel records beyond confirmation that screening and training obligations have been met; or interfere with the availability of the Platform for other customers. Under DM-2 the audit is limited to the controls and evidence that can be produced without exposing another tenant.

The Customer may commission a penetration test of its own environment on thirty (30) days' written notice, against agreed rules of engagement, and shares the report with Pensieve.

If Pensieve later obtains an ISO/IEC 27001 certificate, a SOC 2 Type II report or an equivalent independent attestation, Pensieve makes it available and the Customer may take it in satisfaction of the audit right to the extent of the scope it covers. The audit right at 15.4 continues to apply to anything outside that scope. A certification does not extinguish the audit right and this Agreement does not treat it as if it did.

The Customer shares the audit findings with Pensieve. Pensieve responds within fifteen (15) Business Days with a remediation plan carrying an owner and a date for each finding, and reports completion. A finding that constitutes a material breach of this Agreement is remediated within thirty (30) days or within such longer period as the Parties agree in writing.

Pensieve submits to an audit or inspection by a Supervisory Authority having jurisdiction over the Customer's Processing, and provides the access and information that authority requires.

Liability under this Agreement is governed by the limitation of liability clause in the MSA. Claims under this Agreement and claims under the MSA count against one aggregate cap, not two. This Agreement does not create a separate or additional cap, and does not restate the MSA's cap, exclusions or carve-outs.

Nothing in this Agreement or in the MSA limits or excludes either Party's liability where limitation or exclusion is not permitted by Applicable Data Protection Law, including a data subject's rights under GDPR Article 82 and under Clause 12 of the Standard Contractual Clauses where those Clauses are incorporated.

Pensieve indemnifies the Customer against a claim by a Data Principal, a fine or penalty imposed by a Supervisory Authority, and the reasonable costs of defending either, to the extent caused by Pensieve's breach of this Agreement, its Processing outside the Customer's documented instructions, or its failure to implement the measures in Annexure II. The indemnity is subject to 16.1 and to the indemnity procedure in the MSA, and is reduced to the extent the loss is attributable to the Customer's own act, omission or instruction.

The Customer indemnifies Pensieve against a claim, fine or penalty, and the reasonable costs of defending either, to the extent caused by an instruction that infringes Applicable Data Protection Law, by the Customer's failure to obtain a lawful basis or to issue a required notice, or by the Customer entering categories of Personal Data outside Annexure I without agreement.

This is stated because it is material to how the Parties allocate risk, and because it is frequently misunderstood in negotiation.

Under the DPDP Act the penalties in the Schedule to the Act are imposed on the Data Fiduciary. A Data Processor carries no direct financial penalty under that Schedule. The principal heads, all of which are statutory ceilings rather than tariffs and none of which is in force before the commencement of section 33:

Two consequences follow, and both are advantages to the Customer rather than to Pensieve:

1. The Customer's two largest statutory exposures are weak security and slow breach notification. Annexure II addresses the first; the four-hour commitment at 10.2 addresses the second.
2. Because Pensieve carries no direct DPDP penalty, the indemnity at 16.3 is a genuine transfer of risk rather than a restatement of a liability Pensieve already bears.

Pensieve's own direct statutory exposure in India is real but sits elsewhere: section 43A of the Information Technology Act, 2000 provides for compensation, with no statutory ceiling, where a body corporate handling sensitive personal data is negligent in implementing reasonable security practices; and section 72A creates criminal liability for disclosure in breach of a lawful contract, reaching individual personnel. Those provisions remain in force until the corresponding omission provisions of the DPDP Act commence.

Under the GDPR a processor is directly liable to a data subject under Article 82(2) for damage caused by processing where it has not complied with obligations directed specifically to processors or has acted outside or contrary to lawful instructions, and is directly exposed to administrative fines under Article 83. Under the Privacy Act 1988 (Cth) the obligations attach to the APP entity, and Pensieve's exposure is contractual unless it has an Australian link or has elected under s.6EA. Under the PDPL the obligations attach primarily to the controller, with defined processor duties. Each jurisdiction Annexure states the position for that market.

Pensieve maintains the insurance recorded in the Insurance Schedule (ADD-GL-021), including cyber liability cover, and provides a certificate on request. Insurance does not limit liability and liability is not limited to the amount recoverable under a policy.

Pensieve operates the Legal & Law Enforcement Request Policy (POL-GL-067). Every demand is handled under that policy by a named legal owner and is recorded.

On receiving a legally binding demand from a public authority for disclosure of Customer Personal Data, Pensieve:

(a) reviews the legality of the demand, including whether it is issued by a competent authority, under a valid power, and in a proportionate scope; (b) challenges the demand where there is a reasonable basis to do so, including by seeking to have it narrowed or set aside, and pursues an available appeal; (c) discloses the minimum data necessary to comply, and only after exhausting (b); (d) requires the authority to accept delivery through a documented channel and records what was disclosed; and (e) notifies the Customer before disclosure, or as soon afterwards as is lawful, unless notification is prohibited, in which case Pensieve seeks a waiver of the prohibition and documents the attempt.

Pensieve redirects a demand to the Customer wherever the authority can obtain the data from the Customer directly, and tells the authority that the Customer is the Data Fiduciary.

Pensieve does not grant any public authority direct, indirect, blanket or standing access to Customer Personal Data or to the systems on which it is Processed, and has not been asked to. Pensieve has created no mechanism by which such access could be given without the process at 17.2.

Pensieve publishes a periodic Transparency Report (POL-GL-068) stating the number and type of demands received, the number challenged and the number complied with, at the level of aggregation the law permits. Where Pensieve is prohibited from reporting a number, it says that a prohibition applies rather than reporting zero.

Pensieve cannot undertake to defeat a lawful order of a court or authority of competent jurisdiction, and does not undertake it here. Indian law contains compulsion powers, including under section 69 of the Information Technology Act, 2000 and the rules made under it, section 5(2) of the Indian Telegraph Act, 1885, and the production powers of the criminal procedure statute. The transfer impact assessment referenced in Annexure V addresses them directly rather than asserting that they do not exist. What Pensieve commits to is the process at 17.2 and the technical measures at 12.5, which together determine what is actually available to be compelled.

The Customer notifies Pensieve of its privacy contact, its security incident contact reachable at all hours, and its authorised instructing persons, and keeps them current. Pensieve is entitled to rely on the most recently notified details. A notification under 10.2 sent to the most recently notified contacts is validly given.

The Customer publishes its own contact for Data Principals. Pensieve's contact details are not published to Data Principals as the route for exercising rights, because the rights run against the Customer.

This Agreement is governed by Legal governing law and the courts at Legal jurisdiction have jurisdiction, subject to the dispute resolution provisions of the MSA and to any different governing law or forum stated in an incorporated jurisdiction Annexure or in the Standard Contractual Clauses, which prevails for the matters it covers.

This Agreement, with the documents it incorporates, is the entire agreement between the Parties on the Processing of Customer Personal Data and supersedes any prior data protection term between them. If a provision is held invalid or unenforceable, it is severed and the remainder continues; the Parties will negotiate in good faith a replacement that achieves the intended protection.

A variation of this Agreement is effective only if in writing and signed by both Parties, except that: (a) Pensieve may update Annexure II under 7.4 and Annexure III under 8.4; and (b) where a change in Applicable Data Protection Law, or the adoption of a new transfer mechanism, requires an amendment, either Party may require the other to enter into it, and the Parties will do so within thirty (30) days, acting reasonably.

This Agreement may be executed in counterparts and by electronic signature, including by Aadhaar-based electronic signature or a digital signature certificate issued by a licensed Certifying Authority under the Information Technology Act, 2000, or by an equivalent method valid in the Customer's jurisdiction. An electronically executed counterpart has the same effect as a wet-ink original.

Where stamp duty is payable on this Agreement, it is borne as provided in the MSA and the instrument is stamped in accordance with the law of the state or jurisdiction of execution before or at the time of execution.

No person other than a Party has a right to enforce this Agreement, except that a Data Principal may enforce a third-party beneficiary right expressly conferred by the Standard Contractual Clauses where they are incorporated.

This Agreement is executed in English. Where a translation is provided for convenience, the English text prevails.