XALEN Technology Private LimitedThis Data Processing Agreement ("DPA") is Exhibit B to the MSA between XALEN Technology Private Limited ("Vedika") and the Customer named in the Order Form ("Customer"). Capitalised terms have the meanings in the MSA.
1. Roles
1.1 Roles. For personal data Vedika processes to provide the Service, Customer is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the controller under the EU and UK GDPR, and Vedika is the Data Processor and processor. If Customer is itself a processor, it confirms that its controller has authorised this DPA.
1.2 Valid contract. This DPA is the valid contract under section 8(2) of the DPDP Act and the contract under Article 28 of the GDPR.
1.3 Vedika's own purposes. Vedika acts as an independent controller only for account, billing, security and fraud data, and for the metadata and anonymised aggregate data described in MSA clause 7.4. If Customer opts in under MSA clause 7.2, Customer instructs that use and is responsible for its lawful basis and notice.
2. Processing details
2.1 Subject and purpose. Vedika processes personal data to provide, secure and support the Service for the Term and for the retention periods in clause 8.
2.2 Data subjects. Customer's End Users and the people whose details they submit, and Customer's staff who use the dashboard.
2.3 Personal data. Identifiers supplied by Customer; birth details (date, time and place); questions, conversation history and saved memory items; palm photographs and the palm readings made from them (readings include coarse hand-feature observations); technical metadata such as IP address and timestamps; and feedback.
2.4 Sensitive data. Customer will not submit special categories of data, except as birth details and questions may reveal them incidentally, and obtains any consent needed for them. Palm photographs handled under clause 2.5 are not treated as special-category data, and Customer remains responsible for clause 3.2.
2.5 Palm photographs. This clause applies to photographs sent to the Palm API (the /v2/palmistry endpoints). A palm photograph sent with a question to the query endpoint is answered as a chat, and that answer follows the Customer Content row in clause 8.1. Vedika uses a palm photograph only to make the reading that Customer's API request asks for and to keep the Service secure. It does not use the photograph to identify or authenticate anyone, keeps no template or other record made for identifying or matching a person, and does not use it to train or improve any model. If Customer asks for the line overlay, the traced line paths are part of the reading and follow the same retention and deletion terms. Vedika itself keeps no copy of the photograph. To make the reading, the photograph is sent over an encrypted connection to the AI model providers that Vedika uses as sub-processors under clause 5, who may hold inputs for a limited period under their own terms, for example for safety and abuse checks. Vedika keeps the reading made from it, and a one-way digest of the image file combined with Customer's account and the request options, so that the same account and options return the same reading for the same photograph, for the period in clause 8.1. The digest cannot be turned back into the photograph and is not used to identify anyone. Customer may delete a reading at any time through the Service, and a request to delete Customer's personal data under clause 8.2 also deletes its palm readings. Clause 8.3 applies to backups and logs.
3. Customer's duties
3.1 Lawful basis. Customer gives the notices, obtains the consents and keeps the lawful basis needed for the processing, and handles requests from data subjects.
3.2 Palm photographs. Before sending a palm photograph, Customer gives the person a clear notice and obtains every consent, release or authorisation required by the law of the place where the person is and of each place where Customer operates, including the verifiable consent of a parent or lawful guardian for a child (a person under 18, or any higher age the local law sets). Customer will not use the Service to identify, verify or single out any person from a palm photograph, or to build a biometric template. Customer keeps records of those notices and consents and gives Vedika a copy within 5 business days of a request. Each palm photograph Customer sends is Customer's confirmation that this clause has been met; Vedika may rely on it and has no duty to check. A breach of this clause 3.2 is treated as a breach of MSA clause 4: Vedika may suspend palm processing under MSA clause 6.2, and Customer's liability for it falls under MSA clause 11.3 and is outside the limits of liability under MSA clause 12.3.
4. Vedika's duties
4.1 Instructions. Vedika processes personal data only on Customer's documented instructions, which are the Agreement and Customer's configuration of the Service, unless law requires otherwise. Vedika tells Customer if it believes an instruction breaks the law.
4.2 Personnel. Vedika's staff who process personal data are bound by confidentiality.
4.3 Security safeguards. Vedika maintains reasonable security safeguards appropriate to the risk, including: encryption in transit and at rest; role-based access control with multi-factor authentication for privileged access; logging and monitoring, with logs kept for 180 days; backups; vulnerability management and periodic testing; incident response; and secure development.
4.4 CERT-In. Vedika complies with the CERT-In Directions of 28 April 2022, including reporting covered incidents to CERT-In within 6 hours of noticing them.
5. Sub-processors
5.1 Categories. Vedika uses sub-processors in these categories: hosting and infrastructure; AI model and inference providers; email and communications; payments and billing; support and customer management; and monitoring and security.
5.2 List. The list is published at vedika.io/trust, where AI model and inference providers appear by category. Vedika gives Customer the names of those providers, and the processing locations that apply to Customer's account, on request.
5.3 Changes. Vedika gives 30 days' notice of a new sub-processor by email or in the dashboard. Customer may object on reasonable data-protection grounds within that period. If the Parties cannot resolve the objection, Customer's only remedy is to end the affected Service by notice, with a pro-rata refund under MSA clause 5.8.
5.4 Flow-down. Vedika binds each sub-processor to data-protection terms at least as protective as this DPA and remains responsible for it.
6. Personal data breaches
6.1 Notice to Customer. Vedika notifies Customer's technical contact of a personal data breach without undue delay and within 72 hours of becoming aware of it, with the facts then known, and updates Customer as it learns more.
6.2 Content and help. The notice describes the breach, the data and people affected, the likely consequences and the measures taken. Vedika helps Customer meet its own duties to notify the Data Protection Board of India, supervisory authorities and data subjects.
6.3 CERT-In. Vedika's report to CERT-In is separate from its notice to Customer and overrides any confidentiality duty.
6.4 No admission. A breach notice is not an admission of fault or liability.
7. Assistance
7.1 Requests and assessments. Vedika forwards to Customer, within 5 business days, any request it receives from a data subject about Customer's data, and gives reasonable help with such requests, grievance redressal, impact assessments and regulators' inquiries. Help beyond the Service's standard features is charged at Vedika's standard rates.
8. Retention, export and deletion
8.1 Retention periods. Vedika keeps personal data as follows:
| Data | How long it is kept |
|---|---|
| Customer Content, including conversation history, saved profiles and memory items | While Customer's account is active; deleted from live systems within 30 days of a request or of the end of the Agreement |
| Palm readings made through the Palm API and the image digest kept with them (Vedika keeps no copy of the photograph) | 30 days from the reading, or until Customer deletes the reading |
| Request records without content (endpoint, status, timing) | 90 days |
| Security and operational logs, which may hold fragments of content | 180 days |
| Backup copies | Roll off within 120 days |
| Billing and tax records | 8 years |
8.2 Export and deletion. On Customer's request, Vedika exports or deletes Customer's personal data from live systems within 30 days, including when a data subject's request requires it.
8.3 Backups and logs. Backup copies and logs are not edited for individual requests. They roll off within the periods above and are used in the meantime only to restore the Service, for security and operations, and to meet legal duties.
8.4 Legal holds. Vedika may keep data longer where law, an investigation or a legal claim requires, and flagged content as stated in MSA clause 7.3.
9. Audit
9.1 Information. Once a year, on 30 days' notice, Vedika gives Customer written answers and documents reasonably needed to show compliance with this DPA, under the confidentiality terms of the MSA. On-site audits take place only where a regulator requires them, at Customer's cost.
10. Transfers
10.1 Locations. The Service runs on multi-region infrastructure with automatic routing, so personal data may be processed outside Customer's country.
10.2 India. Vedika will not transfer personal data to a country the Government of India restricts under section 16 of the DPDP Act, and will adjust its processing within a reasonable time if a country is restricted.
10.3 EU and UK. For personal data protected by the EU or UK GDPR, Annex A applies.
11. Liability and precedence
11.1 Liability. The MSA's limits of liability apply to this DPA, except that Customer's liability for a breach of clause 3.2 is outside them, as stated in clause 3.2 and MSA clause 12.3. The limits do not limit the rights of data subjects under the Standard Contractual Clauses.
11.2 Order of precedence. If the Agreement documents conflict, they apply in this order: (1) the Special Terms of the Order Form; (2) the DPA, on personal-data matters only; (3) the MSA, including the rest of the Order Form; (4) the SLA; (5) policies and Documentation. For EU and UK transfers, the Standard Contractual Clauses and the UK Addendum prevail over this DPA.
Annex A: EU and UK transfers
A.1 EU clauses. The Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 are incorporated: Module 2 where Customer is a controller and Module 3 where Customer is a processor. Customer is the data exporter and Vedika the data importer. Clause 7 applies. Under Clause 9, option 2 applies with 30 days' notice. The optional language in Clause 11 does not apply. Under Clause 13, the supervisory authority is that of the Member State where Customer is established or, if none, where its representative is. Under Clauses 17 and 18, the law and courts of Ireland apply.
A.2 Annexes. Annex I is completed by the Order Form and clause 2 of this DPA; Annex II by clause 4.3; and Annex III by the sub-processor list published at vedika.io/trust and the provider names Vedika gives Customer on request.
A.3 UK. For transfers from the UK, the International Data Transfer Addendum issued by the UK Information Commissioner (version B1.0) applies, completed with the details above. Either Party may end it under its Section 19. Transfers from Switzerland follow the same clauses, read for Swiss law.
Contact
Vedika Intelligence · XALEN Technology Private Limited · SN56/8/9A704 Gagan Unnati, Soc Katraj Kondhwa Rd, Kondhwa BK, Pune, Maharashtra 411048, India · privacy@vedika.io · legal@vedika.io