Data Processing Addendum

1. Scope and parties

This Data Processing Addendum ("DPA") forms part of the Terms of Service or other written agreement (the "Agreement") between PALM SOUQ PRIVATE LIMITED ("PALM SOUQ" or "Processor") and the customer ("Customer" or "Controller"). It applies where PALM SOUQ processes Customer Personal Data on Customer's behalf in providing the Service. If there is a conflict between this DPA and the Agreement, this DPA controls on matters of data protection; if there is a conflict with the Standard Contractual Clauses, the Clauses control.

"Data Protection Laws" means all laws that apply to the processing of Customer Personal Data under the Agreement, including Regulation (EU) 2016/679 ("GDPR"), the GDPR as incorporated into UK law ("UK GDPR"), the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), and India's Digital Personal Data Protection Act, 2023 and rules made under it ("DPDP Act"). Terms such as controller, processor, data subject, personal data breach and processing have the meanings given in the GDPR; under the DPDP Act, Customer is the data fiduciary and PALM SOUQ the data processor.

2. Details of processing

3. Processing on instructions

PALM SOUQ will process Customer Personal Data only on Customer's documented instructions, which are the Agreement, this DPA, Customer's configuration of the Service, and any further written instructions agreed by the parties. PALM SOUQ will inform Customer if, in its opinion, an instruction infringes Data Protection Laws, and may suspend the affected processing until the instruction is confirmed or changed.

Customer is responsible for having a lawful basis for the processing, for giving any notices and obtaining any consents Data Protection Laws require, and for the accuracy of the personal data it sends. Customer will configure PALM SOUQ headers with opaque identifiers wherever possible.

4. Zero Payload Retention

PALM SOUQ processes request content (prompts, system messages, tool arguments and completions) only in memory and only while the request is in flight, to forward it, count tokens and evaluate loop heuristics. Request content is not written to persistent storage, not included in logs, metrics or traces, and not accessible to PALM SOUQ personnel. Loop detection uses derived, non-reversible signals that are discarded at the end of the detection window. PALM SOUQ does not use Customer Personal Data to train machine learning models.

5. Confidentiality of personnel

PALM SOUQ ensures that personnel authorized to process Customer Personal Data are bound by confidentiality obligations, receive annual privacy and security training, and have access only to the extent needed for their role. Production access requires single sign-on with hardware security keys and is logged and reviewed.

6. Security measures

PALM SOUQ implements and maintains the technical and organizational measures below, which are audited annually against the SOC 2 Type II criteria.

• Encryption in transit with TLS 1.2 or higher, and at rest with AES-256.
• Provider API keys encrypted with keys held in hardware security modules (AWS KMS and Cloudflare Secrets); keys are never returned to the browser after they are saved.
• Tenant isolation enforced at the gateway and in the metering store, tested in CI on every release.
• Least-privilege access, quarterly access reviews, and automatic removal of access on offboarding.
• Centralized security monitoring, intrusion detection and 24x7 on-call response.
• Annual third-party penetration testing and a public vulnerability disclosure program.
• Business continuity with multi-region failover and fail-open SDKs, tested at least twice a year.
• Secure development lifecycle with mandatory code review and dependency scanning.

7. Subprocessors

Customer gives general authorization for PALM SOUQ to engage subprocessors. The current list is published at palmsouqltd.com/legal/subprocessors. PALM SOUQ will notify Customer at least 30 days before adding or replacing a subprocessor, by email to account owners and by updating that page. Customer may object on reasonable data protection grounds within that period; the parties will discuss the objection in good faith, and if it cannot be resolved, Customer may terminate the affected Service and receive a refund of prepaid fees for the remaining term.

PALM SOUQ imposes data protection terms on each subprocessor that are no less protective than this DPA and remains liable for its subprocessors' performance. Model providers that Customer selects (for example OpenAI, Anthropic, Google or AWS) receive requests on Customer's own instruction under Customer's agreement with them and are not PALM SOUQ subprocessors.

8. Assistance with data subject requests

Because PALM SOUQ does not retain request content, most data subject requests concern metadata identifiers. The dashboard and API let Customer search, export and delete metadata by tenant or user identifier. If PALM SOUQ receives a request directly from a data subject, it will redirect the request to Customer and will not respond except to confirm the redirection, unless legally required. PALM SOUQ will also provide reasonable assistance with data protection impact assessments and consultations with supervisory authorities.

9. Personal data breach

PALM SOUQ will notify Customer without undue delay, and in any case within 48 hours, after confirming a personal data breach affecting Customer Personal Data. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. PALM SOUQ will update Customer as more information becomes available and will support Customer's notifications to supervisory authorities, the Data Protection Board of India and affected individuals. Notification is not an admission of fault.

10. International transfers

PALM SOUQ may process Customer Personal Data in the regions where it operates: the United States, the European Union, India and Singapore. Growth and Scale customers may pin metadata storage to the United States, the European Union or India.

For transfers of personal data from the EEA to a country without an adequacy decision, the parties incorporate the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module 2 (controller to processor) and, where Customer is itself a processor, Module 3 (processor to processor). The optional docking clause applies; Clause 9 option 2 (general authorization) applies with the notice period in section 7; the optional language in Clause 11 does not apply; Clauses 17 and 18 are governed by the laws of, and disputes resolved in, Ireland. Annex I is completed by section 2 of this DPA and Annex II by section 6. For UK transfers, the UK International Data Transfer Addendum applies, and for Swiss transfers the Clauses apply with references adapted to Swiss law.

Transfers of personal data out of India are made in accordance with the DPDP Act and are not made to any country or territory restricted by notification of the Government of India.

11. Deletion and return

On termination of the Agreement, Customer may export its metadata through the dashboard or API for 30 days. PALM SOUQ will then delete Customer Personal Data from production systems within a further 30 days, and from backups within 90 days, unless retention is required by law, in which case the retained data stays protected by this DPA. PALM SOUQ will certify deletion in writing on request.

12. Audits

PALM SOUQ makes its current SOC 2 Type II report, penetration test summary and security policies available to Customer under confidentiality through the Trust Center. If these do not reasonably demonstrate compliance with this DPA, or a supervisory authority requires it, Customer may conduct an audit once a year, at its own cost, with 30 days' notice, during business hours, by a mutually agreed independent auditor bound by confidentiality, and without access to other customers' data.

13. CCPA terms

To the extent PALM SOUQ processes personal information subject to the CCPA, PALM SOUQ acts as a service provider and will not sell or share it, retain, use or disclose it outside the direct business relationship with Customer or for any purpose other than the business purposes in the Agreement, or combine it with personal information from other sources except as the CCPA permits. PALM SOUQ will notify Customer if it can no longer meet these obligations, and Customer may take reasonable steps to stop and remediate unauthorized use.

14. Liability and term

Each party's liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Laws do not permit such a limitation. This DPA remains in force for as long as PALM SOUQ processes Customer Personal Data. Questions about this DPA can be sent to privacy@palmsouqltd.com; a countersigned copy is available on request from legal@palmsouqltd.com.