Data Processing Addendum

This Data Processing Addendum ("Addendum") forms part of the Agreement between the operator of PlantX and the Customer and applies whenever we process Personal Data contained in Customer Data in providing the Services. Words defined in the Terms Of Service have the same meaning here.

For that Personal Data the Customer is the controller - the "data fiduciary" under India's Digital Personal Data Protection Act, 2023 - and we are its processor ("data processor"). Where the Customer itself processes the data on behalf of another controller, we are its sub-processor and the Customer shall pass on the instructions and information this Addendum requires.

This Addendum does not cover Personal Data we process as a controller for our own purposes - such as the details of the Customer's billing contacts and our records of payment - which the Privacy Policy describes.

We process Personal Data only on the Customer's documented instructions, which are: the Agreement; the Customer's configuration and use of the Services, including the settings, access rights and connections its administrator chooses; and any other written instruction the Customer gives that is consistent with the Agreement. We do not process it for any other purpose.

If the law requires us to process Personal Data otherwise, we will tell the Customer before doing so, unless that law prohibits telling it. We will tell the Customer if, in our opinion, an instruction infringes Data Protection Law.

The Customer is responsible for having a lawful basis for the processing, for giving the notices and obtaining the consents Data Protection Law requires - including to its employees, contract workers, applicants and visitors - and for the accuracy of the Personal Data it puts into the Services.

We ensure that every person we authorise to process Personal Data is bound by a duty of confidentiality, and has access to it only as far as their role needs.

We implement and maintain the technical and organisational measures set out in Annex 2, appropriate to the risk of the processing. We may change those measures, provided that the overall level of security is not reduced.

The Customer gives us general authorisation to engage Subprocessors. The Subprocessors engaged today are listed at https://app.plantx.si/legal/subprocessors, with what each does and where.

We will notify the Customer's administrator in the Services, and update that list, at least thirty (30) days before a new Subprocessor begins processing Personal Data, except where a Subprocessor must be replaced urgently to keep the Services running or secure, in which case we notify as soon as possible. The Customer may object on reasonable grounds relating to data protection within that period. We will then work with the Customer in good faith to address the objection; if we cannot, the Customer may end the affected Order by notice and we will credit the unexpired part of its Fees against its future Orders.

We bind each Subprocessor by a written agreement to obligations of data protection no less protective than this Addendum, and remain responsible to the Customer for its performance.

The Services let the Customer's administrator find, export, correct and delete Personal Data in its records. Taking into account the nature of the processing, we will give the Customer reasonable assistance, by appropriate technical and organisational measures, to respond to requests from Data Subjects to exercise their rights under Data Protection Law.

If we receive such a request directly, we will pass it to the Customer without undue delay and will not respond to it ourselves, except to tell the person to contact the Customer or where the law requires us to respond.

We will notify the Customer without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Personal Data Breach affecting Customer Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, its likely consequences, and the measures taken or proposed to address it, and we will give further information as it becomes available.

We will take reasonable steps to contain and remedy the breach and give the Customer reasonable assistance in meeting its own obligations to notify authorities and Data Subjects. We also report incidents to authorities where the law requires us to, including to the Indian Computer Emergency Response Team (CERT-In) under its directions. Our notice of a breach is not an admission of fault or liability.

Taking into account the nature of the processing and the information available to us, we will give the Customer reasonable assistance with its data protection impact assessments and any prior consultation with a supervisory authority that Data Protection Law requires in relation to the Services.

When the Agreement ends, we will return or delete Personal Data in Customer Data as the clause on Customer Data in the Terms Of Service provides, and delete existing copies, unless the law requires us to keep them; any copy we must keep remains protected by this Addendum for as long as we keep it.

We will make available to the Customer the information reasonably necessary to demonstrate our compliance with this Addendum.

The Customer, or an independent auditor it appoints who is bound by confidentiality and is not our competitor, may audit our compliance with this Addendum on at least thirty (30) days' written notice, no more than once in any twelve (12) months, during business hours and without disrupting the Services or seeing other customers' data, at the Customer's own cost. An audit may take place more often, or at shorter notice, where a supervisory authority requires it or after a Personal Data Breach. We may meet a request for an audit by providing a recent independent report or certification covering the matters to be audited, where one is available.

Customer Data is hosted where the Subprocessors list states, and a Subprocessor may process Personal Data in the countries that list names for it. We transfer Personal Data across borders only in compliance with Data Protection Law. India's law permits a transfer except to a country or territory the Central Government restricts by notification; we will not transfer Personal Data to such a place.

Where Personal Data subject to the GDPR is transferred to a country not recognised as giving an adequate level of protection, the parties agree to the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("SCCs"), which are incorporated by reference: Module Two (controller to processor) where the Customer is a controller, and Module Three (processor to processor) where it is a processor; clause 7 applies; under clause 9 option 2 applies with the notice period in this Addendum; the optional wording of clause 11 does not apply; under clauses 17 and 18 the law and courts of Ireland apply; Annex I is completed by Annex 1 of this Addendum and the Agreement, and Annex II by Annex 2.

Where Personal Data subject to the law of the United Kingdom is transferred, the International Data Transfer Addendum to the SCCs issued by the Information Commissioner (version B1.0), completed with the information in this Addendum, applies; and where Personal Data subject to Swiss law is transferred, the SCCs apply with the references to the GDPR read as references to the Federal Act on Data Protection and the competent supervisory authority being the Federal Data Protection and Information Commissioner.

Each party's liability under this Addendum is subject to the limitations of liability in the Terms Of Service, except to the extent Data Protection Law does not allow such a limitation. As to Personal Data, this Addendum prevails over the rest of the Agreement; the SCCs, where they apply, prevail over this Addendum.