Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Enterprise Master Service Agreement or other written agreement ("Principal Agreement") between the customer ("Customer" or "Controller") and Upplio AI ("Processor"). In case of conflict on data-protection matters, this DPA prevails.

1. Definitions

Terms such as "Personal Data", "Processing", "Data Subject", "Data Fiduciary", "Data Processor", "Sub-processor" and "Personal Data Breach" have the meanings given to them in India's DPDP Act, 2023 and, where applicable, the GDPR.

2. Roles

For enterprise deployments where the Customer uploads employee or candidate data to the Service, the Customer is the Data Controller / Data Fiduciary and Upplio AI acts as Data Processor and processes such Personal Data only on documented instructions from the Customer.

3. Scope, Nature and Purpose

Subject-matter: provision of AI-powered career, resume, interview-preparation and related features. Duration: term of the Principal Agreement. Data Subjects: Customer's employees, contractors and candidates. Personal Data: identity, contact, employment history, education, skills, resumes, interview transcripts, scores and usage data.

4. Security Measures

Upplio AI implements the technical and organisational measures described in the Security Policy, including encryption in transit and at rest, role-based access control, MFA for privileged access, logging and monitoring, secure SDLC, vulnerability management and periodic reviews.

5. Sub-processors

The Customer authorises Upplio AI to engage sub-processors (cloud hosting, database, email, AI model providers, payment processors, analytics). Upplio AI maintains an up-to-date list, imposes equivalent obligations and provides at least thirty (30) days' prior notice of new sub-processors, giving the Customer a right to reasonably object.

6. Assistance and Data-Subject Rights

Upplio AI will provide reasonable assistance to the Customer in responding to Data Subject requests, DPIAs and regulator consultations.

7. Confidentiality

Personnel with access to Personal Data are bound by written confidentiality obligations and trained on data-protection responsibilities.

8. Personal Data Breach Notification

Upplio AI will notify the Customer without undue delay, and in any event within seventy-two (72) hours, of becoming aware of a Personal Data Breach affecting the Customer's data, with information reasonably required for the Customer's own notifications under the DPDP Act, GDPR or other applicable law.

9. Audit Rights

Once per calendar year, the Customer may audit compliance either by written questionnaire or, where reasonably necessary, an on-site audit conducted by the Customer or an independent auditor bound by confidentiality, on at least thirty (30) days' notice and during business hours. Additional audits are permitted following a breach or regulatory requirement.

10. International Transfers

Where Personal Data is transferred outside India or the EEA, the parties will use lawful transfer mechanisms including Standard Contractual Clauses and, once notified, the DPDP-permitted country framework.

11. Deletion and Export

On termination of the Principal Agreement, Upplio AI will, at the Customer's written election, return or delete Personal Data within thirty (30) days, unless retention is required by law. During the term, Personal Data can be exported in a commonly used, machine-readable format.

To execute this DPA for an enterprise engagement, email customerservice@upplioai.com.

Amendments

Upplio AI may amend this document from time to time. Material changes will be notified by email or in-app notice at least fourteen (14) days before they take effect. Continued use of the Service after the effective date constitutes acceptance of the amended terms.

Version

Version: 1.0

Effective: 13 July 2026

Owner: Neetu Yadav, Proprietor, Upplio AI

Contact: customerservice@upplioai.com