Data processing addendum

1. Roles

The customer is the controller (data fiduciary, business) and Active Joules is the processor (service provider) of personal data contained in customer data. Each party complies with the data protection laws that apply to it, including the GDPR, the UK GDPR, the CCPA/CPRA and India's DPDP Act, 2023.

2. Processing details

3. Our obligations

We will:

1. process personal data only on the customer's documented instructions, including those given through the product, unless the law requires otherwise (in which case we inform the customer unless prohibited);
2. ensure that people authorised to process personal data are bound by confidentiality;
3. apply the technical and organisational measures in section 8;
4. assist the customer with data subject requests, data protection impact assessments and consultations with authorities, taking into account the nature of the processing;
5. notify the customer of a personal data breach without undue delay and in any case within 48 hours of becoming aware of it, with the information reasonably available;
6. at the end of the service, return customer data through export for 30 days and then delete it, unless the law requires storage.

4. Audits

We make available the information needed to demonstrate compliance with this DPA: first through our trust center, security documentation and questionnaires and, once available, independent audit reports; on-site audits with 30 days' notice where those do not suffice.

5. Sub-processors

The customer authorises the sub-processors listed on our sub-processors page. We give at least 30 days' notice of new sub-processors; the customer may object on reasonable data protection grounds, and if we cannot address the objection, the customer may end the affected service. We impose terms on each sub-processor no less protective than this DPA and remain responsible for them.

6. Data residency and transfers

Customer data is stored and processed in the region of the Active Joules entity that contracts with the customer, as described in data residency and transfers. Where personal data is transferred out of the EEA, the UK or Switzerland, the parties agree to the EU Standard Contractual Clauses (Module 2, controller to processor; Module 3 where the customer is a processor), the UK International Data Transfer Addendum and the Swiss amendments, incorporated by reference. Transfers of personal data of Indian data principals follow the DPDP Act and any restrictions notified by the Government of India.

7. California

Active Joules does not sell or share personal information; does not retain, use or disclose it for any purpose other than providing the service or outside the direct business relationship; and does not combine it with personal information from other sources except as the CCPA permits. We will notify the customer if we can no longer meet these obligations.

8. Technical and organisational measures

9. Contact us

Active Joules
39, Radhakrishan Road, Arumbakkam, Chennai 600103, India
connect@activejoules.com