Our standing Data Processing Addendum.

For the purposes of applicable data-protection law, the client is the data controller and Paiteq Private Limited is the data processor. Paiteq processes personal data only on the documented instructions of the controller.

The nature and purpose of the processing is the delivery of the AI engineering services engaged, scoping, building, evaluating, deploying, and operating the systems described in the applicable statement of work (SOW). The duration of processing matches the engagement term.

The categories of personal data and categories of data subjects depend on the engagement and are defined per SOW, for example end-user records, support transcripts, or documents within scope of the workload.

No special-category data (health, biometric, financial, or other sensitive data under GDPR Art. 9) is processed without explicit written agreement defining the additional safeguards.

Paiteq engages sub-processors to deliver the services, including Sanity (CMS), cloud hosting / CDN providers, email and CRM tooling, and model / LLM providers (Anthropic, OpenAI, and others). We maintain a current list of sub-processors and notify the controller of additions or changes with reasonable notice so objections can be raised.

Flow-down obligations apply: each sub-processor is bound by data-protection terms no less protective than those in this addendum, and Paiteq remains responsible for their performance.

Processing may take place in India, the United States, and the EU. Where personal data subject to EU or UK GDPR is transferred outside the EEA / UK, the transfer is governed by the appropriate safeguards, the Standard Contractual Clauses (SCCs) and, where required, the UK International Data Transfer Addendum, together with any supplementary measures the transfer assessment requires.

Paiteq applies the security posture described on the security page: SOC-2-ready practices, audit logs, least-privilege IAM, key rotation, and encryption in transit and at rest, alongside HIPAA-ready and GDPR-ready engagement patterns.

To be explicit: these are practices, not certifications. Paiteq is not itself SOC 2 Type II or ISO 27001 certified as a vendor. If your procurement requires a vendor SOC 2 report, flag it early and we'll route accordingly.

On becoming aware of a personal-data breach affecting controller data, Paiteq notifies the controller without undue delay and provides the information the controller reasonably needs to meet its own notification obligations to authorities and data subjects. We assist the controller in investigating, mitigating, and remediating the breach.

Taking the nature of the processing into account, Paiteq assists the controller by appropriate technical and organisational measures, insofar as possible, in responding to requests from data subjects to exercise their rights, access, rectification, erasure, portability, restriction, and objection. Requests received directly by Paiteq are routed to the controller rather than actioned independently.

On termination or expiry of the engagement, Paiteq, at the controller's choice, deletes or returns the personal data it processes on the controller's behalf and deletes existing copies, subject to any legal-retention obligation that requires storage for a defined period. Backup copies are purged on their normal rotation cycle.

Paiteq makes available to the controller the information reasonably necessary to demonstrate compliance with this addendum, and allows for and contributes to audits, including inspections, conducted by the controller or an auditor it mandates, on reasonable prior notice and during business hours, subject to confidentiality and not unreasonably disrupting operations.