Data Processing Addendum

This Data Processing Addendum (the “DPA”) is part of the agreement between Thinkbix Technologies Private Limited (“MotherBot”, “we”) and the business that uses MotherBot (“you”) under our Terms of Service. You accept it when you accept the Terms. It is the contract required by section 8(2) of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) between a Data Fiduciary and its Data Processor. If you are subject to the EU or UK GDPR, our GDPR page describes the additional terms that apply.

1. Words used here

• “Customer Personal Data” means personal data of your customers, leads, contacts and other people that you, your team or your connected services put into MotherBot, or that MotherBot receives for you (for example, messages your customers send to your WhatsApp number).
• “Data Principal”, “Data Fiduciary”, “Data Processor”, “personal data breach” and “processing” have the meanings given in the DPDP Act.
• “Sub-processor” means a company we engage that processes Customer Personal Data for us.

2. What we process

3. Your instructions

We process Customer Personal Data only on your documented instructions. Your instructions are these Terms and this DPA, and what you set up and do in MotherBot: the contacts you add, the messages, broadcasts, chatbots and workflows you create, the integrations you connect, and the settings you choose. We will tell you if we believe an instruction breaks the law, and we may refuse to carry it out.

We may also process Customer Personal Data where Indian law requires it, for example to answer a lawful order of a court or government agency. Where the law allows, we will tell you first.

4. Your responsibilities as Data Fiduciary

You confirm and agree that you:

• give each Data Principal a notice that meets section 5 of the DPDP Act, and have their consent, or another lawful ground under section 7, for everything you ask us to do with their data;
• collect WhatsApp opt-ins as Meta requires, and honour opt-outs and withdrawals of consent promptly (STOP and START handling in MotherBot helps, but you are responsible for it);
• keep Customer Personal Data accurate and complete where you use it to make decisions about people;
• do not process children’s personal data without verifiable consent from a parent or guardian, and do not track, monitor or target advertising at children;
• answer Data Principals’ requests to access, correct or erase their data, and their grievances, within the time the DPDP Act sets;
• publish the contact details of the person who can answer your customers’ questions about their data, as section 8(9) of the DPDP Act requires;
• delete Customer Personal Data in MotherBot when your purpose for it is over and no law requires you to keep it;
• notify the Data Protection Board of India and affected Data Principals of a personal data breach as the DPDP Act requires (we will help as section 7 below describes); and
• are responsible for the services you connect to MotherBot (such as AI providers, CRMs and payment gateways) and for having a lawful basis to send them data. Those services are not our Sub-processors.

You will compensate us for any claim, penalty or loss that arises because you broke this section, as section 19 of the Terms provides.

5. Confidentiality

Everyone at MotherBot who can access Customer Personal Data is bound to keep it confidential and may access it only when needed: to provide the Services, to support you when you ask, to keep the Services secure, or to comply with the law.

6. Security

We take reasonable security safeguards to prevent personal data breaches, as section 8(5) of the DPDP Act requires, including:

• encryption of all connections (HTTPS/TLS) and encryption of the database and file storage at rest;
• one-way hashing of passwords and of extension and plugin access tokens;
• separation of each customer’s data, and role-based access for team members with optional two-step verification;
• limited, recorded access to production systems for our staff;
• activity records and logs, kept to detect and investigate unauthorised access; and
• regular review of these measures as risks and technology change.

7. Personal data breaches

• If we become aware of a personal data breach affecting your Customer Personal Data, we will tell you without undue delay, and where possible within 48 hours, at the email address on your account.
• We will tell you what we know: what happened, when, what data and roughly how many people are affected, the likely consequences, and what we have done and will do. We will send more details as we learn them.
• We will help you meet your own duty to inform the Data Protection Board of India and the affected Data Principals, and we will report the incident to CERT-In where the law requires us to.
• Telling you about a breach is not an admission of fault or liability.

8. Sub-processors

You agree that we may use the following Sub-processors. Each is bound by a written contract to protect Customer Personal Data with safeguards at least as strong as ours, and we remain responsible to you for their work:

We will update this list, and tell you by email or in the app, at least 14 days before a new Sub-processor starts processing Customer Personal Data. If you have a reasonable objection on data protection grounds, tell us within those 14 days. We will try to address it. If we can’t, you may cancel the affected Services and we will refund fees paid in advance for the unused period.

Meta (for WhatsApp, Instagram and Messenger) is listed because messages pass through it, but Meta also acts under its own terms with you as a WhatsApp Business customer.

9. Deletion and return of data

• You can delete contacts, conversations and other data in MotherBot at any time, and export them first.
• When you delete your account, we erase Customer Personal Data from our live systems straight away, and from backups when those backups expire in their normal cycle.
• Some records are deleted automatically sooner, as listed in our Privacy Policy, for example call details after 14 days.
• We keep data longer only where Indian law requires it, and then only for that purpose.

10. Helping you with Data Principals’ rights

MotherBot lets you find, correct, export and delete a contact’s data, and record their opt-out, yourself. If a Data Principal contacts us about data you control, we will pass the request to you without undue delay and won’t answer it ourselves unless the law requires us to. We will give you reasonable help where you can’t act on a request yourself.

11. Where data is processed

Customer Personal Data is stored in our database in India (Mumbai) and processed by our application servers in Singapore and by the Sub-processors listed above, in the locations shown. The DPDP Act allows this. We won’t transfer Customer Personal Data to any country the Central Government restricts under section 16 of the DPDP Act.

12. Information and audits

On written request, no more than once a year (or after a personal data breach, or when a regulator requires it), we will give you the information reasonably needed to show that we comply with this DPA, such as answers to a security questionnaire and a description of our safeguards. Any further audit must be agreed in advance, at your cost, during business hours, without access to other customers’ data, and under confidentiality.

13. Liability and order of documents

The limits on liability in the Terms apply to this DPA. If this DPA conflicts with the Terms about personal data, this DPA wins.

14. Contact

• Grievance Officer, Thinkbix Technologies Private Limited
• Email: hello@motherbot.io
• Address: Baner Business Bay, Baner, Pune, Maharashtra 411045, India