Data processing agreement

01About this DPA and how it's accepted

This data processing agreement ("DPA") applies when Get Comma ("Comma", "we") processes personal data on behalf of a client ("you") while providing the services under our terms of service and a service agreement.

The DPA forms part of each service agreement. When you sign a service agreement, you accept this DPA as it stands on that date, and it stays in force for as long as we process personal data for you. If you need a countersigned copy for your records, write to privacy@getcomma.ai and we'll send one, together with the named list of our subprocessors and the completed transfer details in Annex 4.

02Definitions

• Data protection laws: all laws on personal data that apply to the processing, which can include India's Digital Personal Data Protection Act, 2023 and its Rules, the UK GDPR and Data Protection Act 2018, the EU GDPR, and US state privacy laws such as the California Consumer Privacy Act as amended.
• Client personal data: personal data we process on your behalf in providing the services, described in Annex 1.
• Controller, processor, data subject, personal data and processing: have the meanings given in the GDPR. Under Indian law, controller means data fiduciary, processor means data processor and data subject means data principal. Under US state laws, processor includes service provider.
• Personal data breach: a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, client personal data.
• Subprocessor: a third party we engage that processes client personal data.
• SCCs: the Standard Contractual Clauses approved by the European Commission in Decision 2021/914.
• UK Addendum: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner. IDTA means the UK International Data Transfer Agreement.

Other capitalised terms have the meaning given in the terms of service.

03Roles and scope

You're the controller of client personal data (or a processor acting for your own controller, in which case we're your subprocessor). We're your processor. Annex 1 describes the processing.

This DPA doesn't cover personal data we handle as an independent controller, such as account administration, billing and security records. Section 14 and our privacy policy cover that.

04Your instructions

We'll process client personal data only on your documented instructions. The agreement, your service agreements and your use and configuration of the workspace (for example, connecting a tool or approving a draft) are your instructions. You can give further reasonable instructions in writing, and if they add work, we'll agree any change in scope first.

We'll tell you if we believe an instruction breaks data protection laws, and we may pause the affected processing until it's resolved. If the law requires us to process client personal data in a way you haven't instructed, we'll tell you first unless the law forbids it.

You're responsible for having a lawful basis, and giving any notices or obtaining any consents needed, for the client personal data you give us or ask us to collect.

05Our obligations as processor

• We'll process client personal data only to provide the services and for no other purpose.
• We won't sell or share client personal data, use it for targeted advertising, or combine it with personal data from other sources except as the services require.
• We won't use client personal data to train AI models, and we'll only use AI providers whose terms prohibit them from training on it. Our AI terms describe how AI is used in the services.
• We'll keep client personal data accurate as far as the services allow, and correct, complete or update it when you ask.
• We'll keep records of our processing as data protection laws require.

06Confidentiality of personnel

We'll make sure everyone we authorise to process client personal data is bound by an appropriate duty of confidentiality and has access only as far as their work needs.

07Security

We'll keep in place the technical and organisational measures in Annex 2, which are designed to protect client personal data against a personal data breach, taking into account the nature of the data and the risks. We may update these measures over time, but we won't reduce the overall level of protection.

08Subprocessors

• Authorisation: you give us general authorisation to engage subprocessors. The categories are listed in Annex 3, and the named list is available on request and included with your copy of this DPA.
• Our duties: we'll vet each subprocessor, put a written contract in place with data protection terms at least as protective as this DPA, and stay responsible to you for their performance.
• Notice of changes: we'll tell you by email at least 15 days before we add or replace a subprocessor.
• Objection: you may object on reasonable data protection grounds within that notice period. We'll then discuss it in good faith and, where we can, offer an alternative. If we can't resolve it, you may end the affected part of the services and we'll refund any prepaid fees for it.
• Urgent changes: if we need to replace a subprocessor urgently, for example for security reasons, we'll tell you as soon as we can and the objection right still applies.

09Help with rights requests and assessments

• Rights requests: if a data subject contacts us directly about client personal data, we'll pass the request to you without undue delay and won't respond ourselves except to point them to you, unless you ask us to. Taking into account the nature of the processing, we'll help you respond, including through workspace features and exports.
• Assessments: we'll give you reasonable information and help for data protection impact assessments and any prior consultation with a regulator about the services.
• Grievances: if you receive a grievance under Indian law that relates to our processing, we'll help you respond within the time the law allows.

10Personal data breaches

If we become aware of a personal data breach affecting client personal data, we'll:

• tell you without undue delay and in any case within 72 hours of confirming it;
• give you the information we have, including what happened, the categories and approximate number of people and records affected, the likely consequences, and what we're doing about it, and send more as we learn it;
• take reasonable steps to contain the breach and reduce its effects; and
• help you meet your own obligations to notify regulators, such as the Data Protection Board of India, the UK Information Commissioner or an EU authority, and affected people.

We'll also meet our own reporting duties, including reporting cyber incidents to CERT-In within six hours of noticing them where its directions apply. Telling you about a breach isn't an admission of fault.

11International transfers

We're based in India and our main hosting is in the United States. You authorise us and our subprocessors to transfer client personal data to those countries and others where subprocessors operate, subject to this section.

• From the EU: where the transfer is to a country without an adequacy decision, the SCCs apply and are incorporated into this DPA. Module 2 (controller to processor) applies where you're a controller, and Module 3 (processor to processor) where you're a processor. Clause 7 (docking) applies. In Clause 9, option 2 (general authorisation) applies with the notice period in section 08. In Clause 11, the optional language doesn't apply. In Clauses 17 and 18, the SCCs are governed by the law of, and disputes go to the courts of, Ireland. Annexes I to III are completed by Annexes 1 to 4 of this DPA.
• From the UK: the UK Addendum applies to the SCCs as completed above. Table 1 is completed with the parties' details, Tables 2 and 3 with the information in this DPA, and in Table 4 either party may end the Addendum as allowed by its Section 19. Where the UK Addendum can't be relied on, the parties will sign the IDTA.
• From Switzerland: the SCCs apply with the changes needed for the Swiss Federal Act on Data Protection, with the Swiss Federal Data Protection and Information Commissioner as the competent authority.
• From India: we'll transfer client personal data outside India only to countries the Government of India hasn't restricted.
• Onward transfers: we'll put equivalent safeguards in place with subprocessors that receive client personal data outside the UK and EU.
• Government requests: if an authority asks us for client personal data, we'll tell you (unless the law forbids it), push back on requests that aren't lawful, and disclose only the minimum required.

If a transfer mechanism is invalidated or replaced, we'll work with you to put a valid alternative in place.

12Audits and information

We'll make available the information reasonably needed to show we comply with this DPA. We'll first do this by answering your security and privacy questionnaires, providing documentation, and meeting with your team. As our compliance programme grows, we'll share independent reports when we have them.

If that isn't enough to show compliance, or a regulator requires it, you may carry out an audit, at most once a year, with at least 30 days' notice, during business hours, at your cost, and through an auditor bound by confidentiality who isn't our competitor. Audits must not disrupt our services or give access to other clients' data. Any audit following a personal data breach doesn't count toward the yearly limit.

13Return and deletion

When the services end, you can ask for an export of your workspace data within 30 days. After that period, or sooner if you ask, we'll delete client personal data, including from the workspace database. Any backup copies are deleted within a further 30 days. We may keep data where the law requires, in which case we'll keep protecting it under this DPA and process it only for that purpose. We'll confirm deletion in writing if you ask.

During the services, some data is deleted automatically under our retention schedule, such as monitoring data after 180 days and Search Console data after 365 days. Our privacy policy lists these periods.

14Comma as an independent controller

We process some personal data for our own purposes as a controller: account and contact details for managing the relationship, billing records, sign-in and security records, and usage data to run, secure and improve the services. We handle that data under our privacy policy and data protection laws, not this DPA. We use usage data only in aggregated or de-identified form when improving the services.

15US state privacy laws

Where US state privacy laws apply, we act as your service provider or processor. We won't sell or share client personal data, keep, use or disclose it outside our direct business relationship with you or for any purpose other than the services, or combine it with other personal data except as those laws allow. We'll comply with those laws, give the same level of protection they require, and tell you if we can no longer meet our obligations. You may take reasonable steps to stop unauthorised use.

16Liability

Each side's liability under this DPA, including under the SCCs and UK Addendum to the extent the law allows, is subject to the limits and exclusions in the terms of service. Nothing in this DPA limits a data subject's rights under the SCCs.

17Order of precedence and term

If this DPA conflicts with the terms of service or a service agreement on the processing of personal data, this DPA wins. If it conflicts with the SCCs or UK Addendum, those win. This DPA lasts as long as we process client personal data for you, and its obligations continue until all of it is deleted or returned. We may update this DPA to reflect changes in law or our services, with at least 30 days' notice for material changes, but no update will reduce the protection of client personal data during a current service agreement without your agreement.

A1Annex 1: Details of processing

A2Annex 2: Security measures

Our security page describes these measures in full. They include:

• a separate database for each client workspace;
• HTTPS for all traffic, with HTTP Strict Transport Security;
• AES-256-GCM encryption of stored integration keys, tokens and two-factor secrets, and salted scrypt hashing of passwords, and hashing of backup codes and MCP tokens;
• password sign-in with two-factor authentication by authenticator app or email code, throttling of failed attempts, and session revocation;
• roles (Owner, Editor, Reviewer and Viewer) and per-person permissions, enforced on the server;
• same-origin checks against cross-site request forgery, security headers, rate limits and protection against server-side request forgery;
• sign-in records and application logs, and error monitoring configured not to collect user details or request bodies;
• automatic deletion under our retention schedule, and the ability to back up and restore each workspace database;
• confidentiality duties for our team, and vetting of and contracts with subprocessors;
• an incident response process, including reporting to CERT-In within six hours where required.

A3Annex 3: Subprocessors

The categories of subprocessors we use are below. The named list, with each provider's entity and location, is available on request at privacy@getcomma.ai and included in your copy of this DPA.

Tools you connect yourself, such as Google Search Console, your SEO tool, CMS, Notion or Slack, are your own providers, not our subprocessors.

A4Annex 4: Transfer details

• Data exporter: the client named in the service agreement, as controller or processor. Contact details as in the service agreement.
• Data importer: Get Comma, Uttar Pradesh, India, as processor. Contact: privacy@getcomma.ai.
• Signature and date: the signature on the service agreement.
• Description of transfer: as in Annex 1.
• Competent supervisory authority: the authority of the EU member state where the exporter is established or, if none, where its EU representative is established. For UK transfers, the Information Commissioner.
• Technical and organisational measures: as in Annex 2.
• Subprocessors: as in Annex 3.