Data Processing Addendum

1. Scope and roles

This Data Processing Addendum ("DPA") forms part of the Agreement between GAZI WELLNESS PRIVATE LIMITED ("Gazi Wellness") and the Customer. It applies where Gazi Wellness processes personal data contained in Customer Data on the Customer's behalf.

The Customer is the controller (or business, or data fiduciary) and Gazi Wellness is the processor (or service provider, or data processor). Where the Customer is itself a processor for another controller, such as a franchisee acting under a franchisor's program, Gazi Wellness acts as a subprocessor and the Customer is responsible for passing on relevant instructions.

This DPA is designed to meet the requirements of the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the CPRA, and India's Digital Personal Data Protection Act, 2023 (together, "Data Protection Laws").

2. Processing details

3. Gazi Wellness's obligations

• Process personal data only on the Customer's documented instructions, which are set out in the Agreement and in the Customer's configuration of the Service, and inform the Customer if an instruction appears to infringe Data Protection Laws.
• Not sell or share personal data, retain, use or disclose it outside the direct business relationship with the Customer, or combine it with data from other sources except as permitted for a service provider under the CCPA.
• Ensure that personnel with access are bound by confidentiality obligations and receive security and privacy training.
• Assist the Customer, taking into account the nature of processing, with data subject requests, data protection impact assessments and consultations with supervisory authorities.
• Delete or return personal data at the end of the Agreement as described in the Terms of Service, unless retention is required by law.

4. Security measures

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256) with keys managed in AWS Key Management Service.
• Logical tenant isolation, enforced in the application and database layers and tested in each release.
• Role-based access control, single sign-on (SAML 2.0) and SCIM provisioning for Enterprise plans, and multi-factor authentication for Gazi Wellness staff with production access.
• SHA-256 hashing of photo evidence at upload and an append-only audit log of changes to audit records.
• Daily encrypted backups retained for 35 days, with restoration tested quarterly.
• Vulnerability scanning, annual third-party penetration tests and an annual SOC 2 Type II examination.
• Documented incident response plan, tested at least annually.

5. Subprocessors

The Customer authorizes Gazi Wellness to engage the subprocessors listed on our Subprocessors page. Gazi Wellness will bind each subprocessor to data protection terms at least as protective as this DPA and remains responsible for their performance.

We will give at least 30 days' notice of a new subprocessor by updating the Subprocessors page and emailing subscribers to change notices. The Customer may object on reasonable data protection grounds within that period. If we cannot resolve the objection, the Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the remaining term.

6. Personal data breaches

Gazi Wellness will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will describe the nature of the breach, the categories and approximate number of records affected, likely consequences and the measures taken or proposed. We will provide updates as more information becomes available and cooperate with the Customer's notification obligations to regulators and individuals.

7. International transfers

Customer Data is hosted in the AWS region the Customer selects: us-east-1 (Northern Virginia, United States) or ap-south-1 (Mumbai, India). Personnel in India and the United States may access it to provide support and operate the Service.

For transfers of personal data from the EEA to a country without an adequacy decision, the parties incorporate the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914: Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where the Customer is a processor. Clause 7 (docking) applies; the optional wording in Clause 11 does not; Clause 17 is governed by the law of Ireland and Clause 18 disputes are heard by the courts of Ireland. Annex I is completed by Section 2 of this DPA and Annex II by Section 4.

For transfers from the United Kingdom, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses applies. For transfers from Switzerland, the Standard Contractual Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority.

8. Audits

Gazi Wellness will make its most recent SOC 2 Type II report and penetration test summary available to the Customer under confidentiality obligations. If these do not reasonably answer the Customer's questions, or a supervisory authority requires it, the Customer may conduct an audit once per year with at least 30 days' notice, during business hours, at its own cost and subject to reasonable confidentiality and security conditions.

9. Contact

Questions about this DPA: privacy@gaziwellness.si. Security matters: security@gaziwellness.si. Customers that need a countersigned copy of this DPA can request one from their account manager or at privacy@gaziwellness.si.