Data Processing Agreement (DPA)

The purpose of this DPA is to establish the responsibilities of the parties regarding personal data processed through the Service. The parties acknowledge that:

• The Customer determines the purposes for which Customer Data is processed;

• Clock Softwares processes such data to provide the contracted Service;

• The parties will comply with applicable data protection laws.

Personal Data means information relating to an identifiable individual as defined by applicable law. Processing includes collecting, recording, storing, organizing, retrieving, using, transmitting, deleting or otherwise handling Personal Data. Customer Data means data submitted, uploaded or generated by the Customer through the Service. Data Subject means an identifiable individual to whom Personal Data relates.

To the extent applicable:

Customer acts as the data fiduciary/controller or equivalent responsible entity for Personal Data submitted to the Service.

Clock Softwares acts as the data processor/service provider processing such information on the Customer’s behalf. The precise legal classification may depend upon the applicable law and processing activity.

Clock Softwares shall process Customer Personal Data only as reasonably necessary to:

• Provide the SaaS Service;

• Store Customer Data;

• Process transactions initiated through the Service;

• Maintain application functionality;

• Provide support;

• Maintain security;

• Perform backups;

• Diagnose technical problems;

• Prevent fraud and abuse;

• Comply with legal obligations.

Clock Softwares shall not intentionally use Customer Personal Data for unrelated commercial purposes.

The Customer is responsible for:

• Determining the lawful purpose of processing;

• Providing appropriate notices to individuals;

• Obtaining required consent where necessary;

• Ensuring data accuracy;

• Ensuring lawful collection;

• Configuring user permissions;

• Managing authorized users;

• Responding to Data Subject requests where applicable.

The Customer represents that its instructions concerning Personal Data are lawful. The Customer shall not instruct Clock Softwares to process Personal Data in a manner that violates applicable law. If Clock Softwares reasonably believes an instruction violates applicable law, it may notify the Customer and take appropriate measures.

Clock Softwares shall take reasonable steps to ensure that persons authorized to process Customer Personal Data are subject to appropriate confidentiality obligations.

Clock Softwares shall maintain reasonable technical and organizational measures appropriate to the Service. Such measures may include:

• Authentication;

• Access controls;

• Encryption in transit where applicable;

• Security monitoring;

• Logging;

• Backup controls;

• Infrastructure security;

• Vulnerability management;

• Employee access controls.

Security measures may evolve as technology and threats change.

Clock Softwares may engage third-party service providers necessary to operate the Service, including providers for:

• Cloud infrastructure;

• Hosting;

• Databases;

• Email;

• SMS;

• Payment processing;

• Monitoring;

• Security;

• Authentication;

• Support.

Where required by applicable law, Clock Softwares will maintain appropriate contractual controls over such providers.

Clock Softwares shall not intentionally sell Customer Personal Data. Customer Data shall not be commercially resold as a data product. Access shall be limited to persons and service providers requiring access for legitimate Service-related purposes, subject to appropriate controls.

Where a Customer receives a request from an individual concerning Personal Data processed through the Service, the Customer remains primarily responsible for responding. Where technically and legally appropriate, Clock Softwares may provide reasonable assistance using functionality available within the Service.

Clock Softwares shall maintain procedures intended to identify and respond to security incidents. Where Clock Softwares becomes aware of a security incident materially affecting Customer Personal Data, it may notify the Customer as required by applicable law and the circumstances of the incident. Notifications may include available information concerning:

• Nature of incident;

• Affected systems;

• General categories of data;

• Remedial measures.

Customer Personal Data will generally be retained according to:

• The Customer’s active subscription;

• The Terms & Conditions;

• The Account Deletion & Data Retention Policy;

• Applicable legal requirements.

After subscription expiry, read-only access may be available for up to 30 days where supported. Following the applicable retention period, Customer Data may be deleted or anonymized.

Customer Personal Data may remain temporarily in backup systems following deletion. Backup copies will be subject to applicable backup-retention processes and are not normally accessible through the Customer’s account.

Clock Softwares may use infrastructure located in India or other jurisdictions depending upon the applicable technical architecture and service providers. Clock Softwares does not guarantee that all processing will occur exclusively in one geographic location unless expressly agreed in writing.

Where Personal Data is processed outside India, Clock Softwares and/or its service providers will follow applicable legal requirements relating to such processing.

Clock Softwares may disclose information where legally required by:

• Court order;

• Government authority;

• Law enforcement request;

• Applicable legislation;

• Other legally valid process.

Where legally permitted, reasonable notice may be provided.

Customers may request reasonable information concerning Clock Softwares’ security practices where appropriate. For security reasons, Clock Softwares is not required to disclose:

• Passwords;

• Credentials;

• Server access;

• Internal IP addresses;

• Security keys;

• Sensitive architecture;

• Vulnerability details;

• Internal security configurations.

This DPA does not transfer ownership of:

• Source code;

• Software architecture;

• Database architecture;

• Deployment scripts;

• Hosting accounts;

• Infrastructure credentials;

• Proprietary technology.

To the extent permitted by law and the governing agreement, the Customer shall remain responsible for claims arising from:

• Unlawful collection of Personal Data;

• Lack of required permissions;

• Unlawful processing instructions;

• Customer misuse of the Service;

• Customer’s breach of applicable data protection requirements.

Liability relating to this DPA shall be subject to the liability limitations contained in the applicable Terms & Conditions or master agreement, except to the extent such limitation is prohibited by applicable law.

Upon termination of the applicable Service agreement, processing of Customer Personal Data shall cease except where retention is:

• Required by law;

• Required for legitimate security purposes;

• Necessary for dispute resolution;

• Required under the Company’s documented retention processes.

Where technically supported, Customer Data may be exported using available product functionality. Following the applicable retention period, Clock Softwares may delete or anonymize Customer Data. Unless expressly agreed in a separate written agreement, Clock Softwares is not required to provide physical infrastructure, databases, source code or server access to the Customer.

Clock Softwares may update this DPA to reflect:

• Changes in law;

• Changes in infrastructure;

• Changes in processing;

• Changes in security practices.

Material changes may be communicated through reasonable means.

This DPA shall be governed by the laws of India. Subject to applicable law, courts having jurisdiction in Mumbai, Maharashtra, India shall have exclusive jurisdiction.

Clock Softwares Mumbai, Maharashtra, India

Email: info@clocksoftwares.com

Website: www.clocksoftwares.com

Phone: +91 7021356144

“Clock it. Grow it.”