Data Processing Addendum

1. Parties & Scope

This Data Processing Addendum ("DPA") forms part of the Master Services Agreement between Pinbar AI ("Processor") and the Enterprise customer ("Controller"). It applies whenever Pinbar AI processes Personal Data on behalf of the Controller and is governed by the Digital Personal Data Protection Act 2023 ("DPDP") and, where applicable, the EU General Data Protection Regulation ("GDPR").

2. Processing Details

• Subject matter: trade-journaling, analytics, AI insights, billing
• Duration: term of the Master Services Agreement plus 7 years for billing records
• Categories of data: identifiers, contact data, trading activity, device/log data
• Categories of data subjects: Controller's traders, employees, contractors
• Purpose: deliver the contracted services

3. Sub-Processors

Pinbar AI maintains a current list of sub-processors at/sub-processors. Controller authorises the use of these sub-processors. Pinbar AI will notify Controller at least 30 days before adding a new sub-processor; Controller may object on reasonable data-protection grounds.

4. Security Measures

• AES-256-GCM encryption at rest for broker / exchange credentials
• TLS 1.2+ in transit; HSTS enforced; no cleartext traffic on mobile
• Row-Level Security on every public table; least-privilege RBAC for Enterprise
• SHA-256-hashed API keys; JWT validation on every edge function
• Append-only audit logs; 365-day admin retention; 7-year billing retention
• HMAC-signed webhooks with 5-minute replay protection
• Quarterly security scans, dependency audits, and access reviews

5. Data Subject Rights

Pinbar AI provides self-service tools and APIs for access, rectification, deletion, and portability. Controller remains responsible for responding to data-subject requests. Pinbar AI will assist within reasonable timelines at no additional cost for standard requests.

6. International Transfers

Primary data residency is Mumbai (ap-south-1). Limited transfers may occur for global services (Google, Cloudflare, app stores). Such transfers rely on Standard Contractual Clauses or equivalent approved mechanisms.

7. Breach Notification

Pinbar AI will notify the Controller without undue delay, and in any event within 72 hours, of becoming aware of a Personal Data Breach affecting the Controller's data, providing all information reasonably required for the Controller's regulatory notifications.

8. Return & Deletion

On termination, Personal Data is deleted within 30 days, subject to legal retention requirements (notably the 7-year Indian tax / accounting hold on billing records). Certified export available on request.

9. Signing

Enterprise customers who require a counter-signed DPA should emailprivacy@pinbar.ai with their legal entity name and the relevant Order Form reference.