This DPA forms part of the agreement between Renz Innovations Private Limited (“atEaseAI,” “Processor”) and the customer identified in the applicable order form or subscription agreement (“Customer,” “Controller”) where atEaseAI processes Personal Data on Customer's behalf.
1. Definitions
Personal Data: information relating to an identified or identifiable individual, or equivalent term under applicable law.
Processing: any operation performed on Personal Data.
Controller: the party determining the purposes and means of processing, or equivalent role.
Processor: the party processing Personal Data on behalf of the Controller, or equivalent role.
Subprocessor: a third party engaged by atEaseAI to process Personal Data on the Customer's behalf.
2. Scope and Instructions
atEaseAI will process Personal Data only to provide the Services, comply with the Customer's documented instructions, maintain security, prevent abuse, and comply with applicable law. The subject matter, duration, nature, purpose, data categories, and Data Subjects are described in Schedule 1.
3. Customer Responsibilities
Establish the lawful basis for processing and provide required notices.
Ensure instructions to atEaseAI comply with applicable law.
Maintain permissions and authorizations required for connected systems.
Do not instruct processing in a manner that violates applicable law.
4. Confidentiality
Authorized personnel will be subject to confidentiality obligations or an appropriate legal duty of confidentiality.
5. Security Measures
atEaseAI will implement appropriate technical and organizational measures designed to protect Personal Data, taking account of the nature and risks of processing. The measures include:
Logical tenant isolation and organization-level data access.
Role-based access and authentication controls.
TLS for data in transit and protection of sensitive credentials.
Secure OAuth/API authorization mechanisms.
Rate limiting and account-security controls.
Security monitoring and operational controls appropriate to the Services.
Incident response and vulnerability reporting processes.
6. Subprocessors
Customer authorizes atEaseAI to engage subprocessors reasonably necessary to provide the Services, including cloud infrastructure, AI processing, communications, analytics, security, and payment-related providers.
atEaseAI will impose appropriate data-protection obligations on subprocessors and remains responsible for their processing to the extent required by applicable law. A current subprocessor list may be available through the application or on reasonable request.
7. International Transfers
Where Personal Data is transferred outside the jurisdiction in which it was collected, atEaseAI will use a legally recognized transfer mechanism where required by applicable law. For GDPR transfers requiring Standard Contractual Clauses, the parties may incorporate the applicable European Commission clauses by reference or execute them separately with the relevant annexes completed.
8. Data Subject Rights
Taking into account the nature of processing, atEaseAI will provide reasonable assistance to Customer in responding to applicable Data Subject requests. If a Data Subject contacts atEaseAI directly regarding data processed on Customer's behalf, atEaseAI may direct the request to Customer unless law requires otherwise.
9. Security Incidents
atEaseAI will notify Customer without undue delay after becoming aware of a confirmed Personal Data breach affecting Customer Personal Data, where notification is required by applicable law. Where reasonably available, the notice will describe the incident, affected information, likely consequences, and remediation measures.
10. Government Requests
Where legally permitted, atEaseAI will notify Customer before disclosing Customer Personal Data in response to a government request and provide reasonable assistance to challenge or limit the request.
11. Deletion and Return
At the end of the Services, atEaseAI will delete or return Customer Personal Data in accordance with the main agreement and Customer's instructions, unless retention is required by law. Unless otherwise agreed, the current operational baseline for synchronized integration data is up to 30 days after integration disconnection or account closure. Backup copies may persist for a limited period until overwritten.
12. Audit and Compliance Information
Upon reasonable request and subject to confidentiality, security, and protection of other customers, atEaseAI will provide information reasonably necessary to demonstrate compliance with this DPA. This may include security documentation, technical and organizational measures, and reasonable security-questionnaire responses. Audits must be conducted during normal business hours and without unreasonable disruption.
13. Term and Precedence
This DPA remains effective while atEaseAI processes Customer Personal Data on Customer's behalf. If this DPA conflicts with the main agreement regarding data-protection obligations, this DPA controls to the extent of the conflict unless expressly agreed otherwise.
14. Governing Law
This DPA follows the governing-law and dispute-resolution provisions of the main agreement unless applicable data-protection law requires otherwise.
Schedule 1: Description of Processing
A. Subject Matter
Processing Personal Data to provide atEaseAI's post-sales platform, including customer intelligence, account management, onboarding, surveys, recommendations, workflows, renewals/expansion, analytics, communication assistance, and support.
B. Duration
For the term of the applicable service agreement, plus the applicable deletion/retention period.
C. Nature of Processing
Collection through authorized integrations/APIs; synchronization; storage; organization; retrieval; analysis; AI-assisted processing; generation of insights/recommendations; workflow execution; support; security; and deletion.
D. Categories of Personal Data
Names and professional contact details.
Job titles, roles, account ownership, and professional relationship information.
Email metadata and, where authorized, email content.
CRM account, contact, opportunity, activity, and financial information.
Helpdesk ticket and support information.
Product usage and engagement information.
Customer-provided notes, survey responses, files, and other supported content.
Authentication, audit, and technical metadata.
E. Categories of Data Subjects
Customer employees, contractors, and authorized users.
Customer prospects, customers, contacts, and stakeholders.
Individuals whose information appears in Customer Data or connected communications.
F. Sensitive Data
Unless expressly agreed in writing and supported by the Services, Customer should not use atEaseAI to process special categories of personal data, highly sensitive personal information, or regulated data requiring specialized controls.
Schedule 2: Technical and Organizational Measures
Logical tenant isolation and organization-scoped data access.
Role-based access controls.
Authentication and session security controls.
TLS for data in transit.
Encryption/protection of sensitive credentials.
Rate limiting and account-security controls.
Controlled production access.
Incident response and vulnerability reporting processes.
Secure deletion practices consistent with retention terms.
Schedule 3: Subprocessor Information
This schedule describes configured infrastructure and feature-dependent services. The providers receiving Personal Data depend on the services enabled and the information supplied by Customer.
Microsoft Azure
Purpose: Application/API hosting, databases, document storage, knowledge search, frontend delivery, platform email, and enabled AI services.
Personal Data: User and customer/contact identifiers, records and documents stored or supplied to enabled features, transactional email recipients/content, and service request metadata.
Locations: The deployment configuration specifies Central India for core services, East Asia for frontend resources, and United States for platform email. AI and other service-specific processing locations depend on the enabled deployment and applicable Microsoft service terms. Resource locations are not an exclusive data-residency guarantee.
Feature-dependent providers
OpenAI direct API: AI prompt/context processing and generated outputs, only where the direct API is enabled. Models accessed through Azure do not by themselves establish direct OpenAI API use.
PostHog: Product analytics involving user/organization identifiers, email, and enabled usage-event data, where configured and analytics consent is given.
Tavily: Company-name research queries, optional website hints, and search results, where the research service is enabled. Personal Data depends on the supplied queries and returned content.
Firecrawl: Submitted public website URLs and rendered content, potentially including Personal Data on those pages, where the rendering service is enabled.
Processing locations for feature-dependent providers follow the applicable provider account, service configuration, and contractual terms; no India-only or other country-exclusive processing commitment is made by this schedule.
Billing and customer-selected integrations
Dodo Payments may receive billing names/email addresses, organization/user identifiers, and payment/subscription metadata when paid billing is used. Its contractual role is determined by the applicable billing agreement and is not automatically the same as a Customer Data subprocessor.
Customer-selected email, CRM, support, and other integrations exchange data as authorized for those integrations. Their contractual roles depend on the applicable arrangements.
For information about the providers and processing locations applicable to enabled services, contact hello@ateaseai.com.
Contact
Renz Innovations Private Limited (atEaseAI)
Dimapur, Nagaland, India
hello@ateaseai.com
atEaseAI | Public Legal Documentation | Version 1.0