Data Processing Addendum

This Data Processing Addendum (the "Addendum") forms part of the Terms of Service (the "Terms") between you, the Customer, and Whizzy Geeks Internet Services Private Limited ("WhizzyGeeks", "we", "us", "our"), and is incorporated by clause 25 of the Terms. Words defined in the Terms have the same meaning here.

It applies whenever we process Customer Personal Data: personal data contained in the Customer Data that the service reads from the AWS accounts you connect, as Annex 1 describes. It does not apply to the account, contact, billing and security data of your personnel or to the data of visitors to our website, which we process as controller under our Privacy Policy at https://www.kostrix.com/privacy.

It applies for as long as we process Customer Personal Data, and survives the end of the Terms until that data has been deleted under clause 11.

In this Addendum:

• "Data Protection Law" means every law on the protection of personal data that applies to the processing, including the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the United Kingdom GDPR and Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection of 25 September 2020 ("FADP"), the Digital Personal Data Protection Act, 2023 of India and the rules made under it ("DPDP Act"), and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA");
• "controller", "processor", "personal data", "processing", "data subject", "personal data breach" and "supervisory authority" have the meanings the GDPR gives them, and include the equivalent terms of other Data Protection Law, such as Data Fiduciary, Data Processor and Data Principal under the DPDP Act and business and service provider under the CCPA;
• "Sub-processor" means a processor we engage to process Customer Personal Data;
• "SCCs" means the standard contractual clauses for the transfer of personal data to third countries annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021;
• "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the United Kingdom Information Commissioner under section 119A of the Data Protection Act 2018;
• "Restricted Transfer" means a transfer of Customer Personal Data out of the European Economic Area, the United Kingdom or Switzerland to a country not recognised as giving adequate protection, where Data Protection Law requires a transfer mechanism for it.

You are the controller of Customer Personal Data, or, where you process it for your own customer, a processor acting for that controller. We are your processor (or sub-processor), your Data Processor under the DPDP Act, and your service provider under the CCPA.

You are responsible for the lawfulness of the processing you instruct, including any notice to or consent of data subjects that Data Protection Law requires before you connect an AWS account, and for not connecting special-category or other regulated personal data, as clause 25 of the Terms provides.

We process Customer Personal Data only on your documented instructions. The Terms, this Addendum and the way you configure and use the service - which AWS accounts and regions you connect, how often scans run, what you export and which users you add - are your complete instructions at the date you accept them. Further instructions must be given in writing and be consistent with the Terms.

We do not process Customer Personal Data for any other purpose. We do not sell or share it, use it to train any model, or combine it with personal data from other sources except as needed to provide the service to you.

If Data Protection Law requires us to process it otherwise, we will tell you before we do, unless that law forbids it on important grounds of public interest. If we believe an instruction infringes Data Protection Law, we will tell you at once and may suspend acting on it.

We give access to Customer Personal Data only to personnel who need it to provide, support or secure the service, who are bound by a duty of confidentiality, and who have been instructed on their obligations under this Addendum.

We implement and maintain the technical and organisational measures in Annex 2. They are designed to protect Customer Personal Data against a personal data breach and to ensure a level of security appropriate to the risk, as Article 32 of the GDPR and section 8(5) of the DPDP Act require. We may update them, but not so as to lower the overall level of protection.

You are responsible for the security of your AWS accounts and of the credentials you give us, for revoking the IAM role or access key when you stop using the service, and for the security of your users' sign-in credentials.

You give us general authorisation to engage Sub-processors. Those engaged at the date of this Addendum are listed in Annex 3.

We will tell you of any intended addition or replacement at least fifteen days before it takes effect, by updating Annex 3 and by e-mail to the administrators of your account. You may object on reasonable grounds relating to data protection within that period. If we cannot resolve the objection, you may terminate the affected part of the service before the change takes effect, and we will refund any fees you have paid for the period after termination.

We impose on each Sub-processor, by written contract, data-protection obligations at least as protective as those in this Addendum, and we remain liable to you for its performance of them.

Taking into account the nature of the processing, we will help you, by appropriate technical and organisational measures, to respond to requests from data subjects to exercise their rights under Data Protection Law. You can see, export (as CSV or PDF, or through the API) and delete most Customer Personal Data yourself: deleting it is done by removing an AWS account from the service or by closing your account.

If we receive a request about Customer Personal Data directly, we will not answer it ourselves, except to tell the person to contact you, and will pass it to you without undue delay.

We will notify you without undue delay, and in any event within forty-eight hours, after we become aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, its likely consequences, the measures we have taken or propose, and a contact for more information. We will add what we learn as we learn it.

We will take reasonable steps to contain and remedy the breach, and will help you meet your own obligations to notify supervisory authorities, the Data Protection Board of India and data subjects. A notice from us is not an admission of fault or liability.

We will give you reasonable help, with the information available to us, with any data protection impact assessment and any prior consultation with a supervisory authority that Data Protection Law requires you to carry out in relation to the service, and we will cooperate with a supervisory authority in the performance of its tasks.

While your account is open you can export findings and reports, and you can delete the data read from an AWS account by removing that account from the service, which deletes its findings, inventory and scan records.

When you close your account, or the Terms end, we delete Customer Personal Data as our Privacy Policy describes: our closure process deletes it fourteen days after you ask, and in any case it is deleted within ninety days. Copies in our database backups expire within thirty-five days after deletion and are not used in the meantime. We keep nothing longer unless law requires it, and then only for that purpose. On request we will confirm the deletion in writing.

This deletion is your instruction for the purposes of Clause 8.5 of the SCCs and section 8(7) of the DPDP Act.

We will make available to you the information necessary to demonstrate compliance with Article 28 of the GDPR and this Addendum, including written answers to a reasonable security questionnaire once in any twelve months. The independent audit reports of our hosting provider, Amazon Web Services, are available to you through AWS Artifact.

Where that information is not enough to demonstrate compliance, or a supervisory authority requires it, you may audit our processing of Customer Personal Data, yourself or through an independent auditor bound by confidentiality, once in any twelve months, on at least thirty days' written notice, during business hours in India, without access to other customers' data and at your own cost. These limits do not restrict an audit that the SCCs or a supervisory authority require.

We process Customer Personal Data in India and in the United States, as Annex 3 describes. Where a transfer of Customer Personal Data from you to us is a Restricted Transfer out of the European Economic Area, the SCCs are incorporated into this Addendum by reference and apply as follows:

• Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) where you are a processor;
• you are the data exporter and we are the data importer, and each party's acceptance of the Terms is its signature of the SCCs and their Annexes;
• the optional docking clause in Clause 7 applies;
• in Clause 9, Option 2 (general written authorisation) applies, with the notice period in clause 7 of this Addendum;
• the optional wording in Clause 11 does not apply;
• in Clause 13 and Annex I.C, the competent supervisory authority is the one determined under Clause 13(a);
• in Clause 17, Option 1 applies and the governing law is the law of Ireland; in Clause 18(b), the courts of Ireland have jurisdiction;
• Annex I.A and I.B are completed by Annex 1 of this Addendum, Annex II by Annex 2 and Annex III by Annex 3;
• audits under Clause 8.9 are carried out as clause 12 of this Addendum describes, and the certification of deletion under Clauses 8.5 and 16(d) is given on request.

If the SCCs conflict with this Addendum or the Terms, the SCCs prevail. If the SCCs cannot lawfully be used for a Restricted Transfer, the parties will cooperate in good faith to put in place another transfer mechanism that Data Protection Law recognises.

Where a transfer is a Restricted Transfer out of the United Kingdom, the UK Addendum is incorporated into this Addendum by reference and completed as follows: in Table 1, the parties' details are those in Annex 1; in Table 2, the Addendum EU SCCs are the SCCs as incorporated by clause 13, with the modules and options stated there; in Table 3, the Appendix Information is in Annexes 1 to 3; and in Table 4, neither party may end the UK Addendum under its Section 19. The Mandatory Clauses of the UK Addendum apply.

Where a transfer is a Restricted Transfer out of Switzerland, the SCCs apply as clause 13 describes, with these changes: the Federal Data Protection and Information Commissioner is the competent supervisory authority insofar as the FADP governs the transfer; references to the GDPR are to be read as references to the FADP insofar as it governs the transfer; and the term "Member State" in Clause 18(c) must not be interpreted so as to prevent data subjects in Switzerland from suing for their rights in their place of habitual residence.

Where the DPDP Act applies, you are the Data Fiduciary and we are a Data Processor engaged by you under a valid contract, as section 8(2) of that Act requires. We process Customer Personal Data only to provide the service; protect it with the reasonable security safeguards in Annex 2; tell you of a personal data breach as clause 9 provides, so that you can inform the Data Protection Board of India and the Data Principals concerned; help you respond to Data Principals; and erase it on your instruction or when the Terms end, as clause 11 provides.

We transfer Customer Personal Data outside India only to countries to which the Government of India has not restricted transfer under section 16 of that Act.

Where the CCPA applies, we are your service provider. We will not sell or share Customer Personal Data; retain, use or disclose it for any purpose other than the business purposes specified in the Terms, or outside the direct business relationship between us; or combine it with personal information we receive from others, except as the CCPA permits. We will comply with the CCPA, give Customer Personal Data the level of privacy protection it requires, and tell you if we can no longer meet our obligations under it, in which case you may take reasonable steps to stop and remediate unauthorised use.

Each party's liability arising out of or in connection with this Addendum is subject to the exclusions and limitations of liability in the Terms, except that nothing in the Terms limits either party's liability to data subjects under the SCCs, or any liability that Data Protection Law does not allow to be limited.

If this Addendum conflicts with the rest of the Terms about the processing of Customer Personal Data, this Addendum prevails; if the SCCs or the UK Addendum conflict with this Addendum, they prevail.

We may change this Addendum as clause 17 of the Terms provides, but not so as to reduce the protection it gives Customer Personal Data, except where Data Protection Law or a supervisory authority requires it. Each version remains available at https://www.kostrix.com/dpa.

The parties (Annex I.A of the SCCs):

• Data exporter: the Customer that accepted the Terms, with the address and contact details of its account administrator and the billing details on file in the service; role: controller (Module Two) or processor (Module Three); activities: use of Kostrix to review the cost of its AWS accounts.
• Data importer: Whizzy Geeks Internet Services Private Limited, GH-4/32, Meera Bagh Apartment, Block GH-4, SFS Flats, Paschim Vihar, West Delhi, Delhi 110063, India; contact: Vibhor Agarwal, Grievance Officer, contactus@whizzygeeks.com, +91-120-4579550; role: processor; activities: providing Kostrix.

The processing (Annex I.B of the SCCs):

• Data subjects: your personnel and any other individuals whose identifiers appear in the AWS accounts you connect - IAM users and roles named after people, people named in resource names or tags, and the principals recorded in CloudTrail management events.
• Personal data: AWS account ids and aliases; IAM user and role names and, where a credential report already exists, each IAM user's access-key age, multi-factor status and last sign-in; CloudTrail management-event records (which principal called which AWS API, when, and from which IP address); names and tags of resources; S3 object keys (names) and sizes, never object contents; and the role ARN and external id, or the encrypted read-only access key, you give us to connect.
• Sensitive data: none is intended or needed; you must not connect special-category or other regulated personal data (clause 25 of the Terms).
• Frequency: continuous, at each scan - by default once a day, and whenever you ask for one.
• Nature of the processing: collection through read-only AWS APIs using the IAM role or access key you provide; storage; analysis to produce findings and estimates; presentation in the application, in reports, e-mail and CSV exports and through the API; and deletion.
• Purpose: to give you findings, cost estimates, commitment-coverage analyses and reports about your AWS accounts.
• Retention: each scan replaces the previous scan's findings and inventory; monthly counts of findings are kept for comparison while the account is open; everything is deleted as clause 11 describes.
• Transfers to Sub-processors: as Annex 3 describes, for the same purpose and duration.

Competent supervisory authority (Annex I.C of the SCCs): as clause 13 describes.

• Read-only access: the IAM policy we publish grants no action that can change a resource and none that reads object, secret, item or log contents, and automated tests keep it so. When you connect an account we test the role or key you give us against write actions and refuse it, without storing it, if it could change anything.
• Credentials: connection by cross-account IAM role with an external id by default; a read-only access key, if you choose that method instead, is encrypted with AES-256-GCM under a key held in AWS Secrets Manager and is never displayed again.
• Encryption: HTTPS with HTTP Strict Transport Security between your browser and our content delivery network; data at rest encrypted by Amazon DynamoDB and Amazon S3.
• Authentication: e-mail verification before first sign-in; passwords and secret answers stored only as bcrypt hashes; an optional authenticator-app or e-mailed second factor, with one-time recovery codes; escalating lockouts after failed sign-ins; a proof-of-work challenge and rate limits on public forms; and a cross-site request forgery token on every form.
• Separation between customers: every record is stored under your account's own key, and every request is resolved to the signed-in account; our administration console cannot display findings, resource identifiers or cost figures and cannot write to a customer's records.
• Logging and monitoring: every change and download made in your account is recorded with its time, user and network address and kept for thirteen months, as is the sign-in history; alarms tell our team of server errors, failed scans and e-mail delivery failures.
• Backups and recovery: point-in-time recovery on every database table, with a thirty-five day window, and a written restore procedure.
• Change control: every change is tested by an automated test suite before release, and released only by our personnel through a defined deployment process.
• Incident response: a written personal data breach procedure and breach register, including the notice clause 9 requires.
• Personnel and access: access to production systems is limited to personnel who need it, under a duty of confidentiality.

At the date of this Addendum we use these Sub-processors for Customer Personal Data:

• Amazon Web Services, Inc. and its affiliates (United States; the service runs in the AWS US East (N. Virginia) region) - hosting, compute, databases, storage, content delivery, logging and e-mail delivery (Amazon Simple Email Service);
• Slack Technologies, LLC (United States) - only Customer Personal Data that you choose to include in a support message, which is copied to the workspace our team uses to answer it;
• Zoho Corporation and its affiliates (Zoho's United States data centre) - only Customer Personal Data that you choose to include in a support e-mail, which reaches our team's mailbox.

Our personnel in India access Customer Personal Data to provide and support the service. Razorpay and Google, named in our Privacy Policy, receive no Customer Personal Data.