1. Purpose and Scope

This Data Processing Agreement (“DPA”) forms part of the agreement between Enclira Labs Private Limited, a company incorporated under the laws of India (“Enclira,” “Processor,” “we,” “us” or “our”), and the customer identified in the applicable Enclira subscription, order form, enterprise agreement or account (“Customer,” “Controller,” “you” or “your”).

This DPA governs the processing of Personal Data by Enclira on behalf of Customer in connection with Enclira’s services where Enclira acts as a Processor, Data Processor, Service Provider or equivalent role under applicable Data Protection Laws.

This DPA is intended to apply globally and to support processing subject to, where applicable:

• EU General Data Protection Regulation (“EU GDPR”).
• UK GDPR.
• Applicable European Economic Area data-protection requirements.
• India’s applicable digital personal-data protection laws.
• Applicable United States state privacy laws.
• Applicable Canadian privacy laws.
• Other applicable data-protection and privacy laws.

This DPA does not apply to processing where Enclira acts as an independent Controller, unless expressly stated otherwise.

2. Definitions

For purposes of this DPA:

• “Applicable Data Protection Law” means any applicable law, regulation or binding regulatory requirement relating to privacy, data protection, security, confidentiality or processing of Personal Data.
• “Controller” means the entity that determines the purposes and means of Processing Personal Data, or the equivalent legal concept under Applicable Data Protection Law.
• “Processor” means the entity that Processes Personal Data on behalf of a Controller, or the equivalent legal concept under Applicable Data Protection Law.
• “Personal Data” means information relating to an identified or identifiable natural person, or equivalent information protected under Applicable Data Protection Law.
• “Processing” means any operation performed on Personal Data, including collection, recording, organization, storage, alteration, retrieval, consultation, use, disclosure, transmission, restriction, deletion or destruction.
• “Customer Data” means data submitted to Enclira by or on behalf of Customer through the Services.
• “Customer Personal Data” means Personal Data contained within Customer Data that Enclira Processes on Customer’s behalf.
• “Data Subject” means an identified or identifiable individual to whom Personal Data relates.
• “Subprocessor” means any third party engaged by Enclira to Process Customer Personal Data on behalf of Customer.
• “Services” means the Enclira products, applications, APIs, hosting, storage, communication, AI, marketplace, administrative and related services provided to Customer.
• “Security Incident” means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to Customer Personal Data processed by Enclira.
• “Supervisory Authority” means a governmental, regulatory or supervisory authority responsible for enforcing Applicable Data Protection Law.

3. Relationship of the Parties

For Customer Personal Data processed through the Services:

• Customer is generally the Controller or equivalent entity.
• Enclira is generally the Processor or equivalent service provider.
• Enclira may engage Subprocessors.
• Customer determines the purposes and means of Processing unless otherwise expressly agreed.

The parties acknowledge that their respective roles may vary depending on the specific Processing activity.

Nothing in this DPA requires Enclira to act as a Processor where Enclira is independently determining the purposes and means of processing.

4. Customer Responsibilities

Customer is responsible for:

• Determining the lawful purposes for which Customer Personal Data is processed.
• Establishing an appropriate legal basis for Processing.
• Providing required privacy notices.
• Obtaining required consents.
• Complying with Applicable Data Protection Law.
• Ensuring that Customer’s instructions to Enclira are lawful.
• Ensuring that Customer has the right to provide Personal Data to Enclira.
• Configuring the Services appropriately.
• Managing Customer users and administrators.
• Determining appropriate retention periods.
• Responding to Data Subject requests where Customer is the responsible Controller.
• Ensuring that sensitive or special-category data is processed only where legally permitted.
• Implementing appropriate policies for Customer’s users.
• Ensuring that Customer Content does not violate applicable law.

Enclira is not responsible for determining whether Customer’s collection or use of Personal Data is lawful.

5. Enclira’s Processing Instructions

Enclira will Process Customer Personal Data only:

• To provide the Services.
• According to Customer’s documented instructions.
• According to the applicable subscription or agreement.
• As necessary to maintain security.
• As necessary to prevent fraud and abuse.
• As necessary to provide technical support.
• As necessary to comply with applicable law.
• As otherwise expressly permitted under this DPA.

Customer’s use of the Services constitutes the primary instruction to Process Customer Personal Data for the purposes described in the applicable agreement and documentation.

Enclira will not knowingly Process Customer Personal Data for unrelated purposes without an appropriate legal basis or instruction.

6. Categories of Data Subjects

Depending on the Services used, Customer Personal Data may relate to:

• Customers.
• Members.
• Employees.
• Contractors.
• Volunteers.
• Students.
• Alumni.
• Donors.
• Supporters.
• Event participants.
• Community members.
• Website visitors.
• Marketplace buyers.
• Marketplace vendors.
• Service providers.
• Suppliers.
• Business contacts.
• Applicants.
• Users.
• Administrators.
• Other individuals whose information Customer submits to the Services.

The exact categories are determined by Customer’s use of the Services.

7. Categories of Personal Data

Depending on the Services used, Customer Personal Data may include:

• Name.
• Username.
• Email address.
• Telephone number.
• Postal address.
• Profile information.
• Photographs.
• Videos.
• Audio.
• Professional information.
• Educational information.
• Organization membership.
• Account information.
• Authentication identifiers.
• Event information.
• Membership information.
• Communications.
• Posts.
• Comments.
• Messages.
• Survey responses.
• Poll responses.
• Form responses.
• Grievance information.
• Service requests.
• Transaction information.
• Order information.
• Billing information.
• Tax information.
• Device information.
• IP address.
• Approximate location.
• Technical logs.
• Identifiers.
• AI inputs and outputs.
• Other information submitted by Customer or its users.

Customer is responsible for determining which categories are appropriate for its use of the Services.

8. Special Categories and Sensitive Data

Customer must not use the Services to process sensitive or special-category Personal Data unless the applicable Service supports such Processing, Customer has an appropriate legal basis, Customer has satisfied applicable additional requirements, the Processing is permitted by Applicable Data Protection Law, and appropriate safeguards are implemented.

Potentially sensitive information may include:

• Health information.
• Biometric information.
• Political information.
• Religious or philosophical information.
• Precise location.
• Financial information.
• Identity documents.
• Information concerning children.
• Other legally protected categories.

Enclira may restrict certain categories of Processing where reasonably necessary to comply with law, security requirements or Enclira’s risk-management policies.

9. Processing Activities

Enclira may Process Customer Personal Data for:

• Account management.
• Authentication.
• Hosting.
• Storage.
• Transmission.
• Synchronization.
• Search.
• Indexing.
• Communications.
• Notifications.
• Community functionality.
• Social functionality.
• Events.
• Forms.
• Surveys.
• Polls.
• Grievances.
• Marketplace functionality.
• E-commerce.
• Payment-related functionality.
• Analytics.
• Customer support.
• Security.
• Fraud prevention.
• Monitoring.
• Backup.
• Disaster recovery.
• AI and IRA functionality.
• API functionality.
• Integration with third-party services.
• Service improvement as permitted by this DPA.
• Compliance with Customer instructions.

10. Duration of Processing

Enclira will Process Customer Personal Data for the duration of the applicable Services agreement.

Following termination, Enclira will:

• Return Customer Personal Data where required and technically feasible.
• Delete Customer Personal Data according to the applicable retention and deletion procedures.
• Retain information where required by law.
• Retain limited information where reasonably necessary for security, fraud prevention, dispute resolution or legal claims.

Backup copies may remain for a limited period until overwritten through normal backup lifecycle processes.

11. Confidentiality

Enclira will ensure that personnel authorized to Process Customer Personal Data:

• Are bound by confidentiality obligations.
• Receive appropriate access permissions.
• Receive appropriate security guidance.
• Access Customer Personal Data only where necessary to perform their responsibilities.

Enclira will not knowingly authorize personnel to Process Customer Personal Data outside their authorized responsibilities.

12. Security Measures

Enclira will implement reasonable technical and organizational measures appropriate to the risks associated with Processing Customer Personal Data.

Measures may include:

13. Security Standards

Enclira will maintain reasonable security measures appropriate for a SaaS provider of its size, services and risk profile.

Enclira does not represent that it is certified under:

• ISO 27001.
• SOC 1.
• SOC 2.
• PCI DSS.
• HIPAA.
• FedRAMP.
• Other certification frameworks.

Unless Enclira expressly confirms the applicable certification in writing.

Use of a third-party infrastructure provider that maintains a particular certification does not mean that Enclira itself holds that certification.

14. Subprocessors

Customer authorizes Enclira to engage Subprocessors where reasonably necessary to provide the Services.

Subprocessors may provide:

• Cloud infrastructure.
• Hosting.
• Databases.
• Storage.
• Content delivery.
• Backup.
• Communications.
• Email.
• SMS.
• Push notifications.
• Payment infrastructure.
• Fraud prevention.
• Analytics.
• Monitoring.
• Customer support.
• AI infrastructure.
• Security services.
• Meeting and video services.
• Authentication.
• Other technology services.

Enclira will require relevant Subprocessors to provide appropriate data-protection and confidentiality protections consistent with the nature of the Processing.

15. Subprocessor List

Enclira may maintain a current list of material Subprocessors through a designated online location.

The Subprocessor list may include:

• Legal name.
• Service provided.
• Processing purpose.
• Processing location.
• Applicable data categories.

The list may change as Enclira changes or improves its infrastructure.

16. Subprocessor Changes

Enclira may appoint new Subprocessors or replace existing Subprocessors.

Where required by Applicable Data Protection Law, Enclira will provide appropriate notice of material Subprocessor changes.

Customer may object to a new Subprocessor where Applicable Data Protection Law or the applicable agreement provides such a right.

Any objection must:

• Identify the specific legal or data-protection concern.
• Be made within the applicable objection period.
• Not be based solely on a general preference for another provider.

The parties will attempt in good faith to resolve a valid objection.

17. Subprocessor Responsibility

Enclira remains responsible for the performance of its Subprocessors to the extent required by Applicable Data Protection Law and the applicable contractual relationship.

A Subprocessor does not become a direct contractual party to Customer merely because Enclira engages it.

18. International Data Transfers

Customer acknowledges that Enclira may Process Customer Personal Data in countries outside the country where Customer or Data Subjects are located.

Such Processing may involve:

• India.
• United States.
• European countries.
• United Kingdom.
• Canada.
• Other countries in which Enclira or its Subprocessors operate.

Where Applicable Data Protection Law requires a lawful transfer mechanism, the parties will implement an appropriate mechanism.

19. European Standard Contractual Clauses

Where required for transfers subject to the EU GDPR, the parties may rely on the European Commission’s applicable Standard Contractual Clauses (“SCCs”).

The Commission’s modernized SCCs were adopted under Commission Implementing Decision (EU) 2021/914 and provide transfer mechanisms for international transfers subject to the GDPR.

Where appropriate:

• The relevant SCC module will be selected.
• The parties will complete the required annexes.
• The SCCs will be incorporated into the applicable agreement.
• The SCCs will apply to the relevant international transfer.
• Additional safeguards may be implemented where required.

The SCCs will not be modified in a manner prohibited by the applicable Commission decision.

20. Transfer Impact Assessments

Where required by Applicable Data Protection Law, the parties will cooperate in assessing international transfers.

Enclira may provide reasonably available information concerning:

• Processing locations.
• Subprocessors.
• Technical safeguards.
• Contractual safeguards.
• Security measures.
• Applicable transfer mechanisms.

Customer remains responsible for assessing the lawfulness of transfers undertaken by Customer as Controller.

21. Data Subject Rights

Taking into account the nature of the Processing, Enclira will provide reasonable assistance to Customer in responding to lawful Data Subject requests.

Depending on the Services, Enclira may support:

• Access.
• Correction.
• Deletion.
• Restriction.
• Portability.
• Objection.
• Account deletion.
• Export.
• Other applicable rights.

Enclira may provide tools enabling Customer to respond directly to Data Subject requests.

22. Direct Data Subject Requests

If a Data Subject contacts Enclira regarding Customer Personal Data for which Customer is the Controller, Enclira may:

• Direct the Data Subject to Customer.
• Notify Customer.
• Assist Customer as required.
• Respond directly where legally required.

Enclira will not ordinarily independently determine the merits of Customer-controlled Data Subject requests.

23. Assistance With Compliance

Taking into account the nature of Processing and information available to Enclira, Enclira will provide reasonable assistance to Customer concerning:

• Security obligations.
• Breach response.
• Data Subject requests.
• Data-protection impact assessments.
• Regulatory consultations.
• Transfer assessments.

Assistance beyond the standard functionality of the Services may be subject to reasonable fees where permitted by the applicable agreement.

24. Security Incident Notification

Enclira will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data.

Where reasonably available, the notification may include:

• Description of the incident.
• Categories of affected data.
• Affected systems.
• Known or suspected impact.
• Mitigation measures.
• Corrective actions.
• Relevant contact information.

Enclira may provide information progressively as an investigation develops.

Enclira will not be required to provide information that would compromise security, violate confidentiality, expose another customer’s information, violate law or interfere with an investigation.

25. Customer Responsibilities Following an Incident

Customer is responsible for determining:

• Whether a Data Subject notification is required.
• Whether regulatory notification is required.
• The contents of notifications to Data Subjects.
• Communications with Customer’s regulators.

Enclira will provide reasonable assistance within its role.

Enclira will not independently notify Data Subjects concerning Customer-controlled data unless legally required, expressly instructed, necessary to protect individuals, or otherwise appropriate under the circumstances.

26. Regulatory Cooperation

Where required by Applicable Data Protection Law, Enclira will provide reasonable cooperation to Customer in responding to requests from competent Supervisory Authorities concerning Processing performed by Enclira on Customer’s behalf.

Enclira may communicate directly with regulators where legally required.

27. Government Requests

If Enclira receives a legally binding request from a governmental authority for Customer Personal Data, Enclira may disclose the information where legally required.

Where legally permitted, Enclira may notify Customer before disclosure.

Enclira may challenge or limit a request where it reasonably believes there is a lawful basis to do so.

Enclira will not knowingly disclose more Customer Personal Data than legally required.

28. Legal Prohibition on Notification

Enclira is not required to notify Customer of a governmental or law-enforcement request where notification is prohibited by law.

Where legally permitted, Enclira may notify Customer after the restriction expires.

29. Data Deletion

Upon termination of the applicable Services, Customer may request deletion of Customer Personal Data.

Enclira will delete or return Customer Personal Data in accordance with the applicable agreement, the selected Service, documented Customer instructions and Applicable Data Protection Law.

Enclira may retain information where required or permitted for:

• Legal compliance.
• Tax.
• Accounting.
• Fraud prevention.
• Security.
• Dispute resolution.
• Legal claims.
• Enforcement of contractual rights.

30. Backups

Customer acknowledges that deleted information may remain temporarily within backup systems.

Backup data may be retained until:

• The applicable backup cycle expires.
• The backup is overwritten.
• The backup is securely deleted.

Backup retention does not authorize Enclira to restore deleted Personal Data into active production systems except where necessary for disaster recovery or other legitimate operational purposes.

31. Data Portability and Export

Where supported by the applicable Service, Customer may export Customer Data.

Export functionality may vary depending on:

• Subscription.
• Service.
• Data type.
• Technical architecture.
• Third-party dependencies.

Enclira is not required to provide a particular export format unless expressly agreed.

32. Audit Rights

Customer may request information reasonably necessary to demonstrate Enclira’s compliance with its obligations under this DPA.

Where reasonably necessary and legally permitted, Enclira may provide:

• Security documentation.
• Policies.
• Certifications, if any.
• Audit summaries.
• Independent assessment reports, if available.
• Relevant security questionnaires.
• Information concerning Subprocessors.

33. Customer Audits

Customer may request an audit where:

• Required by Applicable Data Protection Law.
• There has been a material Security Incident.
• There is a reasonable and documented basis to believe Enclira is materially failing to comply with this DPA.

Audits must be requested with reasonable advance notice, occur during normal business hours, avoid disruption, protect Enclira confidential information, protect other customers’ information, not involve unauthorized penetration testing, and not access production systems directly.

Unless required by law, Customer may not conduct more than one audit in a twelve-month period.

34. Independent Auditors

Enclira may satisfy audit obligations through:

• Independent audits.
• Security assessments.
• Third-party certifications.
• Penetration testing summaries.
• Security reports.
• Questionnaires.
• Other appropriate evidence.

Customer agrees to reasonably consider such documentation before requesting an additional audit.

35. Audit Costs

Each party bears its own costs for ordinary compliance activities.

If Customer requests a specialized audit outside Enclira’s standard compliance documentation, Enclira may charge reasonable costs associated with the audit where permitted by the applicable agreement.

36. Data Protection Impact Assessments

Where required by Applicable Data Protection Law, Customer is responsible for determining whether a Data Protection Impact Assessment (“DPIA”) is required for its Processing.

Enclira will provide reasonable information available to Enclira to assist Customer.

Customer remains responsible for completing the DPIA.

37. Prior Consultation

Where required by Applicable Data Protection Law, Enclira will reasonably assist Customer in consultations with Supervisory Authorities concerning Customer’s Processing.

Such assistance is subject to the nature of the Services and information available to Enclira.

38. AI and IRA Processing

Where Customer enables Enclira AI functionality, Customer authorizes Enclira to Process relevant Customer Personal Data as necessary to provide that functionality.

AI processing may include:

• Generating responses.
• Summarization.
• Classification.
• Search.
• Recommendations.
• Workflow execution.
• Information retrieval.
• Automation.
• Conversational interfaces.

39. Third-Party AI Providers

Enclira may use third-party AI infrastructure providers to provide AI functionality.

Where third-party AI providers Process Customer Personal Data:

• They may act as Subprocessors.
• Appropriate contractual safeguards will apply.
• Access will be limited to the relevant service.
• Customer Personal Data will be processed according to applicable instructions and agreements.

The specific AI providers may change over time.

40. AI Model Training

Unless expressly permitted by the applicable agreement, Enclira will not intentionally use Customer Personal Data to train a general-purpose AI model for unrelated purposes.

This restriction does not prevent Enclira from:

• Providing AI functionality.
• Generating responses.
• Maintaining service security.
• Detecting abuse.
• Debugging.
• Monitoring service reliability.
• Improving prompts or workflows.
• Using aggregated or appropriately de-identified information where legally permitted.

Any use beyond these purposes will be subject to applicable contractual and legal requirements.

41. Customer Responsibility for AI Inputs

Customer is responsible for determining whether Personal Data may lawfully be submitted to AI functionality.

Customer should not submit sensitive or special-category Personal Data to AI functionality unless the relevant feature supports it, Customer has a lawful basis, required notices have been provided, and required safeguards are implemented.

42. Marketplace Processing

Where Customer uses Enclira marketplace functionality, Enclira may Process Personal Data relating to:

• Buyers.
• Sellers.
• Vendors.
• Service providers.
• Orders.
• Deliveries.
• Transactions.
• Reviews.
• Refunds.
• Disputes.

The merchant or service provider may independently determine purposes of certain Processing.

This DPA does not make Enclira the Controller of Personal Data that a merchant or Customer independently processes.

43. Payment Processing

Enclira may integrate with third-party payment providers.

Payment providers may independently Process:

• Payment credentials.
• Transaction information.
• Fraud information.
• Billing information.
• Authentication information.

Where a payment provider independently determines the purposes and means of Processing, that provider may act as an independent Controller.

Enclira’s receipt of transaction-related information does not necessarily make Enclira the Controller of the underlying payment information.

44. Payment Card Data

Enclira does not intend to require Customer to provide full payment-card credentials directly to Enclira for ordinary payment processing.

Where payment-card processing is handled by an external payment provider, that provider’s systems and terms govern the relevant payment processing.

Customer must not intentionally submit unnecessary payment-card data into Enclira fields that are not designed to receive such information.

45. White-Label Services

Customer may operate a White-Label Service using Enclira infrastructure.

In such cases:

• Customer may control the user-facing application.
• Customer may determine the purposes of member processing.
• Enclira may provide the underlying technology.
• Customer may configure user visibility.
• Customer may configure forms and workflows.
• Customer may configure communications.
• Customer may configure marketplace features.

Customer remains responsible for providing appropriate privacy notices to its users.

Enclira may provide standard privacy information concerning Enclira’s own processing.

46. Customer Administrators

Customer authorizes its administrators to access and manage Customer Personal Data through the Services.

Enclira is not responsible for Processing performed by Customer administrators acting within Customer’s authorized environment, except to the extent caused by Enclira’s failure to comply with this DPA or Applicable Data Protection Law.

Customer must implement appropriate administrator permissions.

47. Data Minimization

Customer is responsible for determining what Personal Data is necessary for its purposes.

Enclira provides technical controls that may assist Customer in limiting collection, access and retention.

Customer should configure the Services according to the principle of data minimization where applicable.

48. Children’s Data

Where Customer operates services involving children or minors, Customer is responsible for determining:

• Applicable age requirements.
• Parental consent requirements.
• Notices.
• Legal basis.
• Retention.
• Access restrictions.
• Other safeguards.

Enclira will provide reasonable technical assistance where supported by the Services.

Customer must not use Enclira to knowingly process children’s Personal Data unlawfully. The Enclira Child Safety Standards set out the conduct prohibited across Enclira-powered services and how to report it.

49. Sensitive Sector Processing

Customer must inform Enclira where its intended Processing involves highly regulated sectors, including:

• Healthcare.
• Financial services.
• Education.
• Government.
• Political organizations.
• Employment.
• Children’s services.

Additional contractual or technical safeguards may be required.

Enclira may decline Processing where it cannot reasonably support the required compliance obligations.

50. Confidential Customer Information

Customer Personal Data is treated as confidential information.

Enclira will not disclose Customer Personal Data except:

• To authorized personnel.
• To authorized Subprocessors.
• According to Customer instructions.
• As necessary to provide the Services.
• Where legally required.
• Where necessary to protect Enclira or users.

51. Enclira Independent Processing

Enclira may independently Process certain information as Controller where necessary for:

• Account administration.
• Billing.
• Subscription management.
• Fraud prevention.
• Security.
• Legal compliance.
• Customer support.
• Service reliability.
• Enclira business operations.

Such Processing is governed by the Enclira Privacy Policy.

This DPA does not convert Enclira’s independent Controller activities into Processor activities.

52. Aggregated and De-Identified Information

Enclira may create aggregated or appropriately de-identified information from Customer Data where legally permitted.

Such information may be used for:

• Analytics.
• Security.
• Benchmarking.
• Product improvement.
• Service reliability.
• Research.
• Business reporting.

Enclira will not intentionally attempt to re-identify appropriately de-identified information except where necessary for legitimate security, legal or operational purposes.

53. Data Protection by Design

Enclira will seek to incorporate reasonable privacy and security considerations into the design and operation of its Services.

This may include:

• Access controls.
• Permission systems.
• Data segregation.
• Authentication.
• Encryption.
• Logging.
• Configurable retention.
• User controls.

No technical architecture can guarantee absolute security.

54. Security Testing

Enclira may perform:

• Vulnerability assessments.
• Security testing.
• Penetration testing.
• Dependency scanning.
• Infrastructure monitoring.
• Application security reviews.

Security testing will be performed according to Enclira’s security program and risk assessment.

55. Employee and Contractor Access

Access to Customer Personal Data by Enclira personnel will be limited based on:

• Job responsibilities.
• Operational necessity.
• Security requirements.
• Least-privilege principles.

Enclira may use contractors and service providers subject to appropriate confidentiality and security requirements.

56. Data Location

Customer acknowledges that exact data-processing locations may vary depending on:

• Infrastructure.
• Backup systems.
• Subprocessors.
• Customer-selected configuration.
• Disaster-recovery requirements.
• Technical architecture.

Enclira will maintain appropriate information about material Processing locations where required.

57. Regulatory Changes

If Applicable Data Protection Law materially changes after the effective date of this DPA, the parties will cooperate in good faith to make reasonable amendments necessary to maintain compliance.

Enclira may update standard DPA terms where reasonably necessary to reflect:

• Legal requirements.
• Regulatory guidance.
• Security requirements.
• Industry standards.

Existing contractual rights will not be materially reduced solely through an administrative update unless permitted by the applicable agreement.

58. Order of Precedence

If there is a conflict between this DPA and another Enclira agreement:

• Mandatory Applicable Data Protection Law prevails.
• Applicable Standard Contractual Clauses prevail for matters governed by those SCCs.
• This DPA prevails over general Terms of Service concerning Processing of Customer Personal Data.
• A separately negotiated enterprise DPA may modify this DPA where expressly stated.

59. Liability

The liability provisions applicable to Processing under this DPA are governed by the liability provisions of the applicable Enclira Terms, Master Services Agreement or Enterprise Agreement, except where Applicable Data Protection Law requires otherwise.

Nothing in this DPA excludes liability that cannot legally be excluded.

60. Indemnification

Any indemnification obligations relating to data protection will be governed by the applicable Enclira commercial agreement.

Nothing in this DPA requires a party to indemnify another party for liability that cannot lawfully be transferred.

61. Term

This DPA becomes effective when:

• Customer accepts the applicable Enclira agreement.
• Customer subscribes to a Service incorporating this DPA.
• The parties sign an agreement incorporating this DPA.
• Another effective mechanism expressly incorporates this DPA.

This DPA remains effective while Enclira Processes Customer Personal Data on Customer’s behalf.

62. Termination

Termination of the underlying Services agreement generally terminates this DPA once Enclira no longer Processes Customer Personal Data as Processor.

Sections concerning the following may survive as necessary:

• Confidentiality.
• Deletion.
• Security.
• Legal retention.
• Audit.
• Liability.
• Dispute resolution.

63. Return or Deletion

Upon termination, Customer may request:

• Return of Customer Data.
• Export of Customer Data.
• Deletion of Customer Personal Data.

Enclira will act according to the applicable agreement and technical capabilities.

Where Customer does not request export or return within the applicable period, Enclira may proceed with deletion according to its retention schedule.

64. Data Protection Contact

Enclira’s privacy contact is Enclira Labs Private Limited:

• Privacy: privacy@enclira.com.
• Legal: legal@enclira.com.
• Security: security@enclira.com.
• Registered office: Enclira Labs, Arenesha Coworking Space, 6th Floor, The District, Financial District, Nanakramguda, Hyderabad, Telangana 500032, India.

If Enclira appoints a Data Protection Officer or privacy representative where legally required, the relevant contact information will be made available.

65. Customer Data Protection Contact

Customer should provide Enclira with a privacy or data-protection contact where appropriate.

Customer is responsible for ensuring that Enclira can reasonably communicate with the appropriate Customer representative concerning:

• Data Subject requests.
• Security Incidents.
• Regulatory matters.
• Data-processing instructions.
• Deletion.
• Other privacy matters.

66. Notice of Material Changes

Enclira may update its standard DPA to reflect:

• Changes in Applicable Data Protection Law.
• Regulatory guidance.
• Changes in Services.
• Changes in security practices.
• Changes in Subprocessors.
• Changes in infrastructure.

Where a change materially affects Customer’s contractual rights, Enclira will provide appropriate notice where required.

67. Governing Law

Unless otherwise agreed in writing, this DPA is governed by the governing-law provision of the applicable Enclira Terms of Service or Master Services Agreement.

Mandatory data-protection laws applicable to the relevant Processing remain unaffected.

68. Dispute Resolution

Disputes concerning this DPA will be handled according to the dispute-resolution provisions of the applicable Enclira Terms or Master Services Agreement.

Nothing in this section restricts a Data Subject’s rights or the authority of a competent Supervisory Authority where such restriction is prohibited by law.

69. Entire Agreement

This DPA, together with the applicable:

• Enclira Terms of Service.
• Master Services Agreement.
• Order Form.
• Enterprise Agreement.
• Applicable SCCs.
• Subprocessor terms.

Constitutes the agreement governing Enclira’s Processing of Customer Personal Data.

70. Severability

If any provision of this DPA is found invalid or unenforceable, the remaining provisions remain effective.

The invalid provision will be interpreted or modified to the minimum extent necessary to make it enforceable while preserving its intended purpose.

71. No Rights for Unauthorized Third Parties

Except where Applicable Data Protection Law expressly grants rights to Data Subjects or other persons, this DPA does not create contractual rights for third parties.

Nothing in this section limits mandatory Data Subject rights.

72. Electronic Acceptance

Customer may accept this DPA electronically.

Electronic acceptance may occur through:

• Enclira account creation.
• Organization creation.
• Subscription checkout.
• Customer portal.
• Order form.
• Enterprise agreement.
• Electronic signature.
• Other electronic acceptance mechanism.

The electronic record of acceptance may be retained by Enclira.

73. DPA Version and Acceptance Record

Enclira may maintain records of:

• DPA version.
• Acceptance date.
• Customer.
• Accepting administrator.
• Organization.
• Applicable subscription.
• Applicable Terms version.
• Applicable DPA version.

This information may be retained for contractual, security, legal and audit purposes.

74. Annex 1 — Processing Details

75. Annex 2 — Data Categories

Potential categories include:

• Identity information.
• Contact information.
• Account information.
• Profile information.
• Organization information.
• Membership information.
• Communications.
• Content.
• Photographs.
• Audio.
• Video.
• Event information.
• Survey responses.
• Poll responses.
• Form responses.
• Grievance information.
• Transaction information.
• Marketplace information.
• Billing information.
• Technical information.
• Authentication information.
• Device information.
• IP addresses.
• Approximate location.
• AI inputs.
• AI outputs.
• Other information configured by Customer.

76. Annex 3 — Data Subject Categories

Potential Data Subjects include:

• Customers.
• Members.
• Employees.
• Contractors.
• Students.
• Alumni.
• Volunteers.
• Donors.
• Event participants.
• Customers of Customer.
• Suppliers.
• Vendors.
• Marketplace participants.
• Service providers.
• Community members.
• Website visitors.
• Users.
• Administrators.
• Other individuals whose Personal Data is submitted to the Services.

77. Annex 4 — Special Categories

Customer may process special-category or sensitive information only where:

• Permitted by the applicable Service.
• Legally permitted.
• Customer has satisfied applicable requirements.
• Appropriate safeguards exist.

Enclira may impose additional restrictions for certain sensitive processing.

78. Annex 5 — Subprocessor Categories

Enclira may use Subprocessors for:

The current Subprocessor List may be maintained separately by Enclira.

79. Annex 6 — Technical and Organizational Measures

Enclira may implement measures including:

80. Annex 7 — International Transfers

Where required, Enclira may use:

• Adequacy decisions.
• Standard Contractual Clauses.
• Contractual safeguards.
• Approved transfer mechanisms.
• Supplementary technical and organizational safeguards.

The European Commission’s modernized SCCs are available for transfers from the EU/EEA to third countries and may also incorporate Article 28 processor obligations where applicable.

The applicable SCC module and annexes should be completed based on the actual transfer structure.

81. Annex 8 — Customer Instructions

Customer’s instructions generally consist of:

• Customer’s use of the Enclira Services.
• Configuration of Customer’s tenant.
• Creation of users.
• Configuration of forms.
• Configuration of workflows.
• Configuration of AI functionality.
• Configuration of integrations.
• Customer’s written instructions.
• Customer’s subscription and order forms.

Enclira may reject instructions that it reasonably believes violate law, violate the applicable agreement, create significant security risk, or require Enclira to process data for an unlawful purpose.

82. Annex 9 — Data Protection Requests

Customer may submit privacy-related requests through privacy@enclira.com.

Where supported, Enclira may provide:

• Export tools.
• Deletion tools.
• Account-management tools.
• Administrator controls.
• Access-management tools.

Customer remains responsible for determining the legal response to a Data Subject request.

83. Annex 10 — Security Incident Contact

Security incidents should be reported to security@enclira.com.

Customers should include, where known:

• Organization.
• Affected environment.
• Date and time.
• Suspected affected data.
• Suspected affected users.
• Known indicators.
• Relevant technical information.

Enclira may request additional information necessary to investigate the incident.

84. Annex 11 — Controller-to-Processor SCCs

Where the European Commission’s Article 28 standard contractual clauses are required or selected for the relevant EU/EEA controller-processor relationship, the applicable clauses may be incorporated into the agreement.

The European Commission provides standard contractual clauses specifically for controller-processor relationships under Article 28.

The parties should complete the applicable clauses and annexes based on the actual Processing relationship.

85. Annex 12 — International Transfer SCCs

Where the European Commission’s international-transfer SCCs are required, the applicable module will be selected based on the actual transfer relationship.

Potential structures may include:

• Controller to Processor.
• Processor to Processor.
• Controller to Controller where applicable.

The SCCs must be used consistently with the European Commission’s applicable decision and must not be materially modified in a way that undermines their required safeguards.

86. Annex 13 — White-Label Customer Processing

For White-Label Services, Customer is responsible for:

• Identifying itself appropriately to End Users.
• Providing its privacy notice.
• Establishing lawful processing purposes.
• Configuring user permissions.
• Configuring retention.
• Determining whether consent is required.
• Ensuring lawful collection.
• Handling Data Subject requests where applicable.

Enclira provides the underlying technology and Processes Customer Personal Data according to this DPA and the applicable agreement.

87. Annex 14 — AI Processing

Where AI functionality is enabled:

88. Annex 15 — Payment Processing

Payment information may be processed by third-party payment providers.

Potential information exchanged with Enclira may include:

• Transaction ID.
• Payment status.
• Amount.
• Currency.
• Payment method type.
• Customer reference.
• Invoice reference.
• Refund status.
• Payout information.
• Limited billing information.

Full payment-card credentials should generally be handled directly by the applicable payment processor rather than entered into Enclira systems.

89. Annex 16 — Final Contractual Statement

This DPA is intended to establish a practical and scalable data-processing framework for Enclira’s global SaaS and white-label platform.

It is designed to support customers across multiple jurisdictions while allowing Enclira to maintain a standardized technology and security architecture.

Where mandatory local law provides stronger or additional rights, those rights prevail to the extent required.

DPA version 1.0, effective 17 August 2026. Contact Enclira Labs Private Limited at privacy@enclira.com, legal@enclira.com or security@enclira.com; registered office: Enclira Labs, Arenesha Coworking Space, 6th Floor, The District, Financial District, Nanakramguda, Hyderabad, Telangana 500032, India.