Data Processing Agreement

1. Roles

You are the controller of the personal data described in Annex 1, and LYSTNG is the processor. For the personal data of LYSTNG's own account holders, LYSTNG is the controller and this DPA does not apply; that data is governed by our Privacy Policy. Where you are yourself a processor for a third party, you appoint LYSTNG as a sub-processor and confirm you have authority to do so.

2. Our obligations as processor

We will:

1. Process personal data only on your documented instructions, including as set out in the Terms and this DPA, and as needed to provide the Services, unless required otherwise by law, in which case we will inform you where legally permitted.
2. Ensure that personnel authorized to process the data are bound by confidentiality.
3. Implement the technical and organizational security measures described in Annex 2.
4. Respect the conditions in Section 4 for engaging sub-processors.
5. Assist you, taking into account the nature of the processing, to respond to requests from data subjects exercising their rights.
6. Assist you with security, breach notification, data protection impact assessments and prior consultation, taking into account the information available to us.
7. Notify you without undue delay after becoming aware of a personal data breach affecting your data.
8. At your choice, delete or return your personal data at the end of the Services and delete existing copies, unless law requires storage.
9. Make available information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to audits, subject to reasonable notice, confidentiality and frequency limits.

3. Your obligations as controller

You will: establish and maintain a lawful basis for the processing; provide required notices to and obtain any required consents from your End Users and data subjects; issue only lawful instructions; and be responsible for the accuracy and legality of the personal data you provide and the instructions you give.

4. Sub-processors

You give general authorization for LYSTNG to engage sub-processors to provide the Services. We maintain a current list of sub-processors, available on request, covering categories including cloud hosting and database infrastructure, a third-party AI model provider, payment processing, email delivery, logging and monitoring, and customer support. We impose data-protection obligations on each sub-processor that are no less protective than this DPA, and we remain responsible for their performance. We will inform you of intended changes to sub-processors and give you a reasonable opportunity to object.

5. International transfers

Your personal data is processed on infrastructure currently located in India. Where personal data originating in the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, the transfer is made under appropriate safeguards, including the applicable Standard Contractual Clauses, which are incorporated by reference and which prevail over this DPA to the extent of any conflict for such transfers.

6. Data subject and regulator requests

If we receive a request from one of your data subjects, or an inquiry from a regulator, relating to data we process for you, we will not respond directly except to confirm the request should be directed to you, unless legally required, and we will inform you without undue delay and assist you in responding.

7. Deletion and return

On termination of the Services, or on your request, we will delete or return your personal data within a reasonable period, and delete existing copies except where retention is required by law. Deletion from routine backups occurs in the ordinary course of backup rotation.

8. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.

Annex 1: Description of processing

Annex 2: Technical and organizational measures

We maintain measures appropriate to the risk, including:

• Encryption of data in transit and at rest
• Access controls and authentication limiting access to authorized personnel
• Network and environment security on our cloud infrastructure
• Logging and monitoring
• Regular patching and vulnerability management
• Backup and recovery processes
• Staff confidentiality obligations

We review and update these measures as standards and threats evolve.

Annex 3: Sub-processors

A current list of sub-processors, by name and purpose, is available on request at founder@zyou.ai. Categories in use include cloud hosting and database infrastructure (currently Amazon Web Services, India), a third-party AI model provider, payment processing, email delivery, logging and monitoring, and customer support.

Contact for data protection matters: founder@zyou.ai
ZYOU AI SYSTEM SOLUTIONS Pvt Ltd (LYSTNG), Pune, Maharashtra, India