Data Processing Agreement

• Subject matter: providing the DueBase vendor risk management service.
• Duration: for as long as the Customer uses DueBase, plus the deletion period below.
• Nature and purpose: storing, organising, displaying, emailing and — when a user requests it — AI-assisted reading of Customer content.
• Data subjects: the Customer’s users, and contacts at the Customer’s vendors.
• Personal data: names, business contact details, job roles, and any personal data contained in documents the Customer uploads.

• We process personal data only on the Customer’s documented instructions, which are these terms and the Customer’s use of DueBase.
• Everyone at DueBase with access to Customer data is bound by confidentiality.
• We maintain the security measures described on our Security page.
• We help the Customer respond to data subject requests and meet its obligations on security, breach notification and impact assessments, taking into account what information is available to us.

The Customer authorises the categories of sub-processor listed below; the named list is available on request. We bind each to data protection terms no less protective than these, and remain responsible for them. We will notify the Customer before adding or replacing a sub-processor, and the Customer may object on reasonable grounds.

• Cloud database and storage provider — Database, sign-in and file storage (Mumbai, India)
• Cloud hosting provider — Runs the DueBase application (Mumbai, India)
• Email delivery provider — Sends service emails, requests and reminders (Mumbai, India)
• AI processing provider — Processes document text for DueBase AI, only when a user runs an AI feature (May be outside India)

Customer data is stored in Mumbai, India. Text sent to DueBase AI is processed by our AI processing provider, which may process it outside India. Where the law requires safeguards for such transfers, we put them in place.

We will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer data, with the information reasonably available to help the Customer meet its own obligations.

When the Customer’s account ends, we will, at the Customer’s choice, return or delete Customer data within 30 days of a written request, unless the law requires us to retain it.

We will make available the information reasonably necessary to demonstrate compliance with this agreement, and respond to the Customer’s reasonable security questionnaires.

Questions about this agreement: privacy@duebasehq.com.