Data Processing Agreement

Effective Date: March 25, 2025

This Data Processing Agreement ("DPA") is entered into by and between:

1. Thareja Technologies Inc. ("Processor" or "Thareja AI"), a company registered in [Insert State/Country], with a registered office at [Insert Address], which operates a SaaS platform for hiring, time tracking, productivity monitoring, and compliance;

and

2. The Client ("Controller"), an individual or entity that engages Thareja AI for services involving the processing of personal data.

This DPA supplements the Master Services Agreement ("MSA") and is incorporated by reference.

1. Definitions

"Applicable Law" means all applicable privacy and data protection laws including GDPR, CCPA, and others.

"Personal Data" means any information relating to an identified or identifiable natural person.

"Processing" means any operation performed on personal data.

2. Subject Matter and Duration Thareja AI processes personal data solely for the purpose of providing services under the MSA. This DPA remains in effect as long as Thareja AI processes personal data for the Client.

3. Nature and Purpose of Processing Managing remote workers; Time tracking and productivity monitoring; Facilitating payments and compliance; User authentication and communication

4. Types of Personal Data Names, email addresses, contact info; Payment details (via Stripe); IP addresses, browser metadata; Time logs and productivity metrics

Categories of Data Subjects: Remote workers (contractors), Client representatives

5. Processor Obligations Thareja AI shall: Process personal data only under documented instructions from the Client; Maintain confidentiality of personal data; Implement appropriate technical and organizational measures (e.g., encryption, access control); Assist the Client with data subject rights requests; Notify the Client without undue delay in the event of a data breach; Delete or return all personal data at the end of service provision.

6. Subprocessors The Client authorizes Thareja AI to use subprocessors including but not limited to: Stripe (payments), AWS (hosting and storage), Firebase (authentication and notifications), Checkr (background checks). Thareja AI shall ensure subprocessors meet equivalent data protection obligations.

7. International Data Transfers If personal data is transferred outside the EEA, Thareja AI will ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs).

8. Audits The Client may, no more than once annually, conduct a reasonable audit or request documentation to verify compliance with this DPA.

9. Liability Each party's liability under this DPA is subject to the limitations of liability under the MSA.

10. Governing Law This DPA shall be governed by the same laws and jurisdiction as specified in the MSA.

11. Acceptance By continuing to use the Thareja AI platform, the Client acknowledges and agrees to the terms of this Data Processing Agreement, which is incorporated by reference into the Master Services Agreement.