Data Processing Addendum

This Tyashin Data Processing Addendum (the "Addendum") forms part of the Tyashin Terms of Service (the "Terms"). It applies when we process personal data about the people who visit or buy from your site on your behalf. "You" means the business that holds the Tyashin account.

1. Who we are

Tyashin is run by three companies in the same group. Which one you deal with depends on where you are. For a business account, that is the country of the business's billing address.

• India: Aapastech Private Limited (CIN U72900DL2022PTC395508; registered office 8/3, 2nd Floor, Roop Nagar, Delhi 110007, India). It is the data fiduciary for your personal data under Indian law.
• European Union and United Kingdom: Aapastech OÜ (registry code 16453146, VAT EE102489493, Tornimäe tn 3 // 5 // 7, 10145 Tallinn, Estonia). It is the controller of your personal data under the GDPR and the UK GDPR.
• Everywhere else: 14818032 Canada Inc. (Burlington, Ontario, Canada). It is the controller of your personal data.

The three companies share engineering, hosting and support, and each processes personal data for the others under a written intra-group agreement. In this document "Tyashin", "we" and "us" mean whichever of them you deal with.

2. Roles

"Site Data" means personal data about the visitors and buyers on any site you run on Tyashin that we process to provide the Service. For Site Data, you are the data fiduciary (the controller, under laws that use that word) and we are your processor. Personal data about you and your team as our account holders is not Site Data; our privacy policy covers it.

If you are in the European Union or the United Kingdom, Aapastech OÜ is your processor, and this Addendum is the contract between you and Aapastech OÜ required by Article 28 of the GDPR and of the UK GDPR.

3. Scope and duration

This Addendum applies from the moment we first process Site Data for you. It lasts as long as we process Site Data, including after your account ends while we delete or return it, or keep it because the law requires (section 11).

4. The data and the people it is about

Site Data is about visitors to your site, buyers and shoppers (including those with accounts on your site), and people who fill in your forms, subscribe to your newsletter or use your chat assistant. It can include:

• form submissions and leads: names, email addresses, phone numbers, messages and any other fields you add to your forms;
• orders: names, contact details, delivery and billing addresses, items bought, amounts, and payment status and references (buyers enter card and bank details with the payment provider, not with us);
• shopper accounts and newsletter sign-ups;
• chat conversations with your site's chat assistant, including anything people type into it;
• analytics and error telemetry: pages viewed, clicks and other events, random visitor and session IDs, the referring page and error messages;
• visitor IP addresses and device data: IP address, the approximate location worked out from it, browser and device details, and request logs;
• the consent choices people make on your site.

We process Site Data to host and run your site, provide the features you turn on, keep the Service secure, support you and meet our legal duties.

5. Processing only on your instructions

We process Site Data only on your documented instructions. Your instructions are the Terms, this Addendum, your settings and the features you turn on, and any other written instructions we agree with you. We will tell you if we think an instruction breaks the law. We do not use Site Data for our own purposes. By accepting the Terms you also instruct us to produce the aggregated statistics described in section 10 of the Terms, and to open and run a YOM analytics account for your sites as section 9 of the Terms describes. YOM is run by our group companies and is on our sub-processors list. We may see the reports in that account only to show them to you in Tyashin and to support you, and we stop when you remove our access in YOM or your Tyashin account ends. The record of results described in section 9 of the Terms (counts and values of leads, orders and chat conversations) holds nothing that identifies your visitors, so it is not Site Data, and we use it for the purposes that section gives. We may process Site Data where the law requires us to, and if so we will tell you first unless the law forbids it.

6. Confidentiality

We limit access to Site Data to staff and contractors who need it for their work and who are bound by a duty of confidentiality.

7. Security

We will keep at least these measures in place to protect Site Data:

• TLS on every public endpoint;
• encryption at rest provided by our hosting and database providers;
• access to production systems limited to staff who need it;
• secrets kept in managed secret stores, never in source code;
• logging of security and administrative events;
• incident response with the notification times in this Addendum;
• backups provided by our database providers.

We are extending log retention to 180 days across all systems by 31 December 2026.

8. Sub-processors

You authorise us to use the sub-processors named in the sub-processors list in our privacy policy. We will use a sub-processor only under written terms that require it to protect Site Data in line with this Addendum. We will tell you by email or in the product at least 30 days before we add or replace a sub-processor that processes Site Data. If you object to the change, you can end the Service before it takes effect.

9. Personal data breaches

If we become aware of a personal data breach affecting Site Data, we will tell you without undue delay and in any case within 24 hours of becoming aware of it. We will give you what you need for your report to the Data Protection Board of India within 72 hours (or, if you are in the European Union or the United Kingdom, to your supervisory authority under the GDPR or the UK GDPR):

• what happened, and its nature, extent, timing and location;
• its likely impact;
• the events, circumstances and reasons that led to it;
• what we have done, or plan to do, to reduce the risk;
• what we know about who caused it;
• the steps we are taking to stop it happening again.

We will update you as we learn more, and help you prepare your notices to the people affected. We also report cyber security incidents to CERT-In where the law requires us to.

10. Requests from individuals

If someone asks us to give them, correct, complete, update or delete their Site Data, to withdraw their consent or to nominate someone to act for them, we will pass the request to you promptly. We will not answer it ourselves unless you ask us to or the law requires it. We will help you answer these requests within the time the law gives you, through the admin app where it covers the request and by hand where it does not. We will also give you reasonable help with data protection impact assessments, and with consulting a supervisory authority, where they concern our processing of Site Data.

11. Deletion or return at the end

When the Service ends, or earlier if you ask, we will delete Site Data or return a copy to you, as you choose. Some data stays longer because the law requires it. The CERT-In Directions of 28 April 2022 require us to keep logs for 180 days, and from 13 May 2027 Rule 8(3) of the Digital Personal Data Protection Rules, 2025 will require us to keep personal data, related traffic data and processing logs for one year from processing. We keep data held for these reasons as a sealed copy that nobody uses except to meet those legal duties, and then destroy it.

12. Information and audits

We will give you the information you reasonably need to show that we meet this Addendum. We will also allow reasonable audits by you, or by an independent auditor you appoint, on reasonable written notice and under a duty of confidentiality, carried out in a way that does not expose other customers' data or weaken our security.

13. Transfers out of India

We may process Site Data outside India through the sub-processors on our list. Transfers out of India follow section 16 of the Digital Personal Data Protection Act, 2023, and we will not transfer Site Data to any country the Government of India restricts by notification.

If you are in the European Union or the United Kingdom, transfers of Site Data to 14818032 Canada Inc. in Canada rely on the adequacy decisions of the European Commission and the United Kingdom. Transfers to Aapastech Private Limited in India, and to sub-processors in other countries not covered by an adequacy decision, are covered by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 3, together with the UK International Data Transfer Addendum issued by the Information Commissioner. Both are incorporated into this Addendum by reference, and we will send you a copy on request.

14. Your responsibilities

You must:

• have a lawful basis for collecting Site Data, including consent where the law requires it, and publish a privacy notice on your site that tells people what you collect, why, who processes it for you (including Tyashin) and how they can use their rights;
• where your site has visitors in the European Union or the United Kingdom, get their consent before your site stores or reads non-essential cookies or other data on their devices;
• not collect personal data of children under 18 unless you have the verifiable consent of a parent or lawful guardian that the law requires, and not use your site to track children or target advertising at them;
• not collect sensitive personal data, such as health or medical information, sexual orientation, biometric data or financial account or card details, unless you have the consent the law requires;
• not upload or import personal data you have no right to use, such as contact lists bought from others; and
• make sure your instructions to us are lawful.

15. Liability

Each party's liability under this Addendum is subject to the limits and exclusions in section 12 of the Terms.

16. If documents conflict, and governing law

If this Addendum and the Terms conflict about Site Data, this Addendum applies. Section 15 of the Terms (governing law and courts) also applies to this Addendum.

17. Contact

Send questions about this Addendum, breach questions and audit requests to contact@aapastech.com. Our Grievance Officer is Shikha Gupta; see the Grievance Officer page.