Data Processing Agreement

DATA PROCESSING AGREEMENT

between

RamAIn, Inc.

(Data Processor)

and

Customer

(Data Controller)

Effective Date: April 18^th^ 2026

Table of Contents

1. Definitions and Interpretation

2. Scope and Nature of Processing

3. Obligations of the Processor

4. Obligations of the Controller

5. Sub-Processing

6. Data Subject Rights

7. Security Measures

8. Personal Data Breaches

9. Data Protection Impact Assessments

10. International Transfers

11. Audit Rights

12. Term and Termination

13. Liability

14. Governing Law and Jurisdiction

15. Miscellaneous

Schedule 1 -- Details of Processing

Schedule 2 -- Technical and Organisational Security Measures

Schedule 3 -- Approved Sub-Processors

Schedule 4 -- Standard Contractual Clauses (EU SCCs)

Data Processing Agreement

This Data Processing Agreement ("DPA" or "Agreement") is entered into as of the Effective Date set out above and forms part of the Master Subscription Agreement or other applicable agreement (the "Principal Agreement") between:

(1) RamAIn, Inc., a Delaware C-Corporation with its principal operating address at 505 Montgomery Street, San Francisco, CA 94111, USA and registered address 108 W. 13th Street, Suite 100, Wilmington, DE 19801, USA (Registered Agent) Processor"); and

(2) The customer entity identified in the Principal Agreement or the applicable Order Form ("Controller").

Together referred to as the "Parties" and each individually as a "Party."

This DPA applies to the extent that the Processor processes Personal Data on behalf of the Controller in connection with the provision of RamAIn's AI-powered computer-use and workflow automation services (the "Services"). In the event of a conflict between this DPA and the Principal Agreement, this DPA shall prevail with respect to the subject matter of data protection.

1. Definitions and Interpretation

1.1 Defined Terms

In this DPA, the following terms shall have the meanings ascribed to them below. Capitalised terms not defined herein shall have the meanings given to them in the Principal Agreement or, where applicable, in the GDPR or other Applicable Data Protection Law.

• "Applicable Data Protection Law" means all laws and regulations applicable to the processing of Personal Data under this DPA, including without limitation: (a) Regulation (EU) 2016/679 ("GDPR"); (b) the UK GDPR and the Data Protection Act 2018 ("UK GDPR"); (c) India's Digital Personal Data Protection Act 2023 and associated rules ("DPDPA"); (d) the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"); and (e) any other applicable national, state, or sectoral data protection legislation.

• "Controller" means the entity that determines the purposes and means of processing Personal Data, as identified in the preamble above.

• "Data Subject" means an identified or identifiable natural person to whom Personal Data relates.

• "EEA" means the European Economic Area.

• "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data.

• "Personal Data" means any information relating to an identified or identifiable natural person that is processed by the Processor on behalf of the Controller in connection with the Services.

• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.

• "Processing" (and "Process", "Processed", "Processes") means any operation or set of operations performed on Personal Data, whether or not by automated means.

• "Processor" means RamAIn, Inc., which processes Personal Data on behalf of the Controller.

• "Restricted Transfer" means a transfer of Personal Data to a country or territory outside the EEA (or, in the case of the UK GDPR, outside the United Kingdom) that is not subject to an adequacy decision.

• "SCCs" means the Standard Contractual Clauses for the transfer of personal data to third countries adopted by the European Commission under Decision 2021/914/EU (Module Two: Controller-to-Processor), and any successor clauses issued thereunder.

• "Services" means the AI-powered computer-use, workflow automation, and related platform services provided by the Processor to the Controller pursuant to the Principal Agreement.

• "Sub-Processor" means any third-party processor engaged by the Processor to process Personal Data on the Processor's behalf in connection with the Services.

• "Supervisory Authority" means an independent public authority responsible for monitoring the application of Applicable Data Protection Law.

• "Technical and Organisational Measures" or "TOMs" means the security and organisational measures described in Schedule 2 of this DPA.

2. Scope and Nature of Processing

2.1 Subject Matter

The Processor shall process Personal Data solely for the purpose of providing the Services to the Controller in accordance with the Principal Agreement and any applicable Order Form. The subject matter, nature, duration, type of Personal Data, and categories of Data Subjects are set out in Schedule 1 (Details of Processing).

2.2 Instructions

The Processor shall process Personal Data only on documented instructions from the Controller, including as set out in this DPA and the Principal Agreement, unless required to do so by Applicable Data Protection Law. In such case, the Processor shall, to the extent permitted by law, inform the Controller before processing.

2.3 Roles

The Parties acknowledge that with respect to Personal Data processed under this DPA: (a) the Controller acts as a data controller under Applicable Data Protection Law; and (b) the Processor acts as a data processor. Where the Processor processes Personal Data for its own purposes (such as security monitoring, product improvement, and service analytics in accordance with its Privacy Policy), the Processor acts as an independent data controller for such processing, which is not governed by this DPA.

2.4 Prohibitions on Processor

The Processor shall not: (a) sell, rent, or otherwise make available Personal Data to any third party except as expressly permitted by this DPA; (b) use Personal Data for its own commercial purposes, including training general-purpose AI or machine learning models, without the Controller's express prior written consent; (c) combine Personal Data with data obtained from other customers or third parties for profiling purposes; or (d) retain Personal Data beyond the period set out in Clause 12.3.

3. Obligations of the Processor

3.1 Confidentiality

The Processor shall ensure that any person authorised to process Personal Data under this DPA is subject to a binding contractual or statutory duty of confidentiality with respect to that Personal Data.

3.2 Cooperation

The Processor shall, taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures, insofar as it is possible, to fulfil the Controller's obligations to respond to Data Subject requests under Applicable Data Protection Law, as further described in Clause 6.

3.3 Assistance with Compliance

The Processor shall assist the Controller in ensuring compliance with its obligations under Articles 32 to 36 of the GDPR (and equivalent provisions under other Applicable Data Protection Law), including with respect to: (a) security of processing; (b) notification of Personal Data Breaches; (c) data protection impact assessments; and (d) prior consultation with Supervisory Authorities.

3.4 Records of Processing Activities

The Processor shall maintain records of processing activities carried out on behalf of the Controller to the extent required under Article 30(2) GDPR (and equivalent provisions), and shall make such records available to the Controller and relevant Supervisory Authorities upon reasonable request.

3.5 Notification of Unlawful Instructions

If the Processor believes that an instruction from the Controller infringes Applicable Data Protection Law, the Processor shall promptly notify the Controller. The Processor shall be entitled to suspend processing of the relevant Personal Data pending resolution, without liability to the Controller.

4. Obligations of the Controller

4.1 Lawful Basis

The Controller represents and warrants that: (a) it has a valid lawful basis under Applicable Data Protection Law for processing the Personal Data; (b) it has provided all required notices and obtained all required consents from Data Subjects; and (c) it has authority to transfer Personal Data to the Processor for processing in accordance with this DPA.

4.2 Accuracy

The Controller is responsible for the accuracy, quality, and legality of the Personal Data it submits to the Services, and for ensuring that its instructions to the Processor are lawful and complete.

4.3 DPDPA Obligations (India)

Where the Controller processes Personal Data of Data Principals (as defined under the DPDPA) and instructs the Processor to do so on its behalf, the Controller shall: (a) obtain valid consent from Data Principals as required under the DPDPA; (b) provide Data Principals with all mandatory privacy notices; and (c) ensure that processing of Personal Data of minors is carried out in compliance with Section 9 of the DPDPA.

4.4 CCPA/CPRA (California)

To the extent that the CCPA/CPRA applies, the Processor shall process Personal Data solely as a "Service Provider" as defined under the CCPA/CPRA. The Processor shall not sell Personal Data or share it for cross-context behavioural advertising. The Controller shall ensure that its privacy notice to California residents accurately reflects this arrangement.

5. Sub-Processing

5.1 General Authorisation

The Controller grants the Processor a general written authorisation to engage Sub-Processors, subject to the conditions set out in this Clause 5. The Processor's current list of approved Sub-Processors is set out in Schedule 3 and is updated from time to time at [ramain.ai/subprocessors]{.mark}.

5.2 Notice of Changes

The Processor shall provide the Controller with at least thirty (30) days' prior written notice (by email or via in-product notification) of any intended addition to or replacement of Sub-Processors. If the Controller has reasonable grounds to object to such change on data protection grounds, it shall notify the Processor within fourteen (14) days of receiving notice, setting out its grounds. The Parties shall negotiate in good faith. If no resolution is reached, the Controller may terminate the affected Services upon written notice, without penalty, provided termination occurs within thirty (30) days of the original notification.

5.3 Sub-Processor Obligations

The Processor shall impose on each Sub-Processor data protection obligations substantially equivalent to those set out in this DPA. The Processor shall remain fully liable to the Controller for the acts and omissions of its Sub-Processors.

5.4 Private VPC and Customer-Hosted Deployments

Where the Parties have agreed (by separate written Order Form or Data Processing Schedule) that the Services will be deployed within the Controller's own private virtual private cloud (VPC) environment ("Private VPC Deployment"), the Controller's own cloud infrastructure (including any AWS, Azure, or other cloud environment owned or controlled by the Controller) shall not constitute a Sub-Processor of the Processor. In a Private VPC Deployment, data at rest resides within the Controller's own environment and the sub-processor analysis shall be as set out in the applicable Order Form or Data Processing Schedule.

6. Data Subject Rights

6.1 Requests

If the Processor receives a request directly from a Data Subject exercising their rights under Applicable Data Protection Law (including rights of access, rectification, erasure, portability, restriction, and objection), the Processor shall promptly forward such request to the Controller and shall not respond to the Data Subject directly, except to acknowledge receipt and inform the Data Subject that the request has been forwarded to the Controller, unless instructed otherwise.

6.2 Assistance

The Processor shall assist the Controller, by appropriate technical and organisational means, in fulfilling the Controller's obligations to respond to Data Subject requests within the applicable statutory timeframes. The Controller may submit requests for such assistance to privacy@ramain.ai.

6.3 India --- Grievance Officer

For processing of Personal Data of Data Principals in India under the DPDPA, the Processor has designated a Grievance Officer as follows: Akshay Vir, akshay@ramain.ai. The Grievance Officer shall acknowledge receipt of complaints within fourteen (14) days and resolve complaints within thirty (30) days of receipt, unless a longer period is required by applicable law.

7. Security Measures

7.1 Implementation

The Processor shall implement and maintain appropriate Technical and Organisational Measures designed to protect Personal Data against unauthorised or unlawful processing and accidental loss, destruction, or damage. The TOMs are described in Schedule 2. The Processor shall review and update the TOMs at regular intervals, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing.

7.2 Security Contact

The Processor's designated security contact for the purposes of this DPA is: security@ramain.ai.

7.3 Employee Training

The Processor shall ensure that all personnel with access to Personal Data receive appropriate data protection and security training and are subject to confidentiality obligations consistent with this DPA.

8. Personal Data Breaches

8.1 Notification to Controller

The Processor shall notify the Controller without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Personal Data Breach affecting Personal Data processed under this DPA. The notification shall include, to the extent available at the time of notification:

• a description of the nature of the Personal Data Breach, including categories and approximate number of Data Subjects and personal data records affected;

• the name and contact details of the Processor's data protection or security contact;

• a description of the likely consequences of the Personal Data Breach; and

• a description of the measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects.

8.2 Cooperation

The Processor shall cooperate with the Controller and take such reasonable steps as are directed by the Controller to assist in the investigation, mitigation, and remediation of the Personal Data Breach. The Processor shall provide updates to the Controller as additional information becomes available.

8.3 Controller Obligations

Where the Controller is required to notify a Supervisory Authority or Data Subjects of a Personal Data Breach, the Processor shall provide such assistance as is reasonably requested by the Controller to enable such notification within the applicable statutory timeframes.

9. Data Protection Impact Assessments

9.1 DPIA Assistance

The Processor shall provide reasonable assistance to the Controller in relation to any data protection impact assessment ("DPIA") that the Controller is required or elects to conduct under Applicable Data Protection Law, where such DPIA relates to the processing of Personal Data under this DPA. Such assistance shall include providing information about the Processor's processing activities, security measures, and any known risks associated with the processing.

9.2 Prior Consultation

Where a DPIA indicates that a high-risk processing activity requires prior consultation with a Supervisory Authority under Article 36 GDPR, the Processor shall cooperate with the Controller to provide any information reasonably requested by the Supervisory Authority in relation to the Processor's processing activities.

10. International Transfers

10.1 Restricted Transfers

The Processor shall not transfer Personal Data subject to the GDPR or UK GDPR to any country or territory outside the EEA or UK (as applicable) unless: (a) an adequacy decision covers the destination country; (b) appropriate safeguards are in place pursuant to Articles 46-47 GDPR; or (c) a derogation under Article 49 GDPR applies.

10.2 Standard Contractual Clauses

Where a Restricted Transfer from the Controller (as EEA or UK data exporter) to the Processor (as data importer) is required, the Parties agree that the SCCs (Module Two: Controller-to-Processor) shall apply and are incorporated into this DPA by reference as Schedule 4. The SCCs as incorporated take precedence over this DPA to the extent of any conflict in relation to Restricted Transfers.

10.3 UK International Data Transfer Addendum

Where a Restricted Transfer is subject to the UK GDPR, the Parties shall enter into the UK International Data Transfer Addendum (IDTA) issued by the UK Information Commissioner's Office (ICO), as appended to Schedule 4. The IDTA shall be deemed incorporated into this DPA as of the Effective Date.

10.4 Data Privacy Framework

Where the Processor achieves certification under the EU-U.S. Data Privacy Framework (DPF) and/or its UK Extension, the Processor shall notify the Controller and the Parties shall assess whether the DPF provides an appropriate alternative or supplementary transfer mechanism. Until DPF certification is obtained, the SCCs shall serve as the primary transfer mechanism.

10.5 India --- Cross-Border Transfers

Where Personal Data of Data Principals in India is transferred outside India, the Processor shall comply with the requirements of the DPDPA and any rules or notifications issued by the Central Government of India with respect to cross-border data transfers. The Processor shall maintain appropriate records of such transfers.

11. Audit Rights

11.1 Information and Audits

The Processor shall make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits, including inspections, conducted by the Controller or a mutually agreed independent auditor appointed by the Controller.

11.2 Conditions

Any audit under Clause 11.1 shall be subject to the following conditions:

• the Controller shall give the Processor at least thirty (30) days' prior written notice, unless a shorter period is required by a Supervisory Authority or Applicable Data Protection Law;

• audits shall be conducted during the Processor's normal business hours and in a manner that minimises disruption to the Processor's operations;

• the Controller shall bear its own costs of any audit unless the audit reveals a material breach of this DPA, in which case costs shall be borne by the Processor;

• the Controller may conduct audits no more than once per calendar year, unless there is a reasonable belief of a material breach; and

• the auditor and Controller shall maintain the confidentiality of any information obtained during the audit.

11.3 Certifications

The Processor shall promptly provide the Controller with copies of any relevant security certifications (including ISO 27001, SOC 2, or equivalent) upon reasonable request, to the extent such certifications exist and are available.

12. Term and Termination

12.1 Duration

This DPA shall remain in force for the duration of the Principal Agreement and for as long as the Processor processes Personal Data on behalf of the Controller.

12.2 Termination

This DPA shall automatically terminate upon termination or expiry of the Principal Agreement, except that obligations relating to in-flight processing and data deletion or return shall survive for the period set out in Clause 12.3.

12.3 Return or Deletion of Personal Data

Upon termination or expiry of this DPA (or upon written request from the Controller at any time), the Processor shall, at the Controller's election: (a) return all Personal Data to the Controller in a machine-readable format; or (b) securely delete or destroy all copies of Personal Data in its possession or control, including on any Sub-Processor systems. The Processor shall certify such deletion or return in writing within thirty (30) days of the termination date. Notwithstanding the foregoing, the Processor may retain Personal Data to the extent required by Applicable Data Protection Law, in which case the Processor shall notify the Controller of such retention and the legal basis therefor.

13. Liability

13.1 General Liability

Each Party's liability to the other under or in connection with this DPA shall be subject to the limitations and exclusions set out in the Principal Agreement, save as provided in Clauses 13.2 and 13.3.

13.2 Regulatory Fines

Nothing in this DPA shall limit either Party's liability to Data Subjects or a Supervisory Authority for regulatory fines, penalties, or compensation orders imposed under Applicable Data Protection Law. As between the Parties, each Party shall be responsible for regulatory fines arising from its own failure to comply with Applicable Data Protection Law.

13.3 Indemnification

Each Party shall indemnify and hold harmless the other Party (and its officers, directors, employees, and agents) from and against any claims, damages, losses, costs, and expenses (including reasonable legal fees) arising from a breach of this DPA by the indemnifying Party, to the extent permitted by Applicable Data Protection Law.

14. Governing Law and Jurisdiction

14.1 Governing Law

This DPA shall be governed by and construed in accordance with the laws of the State of Delaware, USA, without regard to its conflict of laws principles, except that: (a) provisions relating to the GDPR and EEA-originating Restricted Transfers shall be interpreted in accordance with EU law; (b) provisions relating to the UK GDPR shall be interpreted in accordance with the laws of England and Wales; and (c) provisions relating to the DPDPA shall be interpreted in accordance with Indian law.

14.2 Jurisdiction

Any dispute arising out of or in connection with this DPA shall be subject to the jurisdiction set out in the Principal Agreement. Notwithstanding the foregoing, nothing in this DPA shall prevent a Party or Data Subject from bringing a claim before a competent Supervisory Authority.

15. Miscellaneous

15.1 Order of Precedence

In the event of any conflict between this DPA and the SCCs (Schedule 4), the SCCs shall prevail with respect to Restricted Transfers. In the event of any conflict between this DPA and the Principal Agreement with respect to the processing of Personal Data, this DPA shall prevail.

15.2 Amendments

No amendment to this DPA shall be effective unless made in writing and signed by authorised representatives of both Parties, except that Schedule 3 (Approved Sub-Processors) may be updated by the Processor in accordance with Clause 5.2 without requiring a formal amendment.

15.3 Severability

If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.

15.4 Entire Agreement

This DPA, together with the Principal Agreement and any applicable Order Forms, constitutes the entire agreement between the Parties with respect to the processing of Personal Data and supersedes all prior agreements, representations, and understandings relating thereto.

15.5 Counterparts and Electronic Signatures

This DPA may be executed in counterparts and by electronic signature, each of which shall be deemed an original and which together shall constitute one and the same instrument.

Schedule 1 -- Details of Processing

Element Details

Subject matter of Provision of AI-powered computer-use, workflow processing automation, and related platform services enabling customers to automate tasks via AI agents acting on their behalf.

Duration of processing For the duration of the Principal Agreement, plus any additional period required by Applicable Data Protection Law (see Clause 12.3).

Nature of processing Collection, storage, retrieval, use, transmission, analysis, and deletion of Personal Data to enable the Services, including transient processing of inputs/outputs through AI inference APIs.

Purpose(s) of (a) Providing and operating the Services; (b) processing responding to Controller instructions and user queries; (c) security monitoring and incident response; (d) billing administration.

Types of Personal Data Categories may include: user identifiers (name, email address, username); authentication credentials (hashed); device and usage data; content submitted by users to AI workflows (which may contain Personal Data at the Controller's discretion); IP addresses; system access logs; and any other Personal Data submitted by the Controller or end-users through the Services.

Categories of Data (a) Controller's employees and contractors Subjects who access the Services; (b) Controller's end-users; (c) third parties whose Personal Data may be incidentally included in content submitted to the Services by the Controller or its users.

Special categories of Not envisaged as part of the standard Services. Personal Data The Controller shall not submit Special Category Personal Data (as defined under Article 9 GDPR) through the Services unless separately agreed in writing with the Processor.

Frequency of transfer Continuous / on demand, for the duration of the Principal Agreement.

Schedule 2 -- Technical and Organisational Security Measures

RamAIn, Inc. has implemented the following Technical and Organisational Measures (TOMs). These measures are reviewed and updated periodically to reflect the current state of security best practices.

A. Access Control

• Role-based access controls (RBAC) limiting access to Personal Data to authorised personnel on a need-to-know basis.

• Multi-factor authentication (MFA) required for all systems processing Personal Data.

• Privileged access management (PAM) controls for administrative accounts.

• Access rights reviewed and revoked promptly upon change of role or termination of employment.

B. Data Encryption

• Personal Data encrypted in transit using TLS 1.2 or higher.

• Personal Data encrypted at rest using AES-256 or equivalent.

• Encryption key management processes in place with appropriate key rotation procedures.

C. Physical Security

• Personal Data hosted on cloud infrastructure (AWS/GCP) with physical security controls maintained by the respective cloud service provider in accordance with their own security certifications (SOC 2, ISO 27001).

• Physical access to any on-premises infrastructure restricted to authorised personnel.

D. Availability and Resilience

• Regular automated backups of data with tested restoration procedures.

• Business continuity and disaster recovery plans in place and reviewed annually.

• Infrastructure monitoring and alerting for availability and performance.

E. Incident Response

• Documented incident response procedures, including Personal Data Breach procedures consistent with Clause 8.

• Designated security contact: security@ramain.ai.

• Post-incident reviews and corrective action tracking.

F. Data Minimisation and Retention

• Principle of data minimisation applied to collection and processing of Personal Data.

• Defined retention periods for different categories of Personal Data.

• Automated deletion or anonymisation of Personal Data at end of retention period.

G. Personnel and Training

• Confidentiality obligations for all personnel with access to Personal Data.

• Data protection and security training for all relevant personnel upon onboarding and annually thereafter.

• Background checks carried out on personnel with access to Personal Data in accordance with applicable law.

H. Vendor Management

• Due diligence conducted on Sub-Processors prior to engagement, including review of their security practices and contractual data protection obligations.

• Sub-Processor contracts include obligations equivalent to those set out in this DPA.

Schedule 3 -- Approved Sub-Processors

The following Sub-Processors are approved as of the Effective Date. The Processor maintains an up-to-date list at ramain.ai/subprocessors. Changes are notified in accordance with Clause 5.2.

Sub-Processor Purpose Location Transfer Mechanism

Google Cloud Cloud USA (global) SCCs / DPF Platform (GCP) infrastructure; (pending) transient AI/LLM
inference

Amazon Web Services Hosting and USA (global) SCCs / DPF (AWS) infrastructure; (pending) AI/LLM inference

Stripe, Inc. Billing and USA SCCs payment processing

Supabase, Inc. Database services USA SCCs

Sprinto GRC compliance and USA/India SCCs / DPDPA rules Technologies evidence
collection

Intercert GRC auditing India DPDPA rules services

Note: For Private VPC Deployments (see Clause 5.4), the above list applies only to the Processor's own infrastructure components. Customer-controlled cloud environments do not constitute Sub-Processors of the Processor.

Schedule 4 -- Standard Contractual Clauses (EU SCCs) and UK IDTA

The following terms govern the incorporation of the EU Standard Contractual Clauses and the UK International Data Transfer Addendum into this DPA.

Part A -- EU Standard Contractual Clauses (Module Two)

The EU SCCs (Commission Implementing Decision (EU) 2021/914, Module Two: Controller-to-Processor) are incorporated herein by reference and shall apply where the Controller transfers Personal Data from the EEA to the Processor in a Restricted Transfer. The Annexes to the SCCs shall be completed as follows:

• Annex I.A (List of Parties): Data Exporter: Controller (as identified in the Principal Agreement). Data Importer: RamAIn, Inc., 505 Montgomery Street, San Francisco, CA 94111, USA. Contact: privacy@ramain.ai.

• Annex I.B (Description of Transfer): As set out in Schedule 1 of this DPA.

• Annex I.C (Competent Supervisory Authority): The Supervisory Authority of the EU Member State in which the Controller is established, or as agreed between the Parties.

• Annex II (Technical and Organisational Measures): As set out in Schedule 2 of this DPA.

• Annex III (Sub-Processors): As set out in Schedule 3 of this DPA.

Optional clauses: Clause 7 (Docking Clause) --- not included. Clause 11 (Redress) --- optional language not included. Clause 17 (Governing Law) --- the laws of Ireland shall govern the SCCs. Clause 18 (Choice of Forum and Jurisdiction) --- the courts of Ireland.

Part B -- UK International Data Transfer Addendum (IDTA)

Where Personal Data is transferred from the United Kingdom to the Processor in a Restricted Transfer under the UK GDPR, the Parties shall execute the UK IDTA (as published by the ICO and in force from time to time) as a standalone addendum to this DPA. The IDTA table shall be completed to reference the EU SCCs (as above) as the "Approved EU SCCs" and the information in Schedules 1, 2, and 3 of this DPA.

Part C -- India (DPDPA)

Cross-border transfers of Personal Data of Data Principals in India shall be conducted in compliance with the DPDPA and any applicable rules or notifications issued by the Central Government of India. The Parties shall execute any additional agreements required by applicable Indian data transfer rules as they come into force.