Data Processing Addendum

Effective Date: 9 October 2026

This Data Processing Addendum (“DPA”) forms part of the agreement, order form, subscription, Terms of Service, master services agreement or other written agreement (collectively, the “Agreement”) between Arka Pvt Ltd (“Arka” or “Processor”) and the customer identified in the Agreement (“Customer” or “Data Fiduciary”).

This DPA applies where Arka processes personal data contained in Customer Content on behalf of Customer in connection with the Services.

1. Definitions

“Applicable Data Protection Law” means Indian privacy, data-protection, information-technology and cybersecurity law applicable to the relevant processing, including the DPDP Act and rules as applicable from time to time, the Information Technology Act, 2000 and applicable rules and directions.

“Customer Content” means case files, documents, pleadings, evidence, communications, client information, prompts, instructions, matter data and other content submitted to or processed through the Services by or on behalf of Customer.

“Subprocessor” means a third-party service provider engaged by Arka to process personal data on Customer’s behalf in connection with the Services.

2. Roles and Scope

For personal data contained in Customer Content, Customer ordinarily determines the purposes of processing and acts as the Data Fiduciary, while Arka processes that personal data on Customer’s behalf as Data Processor. Arka may separately act as Data Fiduciary for account administration, billing, security, fraud prevention, support, legal compliance and its own business operations.

3. Processing Instructions

Arka will process Customer Content only to provide, operate, maintain, support and secure the Services; in accordance with Customer’s documented instructions expressed through the Agreement and use of the Services; to prevent or investigate fraud, abuse or security threats; to comply with applicable law or binding legal process; or as otherwise agreed in writing.

Arka will not sell Customer Content and will not use Customer Content, prompts or customer-specific outputs to train, fine-tune or improve shared or general-purpose AI models.

4. Customer Responsibilities

Customer is responsible for ensuring that it has the authority and lawful basis required to submit Customer Content and instruct Arka to process it. Customer is also responsible for professional, confidentiality, privilege and legal obligations applicable to its use of the Services and for determining whether and how Data Principal requests concerning Customer Content should be fulfilled.

5. Confidentiality and Personnel

Arka restricts Customer Content access to authorised personnel who require such access for legitimate purposes connected with their role and who are subject to appropriate confidentiality obligations. Manual access is not routine and is limited to customer-requested support, troubleshooting, security and fraud investigation, incident response, maintenance requiring access, legal compliance or another customer-authorised purpose. Production support access is logged.

6. Legal and Privileged Material

Arka acknowledges that Customer Content may include confidential legal information, privileged professional communications, litigation strategy and other material subject to legal or professional duties. Arka will treat Customer Content as confidential and does not acquire ownership of Customer case files or legal work product by processing them.

7. Security Measures

Arka maintains reasonable technical and organisational safeguards appropriate to the nature of the Services and risks presented by the processing, including encrypted transport, encryption-at-rest controls provided by relevant infrastructure services, role-based access controls, tenant permissions, logged support access, secure password storage, dependency vulnerability monitoring, backup and recovery controls, subprocessor safeguards and incident-response procedures.

Further details are provided in the Security & AI Data Handling Policy. Arka may update security measures where the update does not materially reduce the overall level of protection for Customer Content.

8. AI Processing

Arka may transmit Customer Content or relevant portions of it to authorised AI, OCR, embedding or machine-learning providers solely where necessary to provide requested functionality. Arka maintains current information about material AI Subprocessors and will make appropriate provider information available to Customer upon request.

Arka configures supported AI and document-processing services with available enterprise privacy controls, including training restrictions and zero-data-retention settings where supported and appropriate. Provider-specific transient processing may occur as part of providing the requested service.

9. Subprocessors

Customer grants Arka general authorisation to engage Subprocessors necessary to provide the Services. Arka will maintain current records identifying material Subprocessors and will make appropriate identity, purpose and processing-location information available to Customer upon request. Arka will impose appropriate data-protection, confidentiality and security obligations on material Subprocessors.

Arka does not provide a general advance-notice period for Subprocessor changes unless such notice is expressly required by applicable law or agreed in an enterprise order form or other written agreement. Where advance notice is contractually agreed, Arka will provide the notice period stated in that agreement.

10. Cross-Border Processing

Customer acknowledges that authorised Subprocessors may process personal data in India and other jurisdictions in which they operate. Arka will make relevant processing-location information available upon request and will comply with applicable Indian restrictions and safeguards governing cross-border processing.

11. Data Principal Requests

If Arka receives a request relating primarily to Customer Content processed on Customer’s behalf, Arka may direct the requester to Customer unless prohibited by law. Taking into account the nature of the processing and available functionality, Arka will provide reasonable assistance to Customer with access, correction, erasure and other applicable requests. Customer remains responsible for determining the response where it acts as Data Fiduciary.

12. Personal Data Breaches

Arka maintains procedures designed to identify, investigate, contain and remediate personal data breaches affecting Customer Content.

Upon confirming a personal data breach affecting Customer Content, Arka will notify Customer without undue delay and in any event within forty-eight (48) hours after confirmation, unless a shorter period is required by an executed agreement or applicable law.

To the extent reasonably available, the notice will describe the nature of the incident, affected information, known or reasonably anticipated consequences, containment or remediation measures and a contact point for further information. Arka may provide information in phases as the investigation develops.

Customer remains responsible for notifications required of it as Data Fiduciary. Arka will provide reasonable cooperation. Nothing prevents Arka from notifying CERT-In, the Data Protection Board of India, law-enforcement or another authority where Arka is independently required to do so.

13. Government and Legal Requests

If Arka receives a binding legal demand requiring disclosure of Customer Content, Arka will disclose only the information it reasonably determines is required by law. Unless legally prohibited, Arka will use reasonable efforts to notify Customer where the demand specifically relates to Customer Content. Arka may preserve information where required by law, court order or a valid preservation obligation.

14. Return, Export and Deletion

During the subscription term, Customer may download uploaded files and use available Service functionality to delete Customer Content. Bulk export of chat history is not currently supported.

Following valid deletion or tenant offboarding, Arka removes relevant Customer Content from active production use in accordance with its deletion procedures. The production relational database is subject to a seven (7) day scheduled backup cycle. Uploaded files may remain in a protected soft-deleted recovery state for up to seven (7) days. Object versioning is disabled for the current production file store and no additional bucket retention policy is configured.

Residual data in backups or recovery systems is not used for ordinary service delivery and expires through the applicable lifecycle. Arka may retain limited records for tax, accounting, fraud prevention, cybersecurity, dispute resolution, regulatory or other legal requirements.

15. Compliance Information and Audits

Upon reasonable request, Arka may provide information reasonably necessary to demonstrate compliance with this DPA. The parties will ordinarily seek to address concerns through Arka’s security documentation, questionnaire responses and available provider/compliance materials before requesting an intrusive audit. Any additional audit rights will be subject to reasonable confidentiality, security, scope, frequency and cost arrangements.

16. Duration and Survival

This DPA remains in effect for as long as Arka processes Customer Content on behalf of Customer. Obligations that by their nature should survive termination, including confidentiality, incident cooperation and lawful retention obligations, survive for the applicable period.

17. Order of Precedence

If this DPA conflicts with the Agreement regarding the processing or protection of Customer Content, this DPA prevails to the extent of the conflict unless the parties expressly agree otherwise in writing.

18. Governing Law

The governing law and jurisdiction provisions of the Agreement apply to this DPA unless the parties agree otherwise in writing.

Schedule 1 - Details of Processing

Schedule 2 - Contacts

Arka Pvt Ltd
Privacy: privacy@attorni.ai
Security: security@attorni.ai
Support: support@attorni.ai