Data Processing Agreement

This Data Processing Agreement (DPA) applies when an organisation (the Customer) subscribes to Bullseye, and covers the personal data contained in the content its members put into or produce with the Service (Customer Personal Data). It forms part of our Terms of Service. Words defined there have the same meaning here.

For Customer Personal Data, the Customer decides why and how it is processed and is the data fiduciary under India's Digital Personal Data Protection Act, 2023 (the DPDP Act); Beam Enterprises, which operates Bullseye (we, us), processes it on the Customer's behalf as its data processor. For account, billing and website data we are the data fiduciary, as our Privacy Policy explains.

Where this DPA and the Terms conflict on Customer Personal Data, this DPA prevails. Where the Customer has signed a separate data processing agreement with us, that agreement prevails over this one.

• Purpose: providing the Service to the Customer: storing its content, answering its members' questions, and reviewing, comparing and drafting their documents.
• Data principals: the Customer's members who use the Service, and people named or described in the content they submit, such as parties to a contract.
• Personal data: whatever the Customer's members include in their questions, files, chats, matters, knowledge bases and saved memories, such as names, contact details and the facts of a matter.
• Duration: the Customer's subscription, then until the data is deleted as set out in "Deletion and return" below.

We process Customer Personal Data only to provide the Service, on the Customer's documented instructions: the Terms, this DPA, and what its members and administrators do in the Service. We will tell the Customer if we believe an instruction breaks the law. We may also process it where the law requires us to, telling the Customer first where the law allows.

We do not use Customer Personal Data to train or fine-tune AI models, and we do not sell it. The AI model providers that process it are bound not to use it to train their models.

Only the people who operate and support the Service can access Customer Personal Data, and only as the Terms allow: to give support the Customer asked for, to investigate a fault, abuse or security issue, or to comply with the law.

We protect Customer Personal Data with the technical and organisational measures described in the Security section of our Trust Centre. We may change those measures as the Service develops, but not in a way that lowers the overall protection of Customer Personal Data.

The Customer authorises us to use the sub-processors listed on our Trust Centre. Each processes Customer Personal Data only to provide its service to us, under written terms that protect it. We remain responsible to the Customer for what our sub-processors do with it.

We will email the Customer's administrators at least 30 days before a new sub-processor starts processing Customer Personal Data, and update the Trust Centre. If the Customer objects on reasonable data protection grounds within that time, we will discuss it in good faith. If we cannot resolve the objection, the Customer may end its subscription before the change applies, and we will refund the fees it prepaid for the rest of the period.

Customer Personal Data is stored in India. To produce a response, the text of a request may be processed outside India by the AI model providers listed on the Trust Centre, which also shows where each one processes it. We transfer Customer Personal Data outside India only to those providers, and never to a country the Government of India restricts transfers to. A Customer that needs processing kept within India can contact us to discuss its options.

Members can download and delete their own content in the Service. If we receive a request from a data principal about Customer Personal Data, we will pass it to the Customer rather than answer it ourselves, unless the law requires otherwise. We will help the Customer respond to requests, and with its own obligations under the DPDP Act, as far as is reasonable given what we process.

If we become aware of a breach of security affecting Customer Personal Data, we will tell the Customer without undue delay, and within 48 hours of becoming aware of it. We will tell the Customer what we know of what happened, the data and people affected, and what we are doing about it, and update it as we learn more, so that it can meet its own duty to inform the Data Protection Board of India and the people affected.

During the subscription, the Customer's members can download and delete their content in the Service. For 30 days after the subscription ends they can still sign in and download it. After that we may delete it.

When the Customer asks us in writing, we will delete Customer Personal Data and confirm the deletion in writing. Deleted data is gone from our backups within 7 days. We keep only what the law requires us to, and what belongs to someone else: a question one member asked in another member's shared chat stays in that chat, as the Privacy Policy explains.

We will give the Customer the information reasonably needed to show that we meet this DPA: answers to a reasonable security questionnaire once a year, and our security documentation, both under the confidentiality terms in the Terms. Where the law or the Customer's regulator requires more, or after a breach affecting Customer Personal Data, we will allow an audit by the Customer, its regulator, or an independent auditor bound by confidentiality, on 30 days' written notice, during business hours, at the Customer's cost, and no more than once a year unless a regulator requires it.

Each party's liability under this DPA is subject to the limits in the Terms. This DPA lasts for as long as we process Customer Personal Data. It is governed by the laws of India, and disputes about it are settled as the Terms provide.

Questions about this DPA go to support@bullseye.li, and complaints about personal data to our Grievance Officer, Agni Iyer, at agni@bullseye.li.