Data processing agreement

‍

This Data Processing Agreement (“DPA”) is entered into by and between ZiveAI Inc (“Data Processor”) and the Customer (“Data Controller”) (collectively referred to as the “Parties”).

Amazon Web Services, Inc.
- Zive utilizes Amazon Web Services (AWS) as a trusted sub-processor to securely store and process customer data in compliance with industry-leading privacy and security standards. The software is hosted on AWS instance in US-East, and they are SOC2 Type II certified.
MongoDB, Inc.
- Zive uses MongoDB as a managed database service to securely store structured application data with high availability and encryption at rest. The encrypted database is hosted on AWS instance in US-East, and they are SOC2 Type II certified.
Stripe, Inc.
- Zive leverages Stripe to process payments securely and ensure compliance with global financial regulations, including PCI DSS. Stripe operates their data centers in the US, and they are SOC2 Tyep II certified.
Plaid, Inc.
- Zive integrates with Plaid to securely access financial account data and leverage Plaid’s KYC and AML services for customer identity verification and compliance with financial regulations. Plaid operates their data centers in the US, and they are SOC2 Tyep II certified.

1. Definitions

The Data Processor engages the following sub-processors for the processing of Personal Data:

1.1. “Data Controller” refers to the party that determines the purposes and means of the processing of personal data.
1.2. “Data Processor” refers to the party that processes personal data on behalf of the Data Controller.
1.3. “Personal Data” refers to any information relating to an identified or identifiable natural person.
1.4. “Processing” refers to any operation performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Exhibit A: List of Sub-Processors

2. Sub-processors

6.1. This DPA will remain in effect for the duration of the data processing activities or until terminated by the terms set forth herein or in the Terms of Service.
6.3. If you have any questions, please contact our DPO
- Name: Rajesh Gopi
- Email: dpo@zive.ai.

2.1. The Data Processor utilizes sub-processors to aid in delivering the services, as Exhibit A details.

6. Term and Termination

3. Data Processing Obligations

5.1. Data transfers to third countries or international organizations may only occur with the prior written consent of the Data Controller and in compliance with applicable data protection laws.

3.1. Compliance with Laws: The Data Processor commits to processing Personal Data by all applicable data protection laws, regulations, and industry standards.
3.2. Confidentiality: The Data Processor ensures that any individual authorized to process Personal Data is committed to confidentiality.
3.3. Security Measures: The Data Processor implements and maintains adequate technical and organizational measures to safeguard the Personal Data from unauthorized access, loss, disclosure, alteration, or destruction.
3.4. Subprocessing: The Data Processor will maintain an up-to-date list of all sub-processors engaged in processing Personal Data and ensure that data protection obligations bind any sub-processor through a written agreement.
3.5. Data Subject Rights: The Data Processor will assist the Data Controller in responding to data subject requests, including requests to access, correct, delete, or limit the processing of Personal Data.
3.6. Data Breach Notification: In the event of a personal data breach, the Data Processor will promptly inform the Data Controller about the breach and provide all necessary information to assist the Data Controller in fulfilling its obligations under applicable data protection laws.

5. Data Transfer

4. Data Controller Responsibilities

4.1. Lawful Basis: The Data Controller ensures that it has a lawful basis for processing Personal Data and that the necessary permissions or authorizations have been obtained, where applicable.
4.2. Instructions: The Data Controller will provide written instructions to the Data Processor regarding processing Personal Data. The Data Processor will not process the Personal Data for any other purpose than as directed by the Data Controller.
4.3. Data Subject Rights: The Data Controller is responsible for addressing data subject requests related to exercising their rights under applicable data protection laws.