Data Processing Agreement

Version 3.1 · Effective 13 August 2026

1. Scope and roles

This DPA applies where ira ("Processor") processes Personal Data on behalf of the Customer ("Controller") in connection with the ira software. Terms such as Personal Data, Processing, Data Subject, Controller and Processor take the meanings given in Applicable Data Protection Law, including the EU and UK GDPR and India's Digital Personal Data Protection Act, 2023.

Important characteristic of this deployment model. The ira software runs on infrastructure controlled by the Customer. In a standard or air-gapped deployment, ira does not receive, store or have access to any Personal Data processed by the software. The obligations below therefore apply principally to the limited circumstances in which the Customer deliberately transmits Personal Data to ira — for example a diagnostic sample, a support log, or a hosted proof of concept.

2. Processing on documented instructions

ira processes Personal Data only on the Customer's documented instructions, including with regard to international transfers, unless required otherwise by law — in which case ira will inform the Customer before processing, unless legally prohibited from doing so.

This DPA, the Master Services Agreement and the Customer's configuration of the software together constitute the complete documented instructions. ira will inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.

3. Confidentiality

ira ensures that persons authorised to process Personal Data are bound by written confidentiality obligations that survive termination of their engagement, receive data protection training, and are granted access strictly on a need-to-know basis.

4. Security measures

ira implements the technical and organisational measures described in Annex II and on the security page, taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of processing, as well as the risks to data subjects.

5. Sub-processors

The Customer grants ira general authorisation to engage sub-processors, subject to the conditions below. In a standard on-prem deployment there are no sub-processors, because there is no processing outside the Customer's environment.

• ira maintains a current list of sub-processors, available at legal@ira.ai.
• ira gives at least 30 days' notice before adding or replacing a sub-processor.
• The Customer may object on reasonable data protection grounds within that period. If the objection cannot be resolved, the Customer may terminate the affected service without penalty.
• ira imposes on each sub-processor obligations no less protective than those in this DPA and remains fully liable for their performance.

6. Assistance to the Controller

Taking into account the nature of the processing, ira assists the Customer by appropriate technical and organisational measures with:

• responding to data subject requests for access, rectification, erasure, restriction, portability and objection — noting that in an on-prem deployment the Customer can service these directly through the software's own retention and purge controls;
• the security of processing, breach notification and communication to data subjects;
• data protection impact assessments and prior consultation with supervisory authorities.

7. Personal data breach

Where ira becomes aware of a Personal Data Breach affecting Personal Data processed on the Customer's behalf, ira notifies the Customer without undue delay and in any event within 48 hours. The notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. ira does not notify supervisory authorities or data subjects on the Customer's behalf unless instructed to do so.

8. Return and deletion

On termination or expiry, and at the Customer's election, ira deletes or returns all Personal Data it holds on the Customer's behalf and deletes existing copies, unless retention is required by law. Any diagnostic material shared with ira during the term is deleted within 30 days of the resolution of the relevant support matter, or sooner on request. ira certifies deletion in writing on request.

9. Audits

ira makes available all information necessary to demonstrate compliance with this DPA and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor it mandates.

• ira will respond to a reasonable security questionnaire once per year at no charge.
• ira will share the executive summary of its most recent independent penetration test under NDA.
• Because the software runs on Customer infrastructure, the Customer may audit the deployment itself at any time without notice to ira, including network egress inspection and log review.
• On-site audits of ira's own premises require 30 days' notice, occur during business hours, and are limited to once per year unless required by a supervisory authority or following a breach.

10. International transfers

Where ira processes Personal Data and a restricted transfer occurs, the parties incorporate the European Commission's Standard Contractual Clauses (Module Two, Controller to Processor) and, for UK transfers, the ICO's International Data Transfer Addendum, each with a completed transfer risk assessment. For transfers subject to the DPDP Act, ira processes in accordance with any restrictions notified by the Central Government.

In a standard on-prem deployment no restricted transfer occurs, because Personal Data does not leave the Customer's chosen jurisdiction.

Annex I — Details of processing

Item	Detail
Subject matter	Provision, support and improvement of the ira conversation intelligence software
Duration	The term of the Master Services Agreement, plus any deletion period in section 8
Nature and purpose	Real-time transcription, interpretation, retrieval, translation, guidance, compliance monitoring, coaching and write-back — performed on Customer infrastructure
Categories of data subject	The Customer's own customers and prospects; the Customer's employees and agents
Categories of personal data	Voice recordings and transcripts; contact identifiers; account, policy and case data; agent identifiers and performance data; any personal data contained in documents the Customer indexes
Special category data	May be spoken by a data subject during a conversation. The software is configured by default to block writing special-category content to unmapped fields. The Customer determines retention.
Frequency	Continuous, for the duration of each conversation
Data received by ira	None, in a standard deployment. Only material the Customer deliberately transmits for support purposes.

Annex II — Technical and organisational measures

• Pseudonymisation and encryption — TLS 1.3 in transit, AES-256 at rest, PII redaction at index time.
• Confidentiality, integrity, availability and resilience — role-based access control, SSO and SCIM support, segregation of environments, documented backup and restore.
• Restoration of availability — documented recovery procedures, tested restore, rollback to prior signed release.
• Regular testing — annual independent penetration testing, dependency and container scanning in CI, peer-reviewed changes.
• Access governance — no ira standing access to Customer production; least privilege internally; joiner-mover-leaver process.
• Auditability — per-hint audit trail, SIPREC-timestamped compliance events, exportable evidence.

Annex III — Sub-processors

Standard on-prem deployment: none. For hosted proofs of concept or where the Customer elects a private-cloud arrangement operated by ira, a current list is provided at legal@ira.ai and notice of changes is given under section 5.

11. Liability, precedence and law

Liability under this DPA is subject to the limitations and exclusions in the Master Services Agreement. In the event of conflict, this DPA prevails over the Master Services Agreement in respect of data protection, and the Standard Contractual Clauses prevail over this DPA. This DPA is governed by the law stated in the Master Services Agreement.