Data Processing Addendum

Effective date: October 19, 2026
Last updated: October 19, 2026

This Data Processing Addendum (“DPA”) forms part of the agreement between Tessary Software Private Limited (CIN: U62099KA2026PTC218247) (“Tessary”) and the customer that accepts our Terms of Service (“Customer”). It applies automatically when Customer accepts the Terms, with no separate signature. Terms such as “Customer Data,” “Hosted Services,” “Order Form,” and “Services” have the meanings given in the Terms.

1. Definitions

“Applicable Data Protection Law” means the data protection laws that apply to the processing of Customer Personal Data under this DPA, which may include the EU General Data Protection Regulation (2016/679) (“GDPR”), the UK GDPR and Data Protection Act 2018, India’s Digital Personal Data Protection Act, 2023, and US state privacy laws.
“Customer Personal Data” means personal data in Customer Data that Tessary processes on Customer’s behalf on the Hosted Services.
“Sub-processor” means a third party that Tessary engages to process Customer Personal Data.
“Controller,” “processor,” “personal data,” “processing,” “data subject,” and “personal data breach” have the meanings given in Applicable Data Protection Law. Where that law uses equivalent terms, such as “business” and “service provider,” they have the corresponding meaning.

2. Scope and order of precedence

This DPA applies to Customer Personal Data that Tessary processes on the Hosted Services, which are Tessary Cloud and Managed Instances.

This DPA does not apply to:

self-hosted installations of the Open Source edition or the Paid Software, because Tessary does not receive Customer Data from them;
model providers or other third-party services that Customer uses with its own keys or accounts, which are Customer’s own vendors and not Tessary’s Sub-processors; or
personal data that Tessary processes as a controller, such as account, billing, and website data, which our Privacy Policy describes.

If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data. An Order Form signed by both parties may override this DPA. If the Standard Contractual Clauses described in Section 11 apply and conflict with this DPA, the Standard Contractual Clauses prevail.

3. Roles

Customer is the controller of Customer Personal Data, or a processor acting for its own controller. Tessary is Customer’s processor, or sub-processor where Customer is a processor. Each party will comply with the Applicable Data Protection Law that applies to it.

Customer is responsible for the lawfulness of the Customer Personal Data it provides and of its instructions, including any notices and consents needed for Tessary to process that data under this DPA.

4. Instructions

Tessary processes Customer Personal Data only on Customer’s documented instructions, unless the law requires otherwise. In that case, Tessary will inform Customer of that legal requirement before processing, unless the law prohibits this.

Customer’s instructions are the Terms, any Order Form, this DPA, and Customer’s use and configuration of the Services. Additional instructions require Tessary’s written agreement. Tessary will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.

5. Confidentiality of personnel

Tessary ensures that persons it authorizes to process Customer Personal Data are bound by appropriate obligations of confidentiality.

6. Security

Tessary implements appropriate technical and organizational measures to protect Customer Personal Data, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, and the risks to individuals. Annex 2 describes these measures in general terms. Tessary may update its measures from time to time, as long as they continue to meet Applicable Data Protection Law. Any specific security commitments are set in an Order Form.

7. Sub-processors

Customer gives Tessary general authorization to engage Sub-processors. Annex 3 lists the categories of Sub-processors. A list of the named Sub-processors is available on request to support@tessary.ai. That list is the agreed list of Sub-processors for the SCCs and the UK Addendum.

Tessary imposes data protection obligations on each Sub-processor by written contract, to the extent required by Applicable Data Protection Law, and remains responsible for its Sub-processors as that law requires. Tessary will give at least 30 days’ notice before it adds or replaces a Sub-processor. Customer may object within that period on reasonable data protection grounds. If the parties cannot resolve an objection, Customer may end the affected Hosted Services, and Tessary will refund any prepaid fees for the unused part of the term for those services.

8. Assistance

Data subject requests. Taking into account the nature of the processing, Tessary assists Customer by appropriate technical and organizational measures, as far as possible, to respond to requests from data subjects to exercise their rights. If Tessary receives such a request directly, it will refer the data subject to Customer and will not respond further unless the law requires it.

Other assistance. Taking into account the nature of the processing and the information available to it, Tessary provides reasonable assistance with Customer’s obligations on security, personal data breach notification, data protection impact assessments, and prior consultation with supervisory authorities, as Applicable Data Protection Law requires. Tessary may charge for assistance beyond what the Services provide, where the law permits.

9. Personal data breaches

Tessary will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Tessary will provide information reasonably available to it to help Customer meet its own obligations. Notice of a breach is not an admission of fault or liability.

10. Deletion and return

When the Hosted Services end for Customer, Tessary will delete or return Customer Personal Data within a reasonable period, at Customer’s choice, unless the law requires Tessary to keep it. Customer can request an export before deletion by emailing support@tessary.ai. Backups are overwritten in the normal backup cycle. Until then, they stay protected under this DPA and are not used for any other purpose.

11. International transfers

Tessary is based in India, and Tessary and its Sub-processors may process Customer Personal Data outside the country where Customer is located. Where Applicable Data Protection Law requires a transfer mechanism for a transfer of Customer Personal Data to Tessary, the following apply and are incorporated into this DPA by reference:

EU transfers. The Standard Contractual Clauses adopted by European Commission Implementing Decision (EU) 2021/914 (“SCCs”), Module 2 (controller to processor) where Customer is a controller, and Module 3 (processor to processor) where Customer is a processor. Customer is the data exporter and Tessary is the data importer. For the SCCs: the optional docking clause in Clause 7 does not apply; under Clause 9, Option 2 (general written authorization) applies, as described in Section 7 of this DPA; the optional wording in Clause 11 does not apply; under Clause 17, Option 2 applies, and where the law of the data exporter’s EU Member State does not allow third-party beneficiary rights, the law of Ireland applies; under Clause 18, disputes are resolved by the courts of the Member State whose law governs under Clause 17; and Annexes I, II, and III of the SCCs are completed with Annexes 1, 2, and 3 of this DPA.
UK transfers. The International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (“UK Addendum”). Tables 1 to 3 of the UK Addendum are completed with the information in this DPA and its Annexes, and for Table 4, the importer may end the UK Addendum as its Section 19 allows.

The audit and information rights under the SCCs are met as described in Section 12 of this DPA, to the extent the SCCs allow.

12. Information and audits

Tessary will make available to Customer the information that Applicable Data Protection Law requires to demonstrate compliance with this DPA. Tessary will allow and contribute to audits, including inspections, only to the extent Applicable Data Protection Law requires, and otherwise as agreed in an Order Form. Customer must give reasonable notice of an audit, bear its costs, keep the information it receives confidential, and limit the audit to what is needed to verify compliance.

13. Liability and term

Each party’s liability under this DPA is subject to the exclusions and limits in the Terms, to the extent Applicable Data Protection Law allows. This DPA remains in effect for as long as Tessary processes Customer Personal Data on the Hosted Services.

14. Changes

Tessary may update this DPA. Tessary will update the dates above and provide notice of material changes as required by law. Each version of this DPA applies from its Last updated date.

Annex 1: Description of the processing

Parties. Data exporter: Customer, as identified in its account or Order Form, acting as controller or processor. Data importer: Tessary Software Private Limited, Bengaluru, Karnataka, India, acting as processor or sub-processor. Contact: support@tessary.ai.

Subject matter. Providing the Hosted Services to Customer under the Terms.

Nature of the processing. Collecting, storing, organizing, analyzing (including with large language models), transmitting, displaying, supporting, and deleting Customer Personal Data, as needed to provide the Hosted Services.

Purpose. To provide, secure, and support the Hosted Services and the features Customer chooses to use, as instructed under Section 4.

Categories of data subjects. Individuals whose personal data Customer includes in Customer Data, which may include, for example, Customer’s end users and other people who interact with Customer’s agents, and Customer’s personnel or contractors whose information appears in traces, code, or other content.

Categories of personal data. Any personal data that Customer includes in Customer Data, which Customer determines. This may include, for example, names, contact details, identifiers, the content of messages, prompts, and responses, and technical data.

Sensitive data. None intended. Under the Terms, Customer must not send sensitive personal data unless Tessary agrees in writing.

Frequency. Continuous, while Customer uses the Hosted Services.

Duration and retention. For the term of Customer’s use of the Hosted Services, and then until deletion under Section 10. Retention during the term follows the plan details, product settings, or Order Form.

Transfers to Sub-processors. To the categories of Sub-processors in Annex 3, for the same subject matter, nature, and purpose, for as long as needed to provide their services to Tessary.

Competent supervisory authority. The authority determined under Clause 13 of the SCCs, where they apply.

Annex 2: Security measures

Tessary’s technical and organizational measures may include, for example:

access to Customer Personal Data limited to personnel and systems that need it;
authentication and access controls;
encryption of data in transit and protection of credentials and other sensitive data at rest;
isolation of customer environments and of environments used to run AI Features;
logging and monitoring of systems;
backup and recovery;
vulnerability management and security updates; and
confidentiality obligations for personnel.

Tessary may change these measures as described in Section 6. Any specific security commitments are set in an Order Form.

Annex 3: Sub-processor categories

For the Hosted Services, Tessary uses Sub-processors in these categories:

hosting and infrastructure;
isolated code execution sandboxes;
authentication;
model providers used by Tessary;
logging and monitoring;
customer support chat and messaging; and
analytics.

A list of the named Sub-processors is available on request to support@tessary.ai. These categories apply to the services Tessary hosts. They do not apply to self-hosted installations, or to model providers or other services that Customer uses with its own keys or accounts.

Contact

Tessary Software Private Limited
CIN: U62099KA2026PTC218247
Email: support@tessary.ai