Data Processing Addendum

How this DPA works

This DPA forms part of the agreement between you (the customer) and Embiro Technologies (U) Limited for the Yadi service. It applies where we process personal data on your behalf and the Data Protection and Privacy Act, 2019 (the “Act”) applies. If it conflicts with the rest of the agreement on data protection, this DPA prevails.

Words we use

“Controller”, “processor”, “personal data”, “data subject”, and “processing” have the meanings given in the Act. “Customer data” means the personal data we process on your behalf to provide Yadi.

Roles

For customer data, you are the controller and we are the processor. You are responsible for the lawfulness of the data you put into Yadi and the instructions you give. We process customer data only to provide the service.

Our instructions

We process customer data only on your documented instructions — including the tasks, automations, and integrations you configure — unless the law requires otherwise, in which case we will tell you unless the law forbids it.

Our commitments as processor

• Process customer data only on your instructions, for the purposes in Annex 1.
• Keep customer data confidential and bind our staff to confidentiality.
• Apply the security measures in Annex 3.
• Help you respond to data-subject requests and meet your own duties under the Act, including security, breach notification, and any impact assessments.
• Make available the information you reasonably need to show compliance.
• Delete or return customer data at the end of the service, as set out below.

Subprocessors

You authorize us to use the subprocessors listed in Annex 2 to provide the service. We bind each to data-protection terms no less protective than this DPA and remain responsible for their performance. We will give you notice before adding or replacing a subprocessor so you can object on reasonable data-protection grounds.

Sending data outside Uganda

Providing the service involves transferring customer data outside Uganda, mainly to the United States, to the subprocessors in Annex 2. We rely on section 19 of the Act: your authorization and contracts requiring each subprocessor to protect the data to a comparable standard.

Personal data breach

If we become aware of a breach affecting customer data, we will notify you without undue delay, share what we know, and help you meet your notification duties to the Personal Data Protection Office and to affected people under the Act.

Data-subject requests

If a data subject contacts us about customer data, we will refer them to you and will not respond directly unless you tell us to. We will help you respond within the time the Act allows.

Audits

On reasonable request and notice, no more than once a year unless the Act or a regulator requires otherwise, we will give you the information needed to confirm our compliance with this DPA, subject to confidentiality.

Deleting or returning data

When the service ends, we will delete or, at your choice, return customer data within 30 days, except where the law requires us to keep specific records.

Liability and term

This DPA lasts as long as we process customer data. Liability under it is subject to the limits in the main agreement.

Annex 1 — Details of processing

• Subject matter — providing the Yadi service.
• Duration — the term of the agreement, plus the deletion window above.
• Nature and purpose — hosting, processing, and acting on customer data to run the AI teammates and the tasks you configure.
• Types of personal data — identity and contact details; the content of emails, messages, calendar events, files, and meeting transcripts you connect or upload; usage and log data; and billing data. This may include special personal data where it appears in that content.
• Categories of data subjects — your team members, and the people they communicate with or refer to, including customers, contacts, and meeting participants.

Annex 2 — Subprocessors

Annex 3 — Security measures

• Encryption of customer data in transit and at rest.
• Brokered credentials — OAuth tokens are held by our broker, never by us, and the AI never sees raw tokens.
• Scoped access — a teammate reaches only the tools you grant, and you can revoke any connection in one click.
• Workspace isolation — each workspace’s data is segregated; one workspace’s data never appears in another’s results.
• Human-in-the-loop — external messages and money movements require explicit approval.
• An append-only audit log of every tool run, approval, and automated action.
• Role-based, least-privilege access for our own staff.
• Daily spend controls that cap AI usage.
• Secrets management, environment isolation, and regular review of access and subprocessors.