The key legal terms of the DPA are as follows:
| Term | Description |
|---|---|
| Agreement | This Data Processing Agreement ("DPA") forms part of the Imentiv AI Terms of Service and sets out the terms under which Imentiv AI processes personal information on behalf of its users. |
| Approved Controller & Processors |
1. Name: Imentiv Inc. Country of location: USA Anticipated processing task: Manage cloud service |
| Approved Sub Processor |
2. Name: Asterbyte Software Systems Pvt Ltd Country of location: India Anticipated processing task: Manage cloud service |
| Provider Security Contact |
security@imentiv.ai security@asterbyte.com |
| Privacy & Security | As defined in the Terms of Service Agreement |
Service Provider Relationship
To the extent California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq ("CCPA") applies, the
parties acknowledge and agree that Provider is a service provider and is receiving Personal Data from
Customer to provide the Service as agreed in the Agreement and detailed below (see Nature and Purpose of
Processing), which constitutes a limited and specified business purpose. Provider will not sell or share
any Personal Data provided by Customer under the Agreement. In addition, Provider will not retain, use,
or disclose any Personal Data provided by Customer under the Agreement except as necessary for providing
the Service for Customer, as stated in the Agreement, or as permitted by Applicable Data Protection
Laws. Provider certifies that it understands the restrictions of this paragraph and will comply with all
Applicable Data Protection Laws. Provider will notify Customer if it can no longer meet its obligations
under the CCPA.
Governing Member State
EEA Transfers: Netherlands
UK Transfers: England and Wales
Data Controller & Processor
Name: the Customer signing this DPA
Activities relevant to transfer: See Annex 1(B)
Role: Controller & Processor
Data Controller, Processor, Sub-Processor
Name: the Provider signing this DPA
Contact person: Inderjeet Singh, CEO
Address: 22555 Salem Ave, Cupertino, California 95014, USA
Activities relevant to transfer: See Annex 1(B)
Role: Sub-Processor
Service
The Service is:
Imentiv AI is a cloud-based advanced Emotion AI platform comprising tools and APIs capable of analyzing
human emotions through facial expressions, voice tones, and textual inputs.
Categories of Data Subjects
Customer's end users or customers
Customer's employees
Categories of Personal Data
Video, audio or written text
Special Category Data
Is special category data (as defined in Article 9 of the GDPR) Processed?
Yes
Special Category Data Restrictions or Safeguards
See Terms of Services & Privacy Policy
Frequency of Transfer
Regular Transfer as per requirement of the Customer.
Nature and Purpose of Processing
Receiving data, including collection, accessing, retrieval, recording, and data entry
Holding data, including storage, organization, and structuring
Using data, including analysis, consultation, testing, automated decision making, and profiling
Updating data, including correcting, adaption, alteration, alignment, and combination
Protecting data, including restricting, encrypting, and security testing
Sharing data, including disclosure, dissemination, allowing access, or otherwise making available
Returning data to the data controller
Erasing data, including destruction and deletion
Duration of Sub-Processing
Provider will process Customer Personal Data as long as required (i) to conduct the Processing
activities instructed in Section 2.2(a)-(d) of the Standard Terms; or (ii) by Applicable Laws.
Competent Supervisory Authority
The supervisory authority will be the supervisory authority of the data exporter, as determined in
accordance with Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum.
Technical and Organizational Security Measures
See Security Policy
Protecting Customer Personal Data during transmission (in transit):
Use of encryption to protect data during transit Ensuring limited data retention:
The data is deleted upon user request
This Data Processing Agreement ("DPA") forms an integral part of and is incorporated by reference into the Terms of Service ("Terms") of the imentiv.ai website and platform. Capitalized terms not defined herein shall have the meaning assigned to them in the Terms.
This DPA applies to the extent imentiv.ai processes Personal Data in connection with the Services.
For the purposes of this DPA:
Depending on the nature of the Services and the data involved, imentiv.ai ("Provider") may act as:
Provider acts as a Data Controller where it independently determines the purposes and means of Processing, including but not limited to:
In all such cases, imentiv.ai shall manage and process the Personal Data in accordance with its Privacy Policy , this Data Protection Agreement and Applicable Data Protection Laws.
Provider acts as a Data Processor where it Processes Personal Data strictly on approved plan and it's instructions chosen by the Customer, including where:
In such cases, Customer shall be the Data Controller.
Provider or it's affiliate/subsidiaries/vendors acts as a Sub-Processor where the Processor's affiliate/subsidiaries/vendors Processes Personal Data on behalf of the Customer.
In such cases, Provider shall:
The Customer represents and warrants that:
Consent to Processing. Customer has complied with and will continue to comply with all Applicable Data Protection Laws concerning its provision of Customer Personal Data to Provider and/or the Service, including making all disclosures, obtaining all consents, providing adequate choice, and implementing relevant safeguards required under Applicable Data Protection Laws.
Where provider acts as a Processor or Sub-Processor:
imentiv.ai shall ensure that persons authorized to Process Personal Data:
imentiv.ai shall implement appropriate technical and organizational measures to protect Personal Data, including:
7.1 Customer grants general authorization for imentiv.ai to engage Sub-Processors.
7.2 Provider shall:
7.3. Provider will inform Customer at least 10 business days in advance and in writing of any intended changes to the Approved Subprocessors whether by addition or replacement of a Subprocessor, which allows Customer to have enough time to object to the changes before the Provider begins using the new Subprocessor(s). Provider will give Customer the information necessary to allow Customer to exercise its right to object to the change to Approved Subprocessors. Customer has 30 days after notice of a change to the Approved Subprocessors to object, otherwise Customer will be deemed to accept the changes. If Customer objects to the change within 30 days of notice, Customer and Provider will cooperate in good faith to resolve Customer's objection or concern.
When engaging a Subprocessor, Provider will have a written agreement with the Subprocessor that ensures the Subprocessor only accesses and uses Customer Personal Data (i) to the extent required to perform the obligations subcontracted to it, and (ii) consistent with the terms of Agreement.
If the GDPR applies to the Processing of Customer Personal Data, (i) the data protection obligations described in this DPA (as referred to in Article 28(3) of the GDPR, if applicable) are also imposed on the Subprocessor, and (ii) Provider's agreement with the Subprocessor will incorporate these obligations, including details about how Provider and its Subprocessor will coordinate to respond to inquiries or requests about the Processing of Customer Personal Data. In addition, Provider will share, at Customer's request, a copy of its agreements (including any amendments) with its Subprocessors. To the extent necessary to protect business secrets or other confidential information, including personal data, Provider may redact the text of its agreement with its Subprocessor prior to sharing a copy.
Provider remains fully liable for all obligations subcontracted to its Subprocessors, including the acts and omissions of its Subprocessors in Processing Customer Personal Data. Provider will notify Customer of any failure by its Subprocessors to fulfill a material obligation about Customer Personal Data under the agreement between Provider and the Subprocessor.
Where Personal Data is transferred outside the jurisdiction of origin, imentiv.ai shall ensure appropriate safeguards, including:
Authorization. Customer agrees that Provider may transfer Customer Personal Data outside the EEA, the United Kingdom, or other relevant geographic territory as necessary to provide the Service. If Provider transfers Customer Personal Data to a territory for which the European Commission or other relevant supervisory authority has not issued an adequacy decision, Provider will implement appropriate safeguards for the transfer of Customer Personal Data to that territory consistent with Applicable Data Protection Laws.
Ex-EEA Transfers. Customer and Provider agree that if the GDPR protects the transfer of Customer Personal Data, the transfer is from Customer from within the EEA to Provider outside of the EEA, and the transfer is not governed by an adequacy decision made by the European Commission, then by entering into this DPA, Customer and Provider are deemed to have signed the EEA SCCs and their Annexes, which are incorporated by reference. Any such transfer is made pursuant to the EEA SCCs, which are completed as follows:
Ex-UK Transfers. Customer and Provider agree that if the UK GDPR protects the transfer of Customer Personal Data, the transfer is from Customer from within the United Kingdom to Provider outside of the United Kingdom, and the transfer is not governed by an adequacy decision made by the United Kingdom Secretary of State, then by entering into this DPA, Customer and Provider are deemed to have signed the UK Addendum and their Annexes, which are incorporated by reference. Any such transfer is made pursuant to the UK Addendum, which is completed as follows:
Other International Transfers. For Personal Data transfers where Swiss law (and not the law in any EEA member state or the United Kingdom) applies to the international nature of the transfer, references to the GDPR in Clause 4 of the EEA SCCs are, to the extent legally required, amended to refer to the Swiss Federal Data Protection Act or its successor instead, and the concept of supervisory authority will include the Swiss Federal Data Protection and Information Commissioner.
Where imentiv.ai acts as a Processor or Sub-Processor, it shall reasonably assist the Customer in responding to Data Subject requests, including requests for access, deletion, or restriction.
imentiv.ai shall not respond directly to Data Subjects unless legally required or instructed.
Upon becoming aware of any Security Incident, Provider will: (a) notify Customer without undue delay when feasible, but no later than 72 hours after becoming aware of the Security Incident; (b) provide timely information about the Security Incident as it becomes known or as is reasonably requested by Customer; and (c) promptly take reasonable steps to contain and investigate the Security Incident. Provider's notification of or response to a Security Incident as required by this DPA will not be construed as an acknowledgment by Provider of any fault or liability for the Security Incident.
The Provider shall retain and process Personal Data only for such period as is reasonably necessary to perform its obligations under the Terms of Service and this Data Processing Agreement, unless the retention period is required or permitted under applicable law, regulation, contractual obligation, or lawful order of a governmental or regulatory authority.
Upon receipt of a written request from the Customer, the Provider shall, subject to this clause, use commercially reasonable efforts to delete the Personal Data processed on behalf of the Customer. The Customer acknowledges and agrees that the Provider may retain Personal Data to the extent required for compliance with applicable laws, statutory retention requirements, accounting, tax, audit, dispute resolution, enforcement of contractual rights, or legitimate internal business purposes.
The Provider shall, upon reasonable written request, provide confirmation of deletion of Personal Data; however, such confirmation shall be limited to a statement of compliance with this clause and shall not require the Provider to disclose its internal systems, processes, or security measures.
Where applicable, imentiv.ai acts as a Service Provider and:
Provider shall make available information reasonably necessary to demonstrate compliance with this DPA, subject to confidentiality and security obligations.
Audit Rights. Provider will give Customer all information reasonably necessary to demonstrate its compliance with this DPA and Provider will allow for and contribute to audits, including inspections by Customer, to assess Provider's compliance with this DPA. However, Provider may restrict access to data or information if Customer's access to the information would negatively impact Provider's intellectual property rights, confidentiality obligations, or other obligations under Applicable Laws. Customer acknowledges and agrees that it will only exercise its audit rights under this DPA and any audit rights granted by Applicable Data Protection Laws by instructing Provider to comply with the reporting and due diligence requirements below. Provider will maintain records of its compliance with this DPA for 3 years after the DPA ends.
Security Reports. Customer acknowledges that Provider is regularly audited against the standards defined in the Security Policy by independent third-party auditors. Upon written request, Provider will give Customer, on a confidential basis, a summary copy of its then-current Report so that Customer can verify Provider's compliance with the standards defined in the Security Policy.
Security Due Diligence. In addition to the Report, Provider will respond to reasonable requests for information made by Customer to confirm Provider's compliance with this DPA, including responses to information security, due diligence, and audit questionnaires, or by giving additional information about its information security program. All such requests must be in writing and made to the Provider Security Contact and may only be made once a year.
Response to Inquiries. If Provider receives any inquiry or request from anyone else about the Processing of Customer Personal Data, Provider will notify Customer about the request and Provider will not respond to the request without Customer's prior consent. Examples of these kinds of inquiries and requests include a judicial or administrative or regulatory agency order about Customer Personal Data where notifying Customer is not prohibited by Applicable Law, or a request from a data subject. If allowed by Applicable Law, Provider will follow Customer's reasonable instructions about these requests, including providing status updates and other information reasonably requested by Customer. If a data subject makes a valid request under Applicable Data Protection Laws to delete or opt out of Customer's giving of Customer Personal Data to Provider, Provider will assist Customer in fulfilling the request according to the Applicable Data Protection Law. Provider will cooperate with and provide reasonable assistance to Customer, at Customer's expense, in any legal response or other procedural action taken by Customer in response to a third-party request about Provider's Processing of Customer Personal Data under this DPA.
DPIAs and DTIAs. If required by Applicable Data Protection Laws, Provider will reasonably assist Customer in conducting any mandated data protection impact assessments or data transfer impact assessments and consultations with relevant data protection authorities, taking into consideration the nature of the Processing and Customer Personal Data.
Liability arising under this DPA shall be subject to the limitations of liability set forth in the Terms of Service, except where prohibited by Applicable Data Protection Laws.
This DPA shall be governed by the law specified in the Terms of Service.
In the event of conflict, this DPA shall prevail with respect to data protection matters.
This DPA forms part of the Terms of Service. If there is any inconsistency between this DPA, the Agreement, or any of their parts, the part listed earlier will control over the part listed later for that inconsistency: (1) the EEA SCCs or the UK Addendum or any applicable Data Protection Laws, (2) this DPA, and then (3) the Terms of Service.
This DPA is effective upon acceptance of the Terms of Service.