Data processing addendum

This page summarises the Data Processing Addendum (“DPA”) that governs Automis's processing of personal data on behalf of customers acting as Data Fiduciary / Controller. The full DPA is part of your master services agreement and, where requested, can be executed as a standalone document.

1. Roles and processing instructions

Automis processes personal data solely on documented instructions from the customer, as set out in the master services agreement, the ordered products, and the configuration of the tenant workspace (automation levels, policies, retention settings).

2. Technical and organisational measures

• AES-256-GCM at rest for credentials and sensitive fields
• TLS 1.2+ in transit
• Argon2id for password hashing
• Role-based access control + principle of least privilege for Automis personnel
• Certification status to be verified during customer procurement
• Audit trail on data-mutating requests where backend audit middleware is enabled

3. Sub-processors

A list of sub-processors is maintained and communicated at least 30 days in advance of any change. Customers may object to a new sub-processor within the 30-day window in accordance with the master services agreement.

4. Cross-border transfers

Automis processes customer data in India. We do not transfer personal data outside India unless explicitly authorised by the customer (for example, to enable a BYOM arrangement with a foreign SI provider). In such cases, appropriate safeguards are in place including standard contractual clauses and tenant-level approval.

5. Data subject rights requests

Automis provides tooling within the tenant workspace to help customers fulfil Data Principal / Data Subject requests (access, rectification, erasure, portability). On receiving a request directly, Automis will refer the requester to the relevant customer and notify the customer within the contractual and legally required timeframe.

6. Incident notification

In the event of a personal data breach, Automis will notify the affected customer without undue delay according to the signed agreement and applicable law, with a written report covering nature, impact, and remediation.

7. Return / deletion of data

On termination or expiry, customers may export their data via the workspace or API. At the customer's written request, Automis will delete customer data within 30 days, except where retention is required by law, where such retention is secured and purpose- limited.

To request the full DPA as a PDF or to negotiate terms, email legal@automis.com.