Data Processing Addendum

1. Roles

The customer is the controller. Surge Software Solutions Private Limited ("Surge"), Bengaluru, India, is the processor and processes personal data only on the customer's documented instructions, which are the customer's use of the service and these terms.

2. Scope

Personal data the customer puts into BrandInAIAnswers: account and team member names and email addresses, any personal data inside prompts, brand and competitor details, uploaded server logs (which may contain IP addresses and user agents) and AI referral visits. It is processed for as long as the customer uses the service, to provide AI visibility tracking, analysis, fix writing, alerts and reports.

3. Confidentiality

Only Surge staff who need access to run and support the service can reach customer data, and they are bound by confidentiality.

4. Security measures

Surge keeps appropriate technical and organisational measures in place, described on the security page.

5. Subprocessors

The customer authorises the subprocessors listed on the subprocessors page. Surge will email the customer 14 days before adding or replacing a subprocessor; the customer may object on reasonable grounds within that time, and if we cannot resolve it, may stop using the service. Surge stays responsible for its subprocessors.

6. Personal data breaches

Surge will notify the customer without undue delay after becoming aware of a personal data breach affecting the customer's data, with a target of 72 hours, and will share what is known and the steps taken.

7. Help with requests and obligations

Surge will help the customer answer data-subject requests (access, correction, deletion, export) and, where reasonable, with data protection impact assessments and regulator questions.

8. Deletion or return

At the end of the service, or on request, Surge will delete the customer's data, or return it first as CSV exports if the customer asks, unless the law requires us to keep it. A workspace owner can also delete a brand and all its data at any time in Settings.

9. International transfers

Customer data is processed in India and by the providers listed on the subprocessors page, some of them outside India. Standard Contractual Clauses are available on request.

10. Audits

Surge will make available the information reasonably needed to show compliance with this addendum and answer the customer's written questions.

Countersigned copy

Email [email protected] for a countersigned copy of this addendum.

• Processor: Surge Software Solutions Private Limited, Bengaluru, India
• Contact: [email protected]