1. Scope and roles
This agreement applies when Olkara ("Processor") processes personal data on behalf of a customer ("Customer") through Olkara. The Customer is the controller (Data Fiduciary under India's DPDP Act; "business" under US state privacy laws); we are the processor (Data Processor; "service provider"). It forms part of the Terms of Service.
2. Details of processing
3. Instructions
We process Customer personal data only on the Customer's documented instructions (the Terms, the Customer's configuration of the service, and written requests), unless the law requires otherwise, in which case we will tell the Customer first where allowed. We will not sell it, use it to train shared AI models, or use it for our own purposes beyond providing, securing and supporting the service.
4. Confidentiality
Everyone who can access Customer personal data is bound by confidentiality, and access is limited to what their role needs.
5. Security measures
- Encryption in transit (TLS 1.2+) and at rest, including recordings.
- Logical separation of each customer's data, enforced in the application and database (row-level security).
- Role-based access with two-step verification; support access to a customer workspace is time-limited, requires a recorded reason and is logged.
- Data stored in the workspace's home region (India or United States).
- Backups, monitoring, vulnerability management and an incident response process.
- Customer-controlled retention for recordings and transcripts.
6. Subprocessors
The Customer authorises the subprocessors listed on our Subprocessors page. We impose data protection terms on each that are at least as protective as this agreement and remain responsible for them. We will give at least 30 days' notice of a new subprocessor (by updating the page and emailing account owners who subscribe). The Customer may object on reasonable data protection grounds; if we cannot address the objection, the Customer may close the affected service and receive a refund of unused purchased credits.
7. Assistance
We will help the Customer respond to requests from data subjects (access, correction, deletion, opt-out), with security, breach notifications and data protection impact assessments, taking into account the nature of the processing. If a data subject contacts us directly about Customer data, we will pass the request to the Customer.
8. Personal data breaches
We will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a breach affecting Customer personal data, with the information the Customer needs to meet its own obligations, and we will take reasonable steps to contain it.
9. Return and deletion
The Customer can export its data at any time and for 30 days after closing its account. After that we delete Customer personal data within 60 days, including from active systems, and from backups as they cycle out, unless the law requires us to keep it.
10. Audits
We will make available the information needed to show compliance with this agreement, including security documentation and, once available, independent audit reports. On-site audits can be arranged once a year on reasonable notice, at the Customer's cost, unless required by a regulator or after a breach.
11. International transfers
Where Customer personal data is transferred from the EU, UK or another country with transfer rules, the parties agree to the applicable Standard Contractual Clauses or equivalent safeguards, which are incorporated by reference. Transfers from India follow any restrictions notified under the DPDP Act.
12. Contact
Data protection questions or a countersigned copy: privacy@olkara.com.