Legal

Data Processing Addendum

Version 1.2. Effective October 16, 2026.

This addendum covers personal data that belongs to your business and that we handle while we build, test, support and maintain your AI system. You decide why and how that data is used, and we act only on your instructions. We keep it confidential, protect it with the measures listed in Annex 1, tell you about any breach within 72 hours, help you answer requests from individuals, and delete or return the data when our work ends. It forms part of our Terms of Use, so you do not need to sign anything separately.

1. Who we are and when this addendum applies

This website is operated by UPMARK, a sole proprietorship owned by Amit Govil, trading as Upmark Labs, 3/3 B, Saket Nagar, Bhopal, Madhya Pradesh 462024, India (“we”, “us”, “our”). “You” means the business that places an order with us.

This Data Processing Addendum (“Addendum”) applies whenever we process Customer Personal Data while providing the Services. It forms part of the Terms of Use and applies automatically to every order. When you accept the Terms of Use at checkout, you also accept this Addendum.

This Addendum does not cover personal data we collect for our own purposes, such as website, account, order and request data. We are the controller of that data, and our Privacy Policy explains how we handle it.

2. Definitions

Words with capital letters have the meanings below. Other capitalized words have the meanings given in the Terms of Use.

Controller means the party that decides why and how personal data is processed. It includes a “data fiduciary”, “business” or similar term under Data Protection Laws.
Processor means the party that processes personal data on behalf of a Controller. It includes a “data processor”, “service provider”, “contractor” or similar term under Data Protection Laws.
Customer Personal Data means any personal data that we process on your behalf while providing the Services. This includes personal data in the information and files you give us and personal data in the systems you give us access to.
Data Protection Laws means all laws on privacy and personal data that apply to the processing of Customer Personal Data. Depending on the facts, this may include the Digital Personal Data Protection Act, 2023 of India, the EU General Data Protection Regulation 2016/679 (“GDPR”), the GDPR as it forms part of UK law (“UK GDPR”), the UK Data Protection Act 2018, and US state privacy laws such as the California Consumer Privacy Act.
Data Subject means the identified or identifiable individual that personal data relates to.
Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data that we, or our Subprocessors, process.
Services means the work we do for you under an order: intake, building, connecting, testing, delivery, revisions, post-launch support, any accepted Change Quote, any maintenance and any monthly service.
Scope Card means the description of what is included in a product, as shown on the product page and in force when you placed the order.
Subprocessor means a third party that we engage and that processes Customer Personal Data on our behalf.
Your Providers means the third-party services that you contract with directly and that your AI system runs on or connects to, such as AI model providers, CRM, helpdesk, store, telephony and WhatsApp providers.
SCCs means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914, as amended or replaced from time to time.
UK Addendum means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the UK Data Protection Act 2018, as amended or replaced from time to time.
Restricted Transfer means a transfer of Customer Personal Data from a country to another country that Data Protection Laws allow only with appropriate safeguards.

3. Roles of the parties

For Customer Personal Data, you are the Controller and UPMARK, a sole proprietorship owned by Amit Govil, trading as Upmark Labs, is your Processor.

If you act as a Processor for someone else, for example your own client, then we act as your sub-processor. In that case you confirm that the Controller has authorized you to appoint us on the terms of this Addendum, and you are responsible for passing on any instructions and notices between us and that Controller.

Your Providers are your own processors or independent providers. They are not our Subprocessors. You choose them, you hold the contracts with them, and they bill you directly. We work inside the accounts you create with them. You are responsible for having suitable data protection terms in place with each of Your Providers.

4. Details of the processing

4.1 Subject matter

The subject matter is the processing of Customer Personal Data needed to build, test, deliver, support and maintain the AI system described on the Scope Card of your order.

4.2 Duration

We process Customer Personal Data for as long as we provide the Services. This runs from the order until the end of the post-launch support period, or until the end of any maintenance or monthly service you have. It then continues only for as long as it takes to delete or return the data under section 14.

4.3 Nature and purpose

The nature of the processing includes accessing, viewing, organizing, structuring, configuring, testing with, transmitting, storing for a limited time, and deleting Customer Personal Data. Most of this happens inside your own systems and Your Providers’ accounts, through the user accounts and keys you give us.

The purposes are to:

review the information and files you supply at intake;
connect your AI system to the systems listed on the Scope Card;
build and configure workflows, prompts, knowledge sources and integrations;
test the AI system, including with sample records and conversations;
fix defects, answer your questions and make changes during support, maintenance and any monthly service; and
carry out any other processing you instruct in writing under section 5.

We do not use Customer Personal Data for our own purposes. We do not use it to train or improve any AI model, and we do not use our own AI provider accounts to process it. AI model usage runs in your own provider accounts.

4.4 Categories of Data Subjects and personal data

The exact data depends on the product you order and the systems you connect. The table shows the categories we expect.

Data Subjects	Categories of personal data
Your customers and end users	Names, contact details (email, phone, messaging handles), account and customer identifiers, order, booking and transaction details, support tickets, and the content of messages, chats, emails and calls handled by the connected systems.
Your leads and prospects	Names, contact details, company and job details, enquiry content, and CRM records such as stage, notes and activity history.
Your staff and contractors	Names, work contact details, user account details, roles, and their actions and notes in the connected systems.
Other individuals in your records	Any other personal data that appears in the knowledge sources, sample data or systems you give us access to.

4.5 Special categories of data

The Services are not designed to process special categories of personal data, such as health, biometric, genetic or religious data, or other sensitive data such as financial account numbers, government identifiers or data about children. Do not give us access to such data unless it is needed for your order. If it is needed, tell us in writing before we start, and we will agree any additional safeguards in writing. You remain responsible for having a lawful basis for that processing.

5. Your instructions

We process Customer Personal Data only on your documented instructions, unless the law requires otherwise. If the law requires us to process it in another way, we will tell you first, unless that law prohibits us from doing so.

Your documented instructions are:

the Terms of Use and this Addendum;
your order and its Scope Card, including any accepted Change Quote; and
any other reasonable written instructions you give us by email or through your account during the Services.

Instructions that go beyond the Scope Card are new requirements. We may send a Change Quote for them, as described in the Terms of Use.

We will tell you promptly if, in our opinion, an instruction breaks Data Protection Laws. We may pause the affected processing until you confirm or change the instruction.

6. Your responsibilities

You are responsible for:

having a lawful basis for the processing and giving Data Subjects any notices required by Data Protection Laws;
making sure your instructions comply with Data Protection Laws;
giving us access only to the personal data we need for the order, and using test or sample data where it is enough;
creating the user accounts and keys we use, scoping them to the access we need, and revoking them when you choose;
the configuration, security and data protection terms of Your Providers; and
reviewing the outputs of your AI system, as described in the Terms of Use and our AI Usage Policy.

7. Confidentiality of our personnel

We allow access to Customer Personal Data only to the people who need it to deliver the Services. Each of them has an individual account. Each of them is bound by a written duty of confidentiality or a legal duty of confidentiality. These duties continue after they stop working with us.

We may use vetted subcontractors, as described in the Terms of Use. A subcontractor that processes Customer Personal Data is a Subprocessor and section 9 applies. We remain responsible for our subcontractors.

8. Security

We apply the technical and organizational measures described in Annex 1 to protect Customer Personal Data. When choosing these measures we take into account the nature of the Services, the fact that your data stays mainly in your own systems, and the risks to Data Subjects.

You are responsible for the security of your own systems and Your Providers’ accounts, including the permissions you grant us. Our Security page gives more detail on how we work.

9. Subprocessors

9.1 Authorization

You give us general authorization to engage Subprocessors. Our current Subprocessors are listed on our Subprocessors page.

9.2 Our duties

Before a Subprocessor processes Customer Personal Data, we put a written contract in place with it. That contract contains data protection obligations that give at least the same level of protection as this Addendum. We remain fully responsible to you for each Subprocessor’s performance of its obligations.

9.3 Notice of changes

We will give you at least 14 days’ notice before we add or replace a Subprocessor. We will do this by updating the Subprocessors page and by emailing the email address on your account.

9.4 Your right to object

You may object to a new Subprocessor on reasonable data protection grounds. To do so, email hello@upmarklabs.com within 14 days of our notice and explain your reasons. We will discuss your objection with you in good faith. We may offer a reasonable alternative, such as not using that Subprocessor for your Customer Personal Data. If we cannot resolve your objection, you may end the affected Services by written notice. Any refund follows our Refund and Cancellation Policy.

10. Data Subject requests

If a Data Subject contacts us directly about Customer Personal Data, we will forward the request to you without undue delay. We will not answer it ourselves, except to tell the person that we have passed it to you, unless you instruct us otherwise.

Most Customer Personal Data stays in your own systems, so you can usually act on requests yourself. Where you cannot, we will help you, taking into account the nature of the processing, by reasonable technical and organizational measures. This includes helping you find, export, correct or delete Customer Personal Data that we can reach through the access you have given us. If the help you need goes well beyond what the Services include, we may send a Change Quote first.

11. Impact assessments and regulators

We will give you reasonable help with data protection impact assessments and with any prior consultation with a supervisory authority that Data Protection Laws require for the Services. We do this by giving you the information we hold about the processing, taking into account the nature of the processing and the information available to us.

If a public authority asks us for Customer Personal Data, we will refer it to you where we can. We will tell you about the request promptly, unless the law prohibits us from doing so. We will disclose only the data that we are legally required to disclose.

12. Personal Data Breaches

We will notify you without undue delay, and in any case within 72 hours, after we become aware of a Personal Data Breach. We will send the notice to the email address on your account.

As far as we know at the time, the notice will describe:

the nature of the breach, including the categories and approximate number of Data Subjects and records concerned;
the likely consequences of the breach;
the measures we have taken or propose to take to address the breach and reduce its effects; and
a contact point for more information.

If we cannot give all of this information at once, we will give it in stages without further undue delay. We will take reasonable steps to contain and investigate the breach, and we will work with you on any notices you must give to authorities or Data Subjects. Our notice is not an admission of fault or liability.

If you suspect a security problem involving our access to your systems, email hello@upmarklabs.com and revoke the affected accounts or keys.

13. International transfers

13.1 Where we process data

We are based in India and may access Customer Personal Data from India. Our Subprocessors process data in the locations shown on the Subprocessors page.

13.2 Transfers from the EU and EEA

Where a transfer of Customer Personal Data to us is a Restricted Transfer under the GDPR, the SCCs are incorporated into this Addendum by reference and apply as follows:

Module Two (controller to processor) applies where you are a Controller, and Module Three (processor to processor) applies where you are a Processor.
You are the data exporter and we are the data importer.
The optional docking clause in Clause 7 does not apply.
In Clause 9, Option 2 (general written authorization) applies, with the notice period set out in section 9.3.
The optional wording in Clause 11 does not apply.
In Clause 13, the competent supervisory authority is the one that applies to you as data exporter under that clause.
In Clauses 17 and 18, the governing law and courts are those of the EU member state where you are established. If you are not established in the EU, or that law does not allow for third-party beneficiary rights, they are those of Ireland.
Annex I of the SCCs is completed with the information in sections 1, 3 and 4 of this Addendum. Annex II is completed with Annex 1 of this Addendum. Annex III is completed with the Subprocessors page.

13.3 Transfers from the UK

Where a transfer is a Restricted Transfer under the UK GDPR, the UK Addendum is incorporated into this Addendum by reference and applies to the SCCs as set out in section 13.2. Table 1 of the UK Addendum is completed with the details of the parties in section 1 and your account. Tables 2 and 3 are completed with the information in section 13.2 and the annexes referred to there. In Table 4, either party may end the UK Addendum as allowed by its Section 19.

13.4 Other transfers

Where other Data Protection Laws require a transfer mechanism, we will work with you in good faith to put in place the mechanism those laws require. If we both agree in writing on a different lawful transfer mechanism, that mechanism will apply instead.

14. Deletion or return at the end

When the Services end, we will, at your choice, delete or return the Customer Personal Data we hold. You can tell us your choice by emailing hello@upmarklabs.com. If you do not tell us, we will delete it. Most Customer Personal Data stays in your own systems, so returning it usually means confirming that you already hold it.

When the engagement or support period ends, we will also remove our access to your systems on your request. You can revoke the user accounts and keys we use at any time without asking us.

We may keep Customer Personal Data only where the law requires us to. If we do, we will keep it confidential, protect it under this Addendum, and use it only for the purpose that law requires. On request, we will confirm in writing that deletion is complete.

15. Audits and information

On request, we will give you the information reasonably needed to show that we comply with this Addendum. We will start by answering your reasonable written questions.

If that information is not enough to show compliance, you may carry out an audit, or have an independent auditor do so, under these conditions:

You give us at least 30 days’ written notice, with the proposed scope and date.
Audits are limited to once a year, unless a supervisory authority requires an additional audit.
The audit is reasonable in scope, takes place during our normal working days and hours, and does not unreasonably disrupt our work for other customers.
The auditor is bound by a duty of confidentiality and is not our competitor.
You pay your own costs and the auditor’s costs. We may also charge you for our reasonable time spent supporting the audit, and we will tell you the estimate before the audit starts.
You give us a copy of the audit report and use it only to check compliance with this Addendum.

16. US state privacy laws

Where US state privacy laws apply, we act as your service provider or contractor. We will not sell or share Customer Personal Data, as those terms are defined in those laws. We will not retain, use or disclose it for any purpose other than providing the Services, or outside our direct business relationship with you. We will not combine it with personal data we receive from others, except as those laws allow. We will tell you if we can no longer meet these obligations.

17. Liability

Each party’s liability under this Addendum, including under the SCCs and the UK Addendum to the extent the law allows, is subject to the limits and exclusions of liability in the Terms of Use. Those limits apply to this Addendum and the Terms of Use together, not separately. Nothing in this Addendum limits the rights of Data Subjects under the SCCs or any liability that cannot be limited by law.

18. Order of precedence

If documents conflict on the processing of Customer Personal Data, they apply in this order, with the first taking priority:

the SCCs and the UK Addendum, where they apply;
this Addendum;
the Terms of Use; and
your order and its Scope Card.

On all other matters, the Terms of Use apply.

19. Term, changes and contact

This Addendum applies for as long as we process Customer Personal Data for you. Sections 12, 14, 15 and 17 continue to apply after the Services end, for as long as we hold any Customer Personal Data or as long as needed to complete them.

We may update this Addendum. A new version applies to orders placed after we publish it. The version you accepted with an order stays with that order. We may also update it where Data Protection Laws or the SCCs change, and we will tell you if we do.

This Addendum is governed by the laws of India, and disputes are resolved as set out in the Terms of Use, except where the SCCs or the UK Addendum require otherwise.

For questions about this Addendum, email hello@upmarklabs.com. To report a security issue, email hello@upmarklabs.com.

Annex 1. Security measures

These are the technical and organizational measures we apply to Customer Personal Data. They are completed by the security controls you and Your Providers apply to your own systems.

Access to your systems

We access your systems only through user accounts you invite us to, or API keys you create and control.
You can scope that access to least privilege and revoke it at any time.
Builds run in your own accounts. AI model usage runs in your own AI provider accounts, not ours.
We remove our access at the end of the engagement or support period on your request.

Handling of secrets

We never ask for passwords, keys or other secrets by plain email, and we never send them by plain email.

Our own systems and people

Our website uses HTTPS.
Administrative access to our systems is limited to named staff, each with an individual account.
Only people who need access to deliver the Services can access Customer Personal Data, and they are bound by confidentiality as described in section 7.

Use of data

We use Customer Personal Data only to deliver your order.
We do not use it to train or improve AI models or for any purpose of our own.

Reporting

Anyone can report a vulnerability or security concern to hello@upmarklabs.com.
We notify you of Personal Data Breaches as set out in section 12.

Version history

Version	Date	Change
1.2	October 16, 2026	Clarified that the website is operated by UPMARK, a sole proprietorship of Amit Govil.
1.1	October 14, 2026	Updated wording for maintenance and monthly services.
1.0	October 13, 2026	First published version.