Data Processing Agreement

Last updated: 21 September 2026

This Data Processing Agreement ("DPA") is part of the agreement between you and us, GainTrace (operated by Girasol Technologies LLP), under our Terms of Service (the "Terms"). It sets out how we process the personal data in your Customer Data on your behalf, the safeguards that cover international transfers, and the security measures we maintain. It applies automatically to every GainTrace subscription, so you do not need to sign anything for it to protect you.

Version 1.0, effective 21 September 2026.

The "In short" lines throughout are a plain-language guide to help you read quickly. They are not the full terms. If anything in a summary seems to differ from the section it sits above, the full text of that section is what applies.

1. How this DPA applies

In short: this DPA becomes part of your GainTrace agreement when you accept our Terms. It covers the personal data in your Customer Data, and we will countersign a copy if you need one.

1.1 Part of your agreement

When you accept the Terms, sign an Order Form that points to them, or use the Service under them, you also enter into this DPA, and it forms part of the Terms (Section 5.5 of the Terms). It applies from 21 September 2026, or from the date you first accept the Terms if that is later, and covers every subscription you hold with us.

1.2 What it covers

This DPA applies whenever we process Customer Personal Data on your behalf to provide the Service. It does not cover personal data we process for our own purposes as a controller, such as data about visitors to our website, our marketing contacts, our billing records, and the account, sign-in, product-analytics and support data of Authorized Users. Our Privacy Policy covers that data.

1.3 A countersigned copy

If your procurement process needs a signed copy, email [email protected] and we will countersign this DPA. A signed copy carries the same terms as the version published here on the date it is signed.

1.4 The parties

"You" means the customer that accepted the Terms or signed an Order Form. "We", "us" and "GainTrace" mean Girasol Technologies LLP, a limited liability partnership organised under the laws of India (LLPIN ACZ-1487), which operates GainTrace. Annex I.A gives both parties' details.

2. Definitions

In short: words defined in our Terms mean the same here, and a few data protection terms are added.

Capitalised terms that are not defined in this DPA have the meaning given in the Terms, including Authorized User, Customer Data, De-identified and Aggregated Data, Integration, Order Form, Outputs, Prohibited Data, Security Incident, Service, Sub-processor and Third-Party Service. In this DPA:

"CCPA" means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its regulations.
"Customer Personal Data" means personal data within Customer Data that we process on your behalf in providing the Service.
"Data Protection Laws" means the laws on privacy and personal data that apply to our processing of Customer Personal Data under the Terms, which may include the EU GDPR, the UK GDPR, the Swiss FADP, the CCPA and the DPDP Act.
"DPDP Act" means India's Digital Personal Data Protection Act, 2023, and the rules made under it.
"EU GDPR" means Regulation (EU) 2016/679, the General Data Protection Regulation.
"EU SCCs" means the standard contractual clauses for the transfer of personal data to third countries set out in the Annex to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
"Personal Data Breach" means a Security Incident that affects Customer Personal Data.
"Restricted Transfer" means a transfer of Customer Personal Data, including remote access to it, from you to us or from us to a Sub-processor, that the EU GDPR, the UK GDPR or the Swiss FADP permits only with appropriate safeguards because the recipient is in a country without an adequacy decision.
"SCCs" means the EU SCCs and, where they apply, the EU SCCs as amended by the UK Addendum or adjusted for the Swiss FADP under Section 8.6.
"Swiss FADP" means the Swiss Federal Act on Data Protection of 25 September 2020.
"UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 and in force from 21 March 2022.
"UK GDPR" means the EU GDPR as it forms part of the law of the United Kingdom, together with the UK Data Protection Act 2018.
"controller", "processor", "data subject", "personal data", "processing" and "supervisory authority" have the meanings given in the EU GDPR, or the equivalent terms in other Data Protection Laws. "Business", "consumer", "personal information", "sell", "share" and "service provider" have the meanings given in the CCPA.

3. Roles and scope

In short: you decide why and how your Customer Personal Data is processed. We process it only to run GainTrace for you.

3.1 Your role and ours

You are the controller of Customer Personal Data, or a processor acting for your own customers or another controller. We are your processor or, where you act as a processor, your sub-processor. Where those laws apply, you are the business and we are your service provider under the CCPA, and you are the Data Fiduciary and we are your Data Processor under the DPDP Act.

3.2 What we process

Annex I describes the subject matter, nature and purpose of the processing, the types of personal data and the categories of data subjects. The processing lasts for the term of your subscription and then until we delete Customer Personal Data under Section 15.

3.3 Processing for our own purposes

If we ever process personal data for our own purposes beyond your instructions, we are a controller for that processing (Section 5.5 of the Terms), and our Privacy Policy and Data Protection Laws govern it.

4. Processing on your instructions

In short: we only do with your data what you tell us to, and we tell you if an instruction looks unlawful. You make sure you are allowed to give us the data.

4.1 Your documented instructions

We process Customer Personal Data only on your documented instructions, including for Restricted Transfers. Your instructions are: the Terms, this DPA and any Order Form; your use and configuration of the Service, such as the Integrations you connect, the flows and playbooks you set up and the requests you make of Trace AI; and any other written instruction you give us that is consistent with the Terms. You also instruct us to create De-identified and Aggregated Data as Section 13.2 describes. An instruction that changes the scope of the Service needs both parties' agreement.

4.2 When the law requires otherwise

If the law requires us to process Customer Personal Data in another way, we will tell you before we do, unless that law prohibits it on important grounds of public interest.

4.3 Instructions we believe are unlawful

If we believe an instruction infringes Data Protection Laws, we will tell you promptly. We may hold off on carrying out that instruction until you confirm or change it.

4.4 Your responsibilities

You are responsible for:

making sure your instructions comply with Data Protection Laws;
having a valid legal basis, and giving the privacy notices and obtaining the consents needed, for us to process Customer Personal Data as this DPA describes (Section 5.3 of the Terms);
the accuracy of Customer Personal Data; and
not submitting Prohibited Data (Section 7.4 of the Terms).

5. Our people

In short: only people who need access get it, and everyone who can access your data is bound by confidentiality and trained in security.

5.1 Need-to-know access

We give access to Customer Personal Data only to our personnel who need it to provide, support or secure the Service. Access to the production environment is limited to named engineering personnel.

5.2 Confidentiality

Everyone we authorise to process Customer Personal Data is bound by written confidentiality obligations, or an appropriate statutory duty of confidentiality, that continue after their engagement ends, and may use Customer Personal Data only to provide the Service on our instructions.

5.3 Training

Our personnel complete security awareness training within 30 days of joining and every year after that.

5.4 Support access to your workspace

If our support team needs to sign in as one of your users to help you, they must record a reason, the session ends within one hour, and it is recorded in your workspace audit log.

6. Security

In short: we maintain the security measures in Annex II, and we will not lower the overall level of protection during your subscription.

6.1 Our measures

Taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to individuals, we implement and maintain the technical and organisational measures in Annex II. They are designed to protect Customer Personal Data against Personal Data Breaches and to give a level of security appropriate to the risk, as Article 32 of the EU GDPR requires.

6.2 Keeping them current

We may change our measures as technology and risks change, but we will not reduce the overall level of protection for Customer Personal Data during your subscription term.

6.3 Your part

You are responsible for configuring the Service's security controls for your workspace, such as requiring multi-factor authentication and assigning roles, for protecting your credentials, and for securing your own systems and the Third-Party Services you connect (Section 8.3 of the Terms).

7. Sub-processors

In short: you authorise the providers on our public list. We give you 30 days' notice before adding or replacing one, you can object, and we stay responsible for them.

7.1 General authorisation

You give us general written authorisation to engage Sub-processors. The Sub-processors we use on the date you enter into this DPA are listed in Annex III.

7.2 What we require of each Sub-processor

Before a Sub-processor processes Customer Personal Data, we will:

review its security and data protection practices, and review them again every year while it processes Customer Personal Data;
put in place a written agreement that imposes data protection obligations no less protective than those in this DPA, to the extent they apply to the service it provides; and
where its processing involves a Restricted Transfer, make sure a valid transfer mechanism covers it (Section 8.7).

We remain fully liable to you for each Sub-processor's performance of its data protection obligations as if they were our own.

7.3 Notice of new or replacement Sub-processors

At least 30 days before a new or replacement Sub-processor starts processing Customer Personal Data, we will update the list at https://trust.gaintrace.com/subprocessors and email your account owner. If you want the notice sent to other people, such as your privacy team, email [email protected] and we will add them to the notice list.

7.4 Your right to object

During the 30-day notice period, you may object to the change by emailing [email protected] with reasonable grounds relating to data protection. We will work with you in good faith to resolve the objection, for example by explaining the safeguards that apply, by changing how we provide the Service to you, or by not using that Sub-processor for your Customer Personal Data where we reasonably can. If you do not object within the notice period, the change is treated as accepted.

7.5 If we cannot resolve your objection

If we cannot resolve your objection within 30 days after we receive it, you may terminate the affected subscription, or the part of the Service that depends on the new Sub-processor, by written notice to [email protected]. We will then refund, on a pro-rata basis, any fees you prepaid for the period after termination. This refund is in addition to those in Section 4.4 of the Terms.

7.6 Copies of Sub-processor terms

On request, we will give you a copy of the data protection terms we have with a Sub-processor. We may redact commercial terms and other confidential information first.

8. International transfers

In short: your Customer Data is stored in the EU, in AWS Ireland. Access from India and our providers outside Europe are covered by the 2021 EU Standard Contractual Clauses, the UK Addendum and the Swiss adjustments in this section.

8.1 Where Customer Data is stored

We host and store Customer Data at rest in the European Union, in the Amazon Web Services Ireland region (eu-west-1). We will not change the region where Customer Data is stored at rest without notice to you (Section 5.4 of the Terms).

8.2 Which transfers are restricted

Storing data in the EU does not mean it never leaves. Where Data Protection Laws treat them as Restricted Transfers, these are covered by this Section:

access to Customer Personal Data by GainTrace, which is established in India, including by our personnel working from India; and
processing by Sub-processors outside the European Economic Area, the United Kingdom and Switzerland, several of which are in the United States (Annex III).

There is no EU adequacy decision for India, so we rely on the safeguards in this Section rather than on adequacy. We do not rely on the EU-US Data Privacy Framework for any transfer, even where a Sub-processor is certified under it.

8.3 EU Standard Contractual Clauses

For Restricted Transfers subject to the EU GDPR, the EU SCCs are incorporated into this DPA by reference and apply between you, as data exporter, and us, as data importer:

Module Two (controller to processor) applies where you are a controller.
Module Three (processor to processor) applies where you are a processor. You will pass on to us any instructions from your controller, and you confirm that your controller has authorised your use of us and of the Sub-processors in Annex III.

The parties make these choices in the EU SCCs:

Clause 7 (docking clause) applies.
Clause 9(a): Option 2, general written authorisation, with 30 days as the period for prior notice of changes, as Section 7 describes.
Clause 11(a): the optional language does not apply.
Clause 13(a): the competent supervisory authority is the one set out in Annex I.C.
Clause 17: Option 1. The EU SCCs are governed by the law of Ireland.
Clause 18(b): disputes arising from the EU SCCs are resolved by the courts of Ireland.
Annexes: Annex I.A, I.B and I.C of the EU SCCs are completed by Annex I of this DPA, Annex II by Annex II of this DPA, and Annex III by Annex III of this DPA.

By entering into this DPA, each party is treated as having signed the EU SCCs, including their annexes, on the date this DPA starts to apply to you.

8.4 How some EU SCC clauses work in practice

To the extent the EU SCCs allow: audits under Clause 8.9 are carried out as Section 14 describes; the certification of deletion under Clauses 8.5 and 16(d) is given on your written request; and copies of Sub-processor agreements under Clause 9(c) may be redacted to protect business secrets and other confidential information. Nothing in this Section 8.4 limits your rights, or those of data subjects, under the EU SCCs.

8.5 United Kingdom

For Restricted Transfers subject to the UK GDPR, the UK Addendum is incorporated into this DPA by reference and amends the EU SCCs as it provides. Annex IV completes its tables.

8.6 Switzerland

For Restricted Transfers subject to the Swiss FADP, the EU SCCs apply with these adjustments:

references to the EU GDPR are read as references to the Swiss FADP, to the extent the transfer is subject to it;
the competent supervisory authority under Clause 13 is the Swiss Federal Data Protection and Information Commissioner, to the extent the transfer is subject to the Swiss FADP, and the authority in Annex I.C remains competent to the extent the transfer is also subject to the EU GDPR;
the term "Member State" in the EU SCCs does not prevent data subjects in Switzerland from bringing claims in their place of habitual residence under Clause 18(c); and
the EU SCCs remain governed by the law of Ireland, with disputes resolved by the courts of Ireland, as Section 8.3 sets out.

8.7 Onward transfers to Sub-processors

Where a Sub-processor processes Customer Personal Data in a country without an adequacy decision, we put in place with it the EU SCCs, together with the UK Addendum where relevant, or another transfer mechanism that Data Protection Laws recognise other than the EU-US Data Privacy Framework, so that the protection required by Clause 8.8 of the EU SCCs continues.

8.8 Supplementary measures and transfer impact assessment

We keep a transfer impact assessment covering access from India and each Sub-processor outside the European Economic Area. We review it every year, and before a new Sub-processor outside the European Economic Area receives Customer Personal Data. The transfers are supported by supplementary measures, including:

encryption in transit, and encryption at rest of the production database and its backups;
access limited to named personnel who use multi-factor authentication;
support access to your workspace that is time-limited and recorded in your audit log;
storage of Customer Data at rest by GainTrace only in the European Union; and
the handling of public authority requests in Section 12.

You can ask for a copy of our transfer impact assessment, under confidentiality, at [email protected].

8.9 If a transfer mechanism changes

If a transfer mechanism we rely on is amended, replaced or found invalid, we will work with you to adopt a valid alternative, such as a new version of the standard contractual clauses, and we may update this DPA to include it (Section 18.3).

9. Personal Data Breaches

In short: if a breach affects your Customer Personal Data, we tell you without undue delay and within 48 hours, then keep you updated as we learn more.

9.1 Notice within 48 hours

If we become aware of a Personal Data Breach, we will notify you without undue delay, and in any event no later than 48 hours after becoming aware of it. We send the notice by email to your account owner and to any security contact you have given us.

9.2 What the notice includes

To the extent the information is available to us, the notice will describe:

the nature of the Personal Data Breach, including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
the name and contact details of our contact point for more information;
the likely consequences of the Personal Data Breach; and
the measures we have taken or propose to take to address it, including, where appropriate, measures to mitigate its possible adverse effects.

Where we cannot provide all of this information at once, we will provide it in phases as it becomes available, without further undue delay.

9.3 What we do next

We will promptly take reasonable steps to contain, investigate and mitigate the Personal Data Breach, keep you informed of material developments, and give you the reasonable help you need to meet your own obligations to notify supervisory authorities and affected individuals.

9.4 Who notifies regulators and individuals

As the controller, or on your controller's behalf, you decide whether to notify supervisory authorities and affected individuals. We will not notify them, or any other third party, about a Personal Data Breach affecting your Customer Personal Data without your approval, unless the law requires us to.

9.5 What is not a Personal Data Breach

Unsuccessful attempts and activities that do not compromise the security of Customer Personal Data, such as pings, port scans and failed sign-in attempts, are not Personal Data Breaches.

9.6 Not an admission

Notifying you of, or responding to, a Personal Data Breach is not an admission of fault or liability (Section 8.2 of the Terms).

9.7 Telling us about a problem

If you suspect a Security Incident affecting the Service, email [email protected].

10. Requests from individuals

In short: the Service gives you tools to answer access, correction and deletion requests yourself. If someone contacts us about your data, we pass the request to you.

10.1 Tools in the Service

Taking into account the nature of the processing, we help you respond to individuals exercising their rights under Data Protection Laws through appropriate technical and organisational measures. The Service lets you find, export, correct and delete Customer Personal Data yourself, including by exporting tables and views as CSV files, through the REST API, and by editing or deleting records. Admins can also redact or hide contact email, phone and LinkedIn fields for members with the built-in roles.

10.2 When you need more help

If you cannot fulfil a request with those tools, we will help you on your documented instruction, including by deleting or correcting specific Customer Personal Data within a reasonable time, subject to backup cycles and any legal retention (Section 5.6 of the Terms).

10.3 Requests made to us

If an individual contacts us with a request about Customer Personal Data, we will not respond to it except on your instruction, and we will forward it to you promptly, and within 2 business days of receiving it.

10.4 Explaining Outputs

On reasonable request, we will give you meaningful information about the general logic of our automated Outputs, and their significance and likely consequences, to support your transparency obligations (Section 5.6 of the Terms).

11. Assessments, consultations and other help

In short: we give you the information you need for your own impact assessments, regulator consultations and records.

11.1 Your Article 32 to 36 obligations

Taking into account the nature of the processing and the information available to us, we will help you meet your obligations under Articles 32 to 36 of the EU GDPR, and their equivalents in other Data Protection Laws: security (Section 6 and Annex II), Personal Data Breach notification (Section 9), data protection impact assessments, and prior consultation with a supervisory authority.

11.2 Impact assessments and prior consultation

For a data protection impact assessment or a prior consultation, we will give you the information reasonably available to us about the processing, such as the data flows, Sub-processors, locations and safeguards of the features you use, our security documentation under confidentiality, and answers to your reasonable questions.

11.3 Records and cooperation

We keep records of the processing we carry out on your behalf, as Article 30(2) of the EU GDPR requires, and we will cooperate with a supervisory authority, on request, in the performance of its tasks.

11.4 If we can no longer comply

We will tell you promptly if we determine that we can no longer meet our obligations under this DPA or Data Protection Laws (Section 5.5 of the Terms).

12. Requests from public authorities

In short: we disclose Customer Personal Data to a public authority only when the law compels it, we push back on requests that are not lawful, and we tell you unless the law forbids it.

12.1 How we handle a request

If a public authority, including a court, a law enforcement body or a national security body, asks or orders us to disclose Customer Personal Data, we will:

check that the request is legally binding and has a valid legal basis, and challenge it where, after careful assessment, we conclude there are reasonable grounds to consider it unlawful;
try to redirect the authority to request the data from you directly;
notify you promptly, before we disclose anything, unless the law prohibits it, and, if it does, use our best efforts to obtain a waiver of that prohibition;
disclose only the minimum the request requires; and
keep a record of the request and our response.

12.2 The SCCs

These commitments add to Clause 15 of the EU SCCs where it applies.

13. AI and machine learning

In short: your Customer Data trains only models that serve you. Improvement across customers uses only de-identified, aggregated data, and our AI providers are bound not to train on your data.

13.1 Models trained on your data serve only you

Our prediction models, such as our churn and expansion models, are trained for each workspace on that workspace's data and serve only that workspace. We do not use Customer Personal Data to train, fine-tune or improve any model that is made available to, or benefits, another customer (Section 6.2 of the Terms).

13.2 De-identified and Aggregated Data

We may create De-identified and Aggregated Data from Customer Data to operate, secure, analyse, benchmark and improve the Service and our models (Section 6.3 of the Terms). This is the only way data derived from your Customer Data is used beyond serving you. We will keep it only in de-identified and aggregated form, take reasonable measures so that it cannot be associated with you or any individual, not try to re-identify it, and not sell it.

13.3 Third-party AI providers

Our commitment. An AI provider may act as our Sub-processor only under terms, or with settings we switch on, that prevent it from using Customer Data to train or improve its models. We will confirm this for each new AI Sub-processor before it receives Customer Personal Data.
Generative features. Trace AI and our other generative features run on OpenAI's API. OpenAI's API terms bar it from training on the data we send. We switch response storage off on every request, and OpenAI may keep request logs for up to 30 days for abuse monitoring.
Speech-to-text. Voice input that Authorized Users dictate in the Service is transcribed by Deepgram. We will configure every request to Deepgram to opt out of its use of the audio or transcript to improve its models. We do not store the dictated audio.

13.4 Your own AI provider keys

If you connect your own key for an AI provider, that provider processes the data sent to it as your Third-Party Service under your own agreement with it, not as our Sub-processor. We encrypt your key and bind it to your workspace.

13.5 Your controls

Admins can switch Trace AI off for the whole workspace. Trace AI never changes your data on its own: every change it proposes needs a member to confirm it. Text from emails, CRM notes and transcripts is treated as untrusted data in AI prompts, never as instructions.

13.6 Outputs support your decisions

Outputs are probabilistic estimates about business accounts. They support your decisions and do not replace them, and you keep a human in the loop for any decision with a legal or similarly significant effect on an individual (Sections 6.5 to 6.7 of the Terms).

14. Audits and information

In short: we first answer your questions with documentation. If you still need an audit, you can run one a year, at your cost, with 30 days' notice and under confidentiality.

14.1 Information we make available

We will make available to you the information reasonably necessary to demonstrate our compliance with this DPA and Article 28 of the EU GDPR. In the first instance, and under confidentiality, this means:

our information security policies and procedures;
our answers to your reasonable security and privacy questionnaires; and
the mapping of our controls to the SOC 2 Trust Services Criteria.

14.2 Audits

If that information is not enough to demonstrate our compliance, you may audit our compliance with this DPA, including by inspection, on these conditions:

you give us at least 30 days' written notice at [email protected], and agree the scope, timing and duration with us in advance;
there is no more than one audit in any 12-month period, except for any audit a supervisory authority requires;
the audit is carried out by you or by an independent auditor you appoint, and everyone taking part is bound by confidentiality obligations;
it takes place during our normal business hours, does not unreasonably disrupt our operations, and is limited to the systems, records and personnel relevant to the processing of your Customer Personal Data, without access to other customers' data;
you bear your own costs and your auditor's costs; and
you share the audit findings with us, and they are our Confidential Information.

14.3 Your rights under the SCCs and the law

Nothing in this Section 14 restricts any audit right you or a supervisory authority has under Clause 8.9 of the EU SCCs or under Data Protection Laws.

15. Return and deletion

In short: export your data any time during your subscription and for 30 days after it ends. Then we delete it, and backups roll off within 90 days.

15.1 During your subscription

You can export Customer Data, including Outputs, at any time during your subscription through the Service or its API. If you delete your workspace, it stays recoverable for 30 days in case the deletion was a mistake, and is then permanently deleted.

15.2 After your subscription ends

For 30 days after expiry or termination, you can export Customer Data in a structured, commonly used, machine-readable format (such as CSV or JSON) through the Service or its API, or by asking us (Section 11.6 of the Terms). After that period, we will delete Customer Data, including Customer Personal Data, within a reasonable time.

15.3 Backups

Copies in routine backups are deleted on our regular backup cycle, and in any event within 90 days. Until then, they remain protected under this DPA.

15.4 Data the law requires us to keep

Where the law requires us to keep some Customer Personal Data, we will keep only what it requires, continue to protect it under this DPA, and process it only for the purpose the law requires.

15.5 Confirmation

On your written request, we will confirm the deletion to you in writing.

16. California service provider terms

In short: for California personal information, we act as your service provider. We do not sell or share it, and we use it only to provide GainTrace to you.

16.1 Business purpose

Where the CCPA applies to Customer Personal Data, we process the personal information you disclose to us only for the limited and specified business purpose of providing, supporting and securing the Service for you, as the Terms and this DPA describe, including the purposes in Annex I.B.

16.2 What we will not do

We will not:

sell or share the personal information, including for cross-context behavioural advertising;
retain, use or disclose it for any purpose, including any commercial purpose, other than the business purpose in Section 16.1, except as the CCPA otherwise permits a service provider to;
retain, use or disclose it outside the direct business relationship between you and us; or
combine it with personal information we receive from or on behalf of another person, or collect from our own interaction with the consumer, except where that is needed to perform the business purpose you instruct, such as enriching business contact data when you use that feature, or as the CCPA regulations otherwise permit.

16.3 Our other commitments

We will comply with the obligations the CCPA places on us as a service provider and provide the same level of privacy protection the CCPA requires of you. We will notify you if we determine that we can no longer meet our obligations under the CCPA. We will help you respond to consumer requests as Section 10 describes. And we will bind every Sub-processor that processes the personal information to a written contract with restrictions at least as protective as this Section 16, after giving you notice under Section 7.

16.4 Your rights

You may take reasonable and appropriate steps to make sure we use the personal information in a manner consistent with your obligations under the CCPA, including through the information and audits in Section 14. On notice to us, you may also take reasonable and appropriate steps to stop and remedy any unauthorised use of it.

16.5 De-identified information

This Section 16 does not restrict our use of De-identified and Aggregated Data that meets the CCPA's requirements for deidentified information.

16.6 Certification

We certify that we understand the restrictions in this Section 16 and will comply with them.

17. Liability

In short: the liability limits in our Terms apply to this DPA, except where the SCCs or the law do not allow them.

17.1 The Terms' limits apply

Each party's liability arising out of or relating to this DPA, including under the SCCs, is subject to the exclusions and limitations of liability in Section 12 of the Terms, and counts toward the same aggregate cap in Section 12.5 of the Terms.

17.2 Where those limits do not apply

Nothing in this DPA limits either party's liability to data subjects under Clause 12 of the EU SCCs, or under the SCCs as amended by the UK Addendum, or any liability that cannot be limited under Data Protection Laws. Where the SCCs do not allow a limitation of liability to apply, it does not apply.

18. How the documents fit together

In short: on data protection matters, the SCCs come first, then this DPA, then our Terms. This DPA lasts for as long as we hold your Customer Personal Data.

18.1 Order of precedence

If there is a conflict on a data protection matter, this order applies, for the conflicting subject only: first the SCCs, where they apply to a Restricted Transfer; then this DPA; then the Terms, together with any Order Form, in the order Section 14 of the Terms sets out. On every other matter, the Terms govern.

18.2 How long this DPA lasts

This DPA continues for as long as we process Customer Personal Data, including after the Terms end, until we have deleted it under Section 15. Provisions that by their nature should survive termination do.

18.3 Changes to this DPA

We may update this DPA as Section 15 of the Terms describes. We will post each update on this page and change the date at the top. We will not make a change that reduces the protection of Customer Personal Data during your current subscription term, unless the change is required by Data Protection Laws, a supervisory authority or a court, or adopts a new or amended transfer mechanism under Section 8.9.

19. Who we are and how to reach us

In short: GainTrace is operated by Girasol Technologies LLP in India. Write to privacy@ for data protection, support@ for security incidents, and legal@ for notices.

GainTrace is operated by Girasol Technologies LLP, a limited liability partnership organised under the laws of India, LLPIN ACZ-1487, with its registered office at C-502, Pushkar Hill, Near Dharmvatika Flat, Hathijan, Ahmedabad 382445, Gujarat, India.

Privacy questions, data subject requests and objections to Sub-processors: [email protected]
Security incidents and vulnerability reports: [email protected]
Legal notices under this DPA, audit requests and requests for a countersigned copy: [email protected]

Annex I: Details of the processing

In short: who the parties are, whose personal data GainTrace processes, what kinds of data, and why.

A. List of parties

	Data exporter	Data importer
Name	The customer that accepted the Terms or signed an Order Form, as named in its GainTrace account or Order Form	Girasol Technologies LLP, operating GainTrace (LLPIN ACZ-1487)
Address	As given in the customer's GainTrace account or Order Form	C-502, Pushkar Hill, Near Dharmvatika Flat, Hathijan, Ahmedabad 382445, Gujarat, India
Contact person	The customer's account owner, or the privacy contact the customer gives us	Privacy Lead, [email protected]. Security incidents: [email protected]. Legal notices: [email protected]
Activities relevant to the transfer	Use of the Service, including connecting Integrations and inviting Authorized Users	Providing the Service to the customer under the Terms
Role	Controller (Module Two) or processor (Module Three)	Processor (Module Two) or sub-processor (Module Three)
Signature and date	Treated as signed by accepting the Terms or an Order Form, on the date this DPA starts to apply	Treated as signed by entering into this DPA, on the same date

B. Description of the processing

Categories of data subjects

The data subjects depend on the Integrations you connect and the features you use. They typically include:

contacts at your customers and prospects, such as champions, users, decision makers, executive sponsors and billing contacts;
end users of your product, where you connect product-usage or analytics data;
people who correspond or meet with your team, where you connect email, calendar, messaging, call or meeting tools;
people who answer surveys you send through the Service or connect from a survey tool;
people who receive emails you send through flows and playbooks in the Service; and
your Authorized Users and other staff, contractors or agents, as they appear in your workspace, for example as account owners or authors of notes.

Categories of personal data

Depending on the Integrations and features you use:

Contact and profile data: name, business email address, phone number, job title, role, company, location and professional profile URL.
Enriched business contact data: where you use contact-enrichment features, such as tracking when a key contact changes jobs, we send a contact's business email address or professional profile URL to a business-contact enrichment provider, and receive professional profile information such as current employer, job title and employment history.
CRM data: accounts, contacts, deals, renewal records, owners, activities, tasks and notes from your CRM.
Billing data: customer, subscription, plan, invoice, payment and dunning records from your billing system. From an optional payment-gateway connector we receive only the card brand, the last four digits and the expiry date, never full card numbers or card verification values (Section 3.5 of the Terms).
Product usage data: user and account identifiers, events, timestamps and properties sent from your product-analytics tools or through our API.
Support data: tickets, conversations, satisfaction ratings and related metadata from your support tools.
Email and messaging data: messages and their metadata, such as sender, recipients, subject and date, from the mailboxes, calendars and messaging tools you connect, and emails you send through the Service.
Calls and meetings: call recordings, transcripts, summaries and meeting details from the call and meeting tools you connect, and transcripts of voice input that Authorized Users dictate in the Service.
Survey data: responses, scores and comments, linked to the respondent unless the survey is anonymous.
Outputs: health scores, churn and expansion predictions, risk flags and other signals, summaries, recommendations and plans that the Service generates from the data above, which may refer to individuals.
Authorized User data in your workspace: names, email addresses, roles, permissions and assignments, and the workspace audit log of sign-ins, admin changes and AI agent actions, including IP address and browser details.

We process Authorized Users' account, sign-in, product-analytics and support data for our own purposes as a controller, as our Privacy Policy describes. That processing is outside this DPA.

Sensitive data

None is intended. Special categories of personal data, personal data about criminal convictions and offences, full payment card data, protected health information and children's data are Prohibited Data under Section 7.4 of the Terms, and you must not submit them. The Service is not designed to collect or infer them. If free text you connect, such as an email, a note or a transcript, contains such data incidentally, the measures in Annex II apply to it, and you can delete it with the tools described in Section 10.1. If we find Prohibited Data in Customer Data, we will tell you and delete or isolate it on your instruction.

Frequency of the transfer

Continuous, for the term of your subscription, as your Integrations sync and your Authorized Users use the Service.

Nature of the processing

Collection through Integrations, the API and user input; storage; organisation and structuring, such as matching records to accounts and contacts; analysis and scoring with machine-learning models; generation of summaries and recommendations with AI; transcription; enrichment of business contact data; retrieval and display; transmission on your instruction, such as sending emails and writing data back to connected systems; export; and deletion.

Purpose of the processing

To provide the Service to you under the Terms: bringing together your customer data, scoring account health, predicting churn and expansion, running playbooks, flows and plans, sending the communications you configure, powering Trace AI and the MCP server, supporting you, and keeping the Service secure. As Section 6.3 of the Terms permits, the processing also includes creating De-identified and Aggregated Data.

Retention

For the term of your subscription, then the 30-day export period, then deletion as Section 15 describes, with backup copies deleted within 90 days. You can delete Customer Personal Data at any time during the term. Some data is kept for less time: dictated audio is not stored after transcription, and OpenAI may keep AI request logs for up to 30 days for abuse monitoring.

Transfers to Sub-processors

Sub-processors process Customer Personal Data only to provide the service listed for them in Annex III, for the term of your subscription, and within the retention described above. By function, they are: cloud hosting and database (Amazon Web Services, Ireland); network edge and traffic delivery (Cloudflare, global); generative AI (OpenAI, United States); speech-to-text (Deepgram, United States); email delivery (Resend, United States); product analytics and session replay of the signed-in app, which can capture Customer Data shown on screen (PostHog, European Union); error monitoring (Sentry, Germany); and support messaging (Intercom, United States). Where you use contact-enrichment features, a business-contact enrichment provider receives contact identifiers and returns professional profile information.

C. Competent supervisory authority

EU GDPR: the supervisory authority determined under Clause 13(a) of the EU SCCs by reference to your establishment in the European Union or, where you are not established there, your representative under Article 27 of the EU GDPR. Where no supervisory authority can be determined in that way, Ireland's Data Protection Commission.
UK GDPR: the Information Commissioner's Office.
Swiss FADP: the Federal Data Protection and Information Commissioner.

Annex II: Technical and organisational measures

In short: the security measures in place today, grouped by the categories in Article 32 of the GDPR, plus the commitments our security policies make.

Statements in the present tense describe measures in place on the date of this DPA. Statements that say "we will" are commitments our security policies require.

1. Encryption and pseudonymisation

The production database, which holds Customer Data, is encrypted at rest with AES-256.
The database is backed up every night to separate storage encrypted with AWS KMS, which the application server cannot delete.
Every connection to the Service is encrypted with TLS, and browsers are held to HTTPS with HSTS. Web traffic reaches the application only through an encrypted Cloudflare Tunnel.
OAuth tokens and API keys for the tools you connect are encrypted again at the application layer with AES-256-GCM before they are stored.
AI provider keys you bring are encrypted and bound to your workspace.
Workspace API keys are shown once and stored only as hashes. Passwords are hashed with scrypt and never stored in plain text.

2. Confidentiality: identity and access control

In the Service:

Members sign in with Google, with Microsoft, or with an email address and password.
Members can protect their accounts with an authenticator app, email codes and backup codes, and admins can require multi-factor authentication for every member.
Access is role-based, with owner, admin and member roles, and on paid plans custom roles built from more than 50 individual permissions.
Customer Data is logically separated by workspace: every request is tied to the signed-in member's workspace membership, and data access is scoped to that workspace.
Admins can redact or hide contact email, phone and LinkedIn fields for members with the built-in roles.
Session cookies are HttpOnly, Secure and SameSite, and sessions expire after 7 days without use.
Sign-in, sign-up and password reset are rate-limited.
If our support team signs in as one of your users, they must give a reason, the session ends within one hour, and it is recorded in your workspace audit log.

Inside GainTrace:

Multi-factor authentication is required on every service our team uses.
Access to the production environment is limited to named engineering personnel who need it.
Deployments use short-lived cloud credentials, never stored keys.
The application runs as a non-root user inside its container.
We will review access to production, AWS, GitHub, the database and admin roles every quarter, and access to other systems every six months.
We will remove a leaver's access within 24 hours of their last working day, and on the same day for an involuntary departure.

3. Integrity: secure development and change management

Every production release passes type checks, automated tests and a production build before it is deployed.
Dependencies are updated weekly, and security fixes are raised as soon as they are published.
Every application image is scanned for known vulnerabilities when it is pushed.
Credentials are kept out of the code repository, with checks before code is committed and deployed.
Inbound webhooks are verified before we process them, and webhooks we send are signed with HMAC-SHA256.
Trace AI never changes Customer Data on its own: every change it proposes needs a member to confirm it.
Text from emails, CRM notes and transcripts is treated as untrusted data in AI prompts, never as instructions.
We will have every production change reviewed by someone other than its author, or, when only one engineer is available, reviewed and recorded within 2 business days after deployment.
We will fix vulnerabilities within these times from triage: critical within 7 days, high within 30 days and medium within 90 days, with low-severity issues handled at the next scheduled maintenance or accepted through a documented exception.

4. Availability and resilience

The Service runs in AWS eu-west-1 (Ireland).
The application has no open web ports. Traffic is served through Cloudflare's network, which absorbs denial-of-service attacks.
The database has no public endpoint and accepts connections only from the application server.
Releases are deployed side by side behind a health gate, and a release that fails its health checks is rolled back automatically.
The Service is checked from outside our infrastructure every 30 seconds, with alerts to the team, and application errors are reported to an error-monitoring service.

5. Restoring availability after an incident

The production database has point-in-time recovery, and nightly backups are kept in separate encrypted storage (Section 1 of this Annex).
We follow a documented incident response process to detect, triage, contain and recover from incidents and learn from them, and we notify Personal Data Breaches as Section 9 describes.
We will start triage within 1 hour of detecting a confirmed breach of Customer Data or a full outage, and write a post-incident review within 5 business days of a high-severity incident.
We will test restoring from backup at least once a year. Our recovery objectives are a recovery point of 24 hours and a recovery time of 24 hours; these are objectives, not guarantees.

6. Regular testing, assessment and evaluation

Our security program is set out in written policies and procedures, approved by management and reviewed at least once a year, and our controls are mapped to the SOC 2 Trust Services Criteria.
We will commission an independent penetration test of the Service at least once a year and after any major architectural change, and track its findings to the remediation times in Section 3 of this Annex.
We will assess information security and privacy risks at least once a year and when the Service changes significantly.
Every quarter, each team member will confirm, with dated evidence, that their computer's encryption, firewall and automatic updates are on, and the Information Security Officer will review the results.

7. Physical and endpoint security

We run no servers or data centres of our own. The Service runs in AWS data centres in Ireland, and AWS manages their physical and environmental security.
Every company computer is an Apple MacBook running macOS, with FileVault full-disk encryption, automatic macOS and security updates, the firewall on, and a password with automatic locking when left unattended.

8. People, policies and suppliers

Everyone with access to Customer Personal Data is bound by written confidentiality obligations and has access only on a need-to-know basis (Section 5).
Every employee completes security awareness training. We will provide it within 30 days of joining and every year after that, including phishing awareness, and record completion.
We have named an Information Security Officer, who owns the security program, and a Privacy Lead, who handles [email protected], data subject requests and Personal Data Breach notices to customers.
We will review each supplier before onboarding it, and every year for suppliers that process Customer Data, and we will have a data processing agreement or equivalent terms in place before any Customer Data is shared with it.
We publish our Sub-processors and give 30 days' notice before adding or replacing one (Section 7).
We will screen every change that touches personal data for privacy risk, and carry out a data protection impact assessment where the screening calls for one, before it is released.

9. Data minimisation, retention, portability and erasure

Admins control which Integrations are connected, and disconnecting an Integration stops further ingestion from that source.
Customer Data can be exported as CSV files and through the REST API, and records can be corrected or deleted in the Service (Section 10).
We will request the narrowest permissions each Integration provider offers, and ingest only the data the Service uses.
We will not use production Customer Data in development or test environments.
We will return and delete Customer Data as Section 15 describes: a 30-day export period after your subscription ends, then deletion, with backup copies deleted within 90 days.

10. AI-specific measures

Our churn and expansion models are trained for each workspace on that workspace's data only, and serve only that workspace.
Managed AI features run on OpenAI's API with response storage switched off on every request. OpenAI's API terms bar it from training on the data we send, and OpenAI may keep request logs for up to 30 days for abuse monitoring.
Admins can switch Trace AI off for the whole workspace, and can bring their own AI provider key instead (Section 13.4).
We will configure every AI Sub-processor, including our speech-to-text provider, so that it does not use Customer Data to train or improve its models (Section 13.3).

Annex III: Sub-processors

In short: our current Sub-processors are listed on our trust center, with what each one does and where it operates.

The Sub-processors you authorise under Section 7 are those listed at https://trust.gaintrace.com/subprocessors, which shows each provider's name, what it does for us and where it operates. That list forms part of this Annex III, and we update it as Section 7 describes. The list also names providers that support our own operations as a controller, such as our CRM and scheduling tools. Only the providers that process Customer Personal Data act as Sub-processors under this DPA.

Annex IV: UK Addendum

In short: how the UK Addendum's tables are completed for transfers from the United Kingdom.

For Restricted Transfers subject to the UK GDPR, the UK Addendum applies, and its tables are completed as follows:

Table 1 (Parties): the start date is the date this DPA starts to apply to you. The parties, their details and their key contacts are as set out in Annex I.A, with you as the exporter and us as the importer.
Table 2 (Selected SCCs, Modules and Selected Clauses): the version of the Approved EU SCCs incorporated by Section 8.3, including the Appendix Information, with Module Two or Module Three as Section 8.3 describes and the options selected there: Clause 7 applies; Clause 9(a) Option 2 applies, with 30 days' notice of changes; and the optional language in Clause 11(a) does not apply.
Table 3 (Appendix Information): the list of parties is Annex I.A, the description of the transfer is Annex I.B, the technical and organisational measures are in Annex II, and the list of Sub-processors is Annex III.
Table 4 (Ending this Addendum when the Approved Addendum changes): both the importer and the exporter may end the UK Addendum as Section 19 of the UK Addendum allows.

The Mandatory Clauses are those of the Approved Addendum, template Addendum B1.0, issued by the Information Commissioner and laid before Parliament in accordance with section 119A of the Data Protection Act 2018 on 2 February 2022, as revised under Section 18 of those Mandatory Clauses. As the Mandatory Clauses provide, for transfers under the UK Addendum the EU SCCs are governed by the laws of England and Wales, disputes are resolved by the courts of England and Wales, and the competent supervisory authority is the Information Commissioner's Office.

This Data Processing Agreement forms part of our Terms of Service. Our Privacy Policy explains how we handle the personal data we control, and our Sub-processor list names the providers we use.