Data Processing Addendum

This Data Processing Agreement ("DPA") is entered into between:

• PetBoard Technologies Private Limited, (CIN - U62099KA2026PTC223226) a company incorporated under the Companies Act, 2013, having its registered office at Bangalore, Karnataka, India ("PetBoard");

And

• [Operator Name], a [entity type] having its principal place of business at [Address] ("Operator"), operating a pet-care business including [boarding / day-care / grooming / training / sitter services] (as applicable).

WHEREAS:

• PetBoard operates a B2B SaaS operations management Platform for pet-care businesses in India ("Platform"), enabling bookings, pet records, customer management, staff scheduling, payments, and related operations.
• The Operator has subscribed to the Platform under this DPA, Terms of Use and the Privacy Policy and, in that capacity, uploads Personal Data of pet parents, pets, and staff to the Platform.
• The Parties recognise that PetBoard acts in a dual capacity: (i) as Data Fiduciary under the DPDP Act with respect to Operator-account data and PetBoard's own operational processing; and (ii) as Data Processor with respect to pet-parent Personal Data that Operators, as Data Fiduciaries, process through the Platform.
• Pet parents do not hold self-managed login accounts on the Platform; they interact solely through tokenised public links (intake forms, stay-status, training-progress, pack-receipt pages) shared by Operators, and have no self-service profile management.
• One public-link feature works without a token: the returning-customer check on an Operator's public intake form. When a phone number is entered, the form shows the names of the pets on file for that number with that Operator, whether an address, a vet and an emergency contact are on file (yes or no only), and the month of the last form, so that a returning pet parent does not enter the same details again. It never shows the pet parent's name, phone number, address or other contact details, and the number of checks from one network address is limited.
• PetBoard independently designs the Platform data model, default intake fields, technical means of storage, security architecture, and retention schedules, while Operators configure processing within that framework for their pet-parent data.

NOW, THEREFORE, the Parties agree as follows:

1. DEFINITIONS AND INTERPRETATION

• Definitions

• Interpretation
• In case of conflict between this DPA and the Terms of Use, this DPA shall prevail on data protection matters.
• References to clauses include their sub-clauses. Headings are for convenience only.
• The singular includes the plural and vice versa.

2. PETBOARD'S DUAL ROLE FRAMEWORK

• Data Fiduciary Role (Category A Data)- PetBoard independently determines the purposes and means of processing Category A Data. In this capacity, PetBoard's obligations under the DPDP Act, including providing a Privacy Notice to Operators, establishing a lawful basis for processing, maintaining a Grievance Officer, and responding to Data Principal requests are governed by PetBoard's Privacy Policy and its own compliance programme, not by Operator instructions.
• Data Processor Role (Category B Data)- With respect to Category B Data, PetBoard acts as Data Processor on behalf of the Operator-Data Fiduciary. PetBoard processes Category B Data solely on the Operator's documented instructions (as set out in the Terms of Use and this DPA), except where required by law. PetBoard independently determines the technical means (storage architecture, security controls, retention defaults, deletion mechanisms) even for Category B Data. However, the purposes of processing Category B Data are set by the Operator; PetBoard does not use identifiable pet-parent data for unrelated commercial purposes.
• Own-Purpose Processing of Category B Data- Notwithstanding Clause 2.2, PetBoard may access Category B Data for the following limited own-purposes, which are ancillary to its role as Data Processor and necessary for Platform integrity:
• Support and troubleshooting, by a closed list of authorised staff, on a need-to-know basis.
• Data Subject Request (DSR) execution on Operator instruction.
• Incident investigation and security operations (bug, breach, fraud).
• Legal holds and regulatory compliance.
• Data imports and migrations authorised by the Operator.

Such access shall be limited to the minimum data reasonably necessary for the relevant purpose and subject to appropriate access controls. PetBoard shall NOT use Category B Data for targeted advertising, profiling for third-party commercial purposes, sale to data brokers, or any purpose unrelated to Platform operations. Analytics derived from Category B Data shall be aggregated and anonymised before use for product improvement.

3. SCOPE AND NATURE OF PROCESSING

• Platform Data Architecture- PetBoard designs the Platform's data model, default intake fields, and processing architecture. Operators configure intake forms and workflows within the framework PetBoard establishes. Pet parents interact with the Platform exclusively through Tokenised Public Links shared by Operators and do not hold login accounts.
• Categories of Personal Data

For the avoidance of doubt, certain pet-related information included within Category B Data may not independently constitute Personal Data under Applicable Data Protection Law, but shall nevertheless be subject to the confidentiality, security, and processing provisions of this DPA especially where such information forms part of an Operator's customer records.

• Permitted Purposes for Category B Data
• Providing and operating the Platform for the Operator's pet-care business.
• Generating operational reports and dashboards for the Operator.
• Sending transactional communications (booking confirmations, intake alerts, and stay-status updates) on the Operator's behalf via Sub-Processors as mentioned in Schedule 2.
• Storing, backing up, and restoring data in accordance with this Agreement.
• Platform security, integrity, and fraud prevention (access strictly controlled per Clause 2.3).
• Complying with legal obligations under Applicable Data Protection Law and other applicable law.
• Any other purpose expressly authorised in writing by the Operator.
• Prohibition on Secondary Use- PetBoard shall not process Category B Data for: (a) sale or rental to third parties; (b) targeted advertising or behavioural profiling for unrelated commercial purposes; (c) data brokerage; or (d) enrichment of profiles beyond what is necessary for the Platform.

4. PETBOARD'S OBLIGATIONS AS DATA PROCESSOR (CATEGORY B DATA)

• Processing on Instructions
• Process Category B Data only on documented instructions from the Operator (as set out in this DPA and the Terms of Use), except as required by law. PetBoard shall without undue delay inform the Operator if it believes an instruction would infringe Applicable Data Protection Law.
• Inform the Operator without undue delay if processing instructions are impractical or unlawful.
• Confidentiality
• Ensure that all personnel with access to Category B Data are bound by enforceable confidentiality obligations.
• Restrict access to Category B Data to the minimum number of authorised personnel necessary for permitted purposes.
• Technical and Organisational Measures- PetBoard shall implement and maintain the security measures set out in Clause 6.
• Sub-Processors- Engage Sub-Processors only as permitted under Clause 7.
• Data Principal Rights Assistance- Assist the Operator in responding to Data Principal requests under Clause 8.
• Breach Notification- Notify the Operator of a Personal Data Breach in accordance with Clause 9.
• Return or Deletion- Return or delete Category B Data upon termination in accordance with Clause 11.

5. OPERATOR’S OBLIGATIONS AS DATA FIDUCIARY (CATEGORY B DATA)

• Lawful Basis and Responsibility- The Operator acknowledges and agrees that, in respect of Category B Data, the Operator acts as the Data Fiduciary and is solely responsible for determining the purposes for which such Category B Data is collected, uploaded, stored, used, disclosed, retained, corrected, deleted, or otherwise processed through the Platform. The Operator shall ensure that all processing of Category B Data through the Platform is carried out in accordance with Applicable Data Protection Law, this DPA, the Terms of Use, and any applicable notices, consents, records, policies, and internal procedures maintained by the Operator.
• Notice and Consent- The Operator shall be solely responsible for providing all legally required notices to pet parents, staff, employees, emergency contacts, veterinarians, and any other Data Principals whose Personal Data is collected or processed through the Platform. Where consent is required under Applicable Data Protection Law, the Operator shall obtain, maintain, and evidence valid consent before collecting or uploading such Personal Data to the Platform, including through intake forms, booking forms, staff records, communications, or Tokenised Public Links. The Operator shall ensure that such notices and consents clearly describe the purposes of processing, categories of Personal Data collected, manner of processing, sharing with PetBoard and Sub-Processors, retention periods, grievance redressal details, and Data Principal rights. PetBoard shall rely upon the Operator's representation that all required notices and consents have been obtained.
• Instructions to PetBoard. The Operator shall provide PetBoard with lawful, clear, complete, and documented instructions for processing Category B Data. The Operator shall not instruct PetBoard to process Category B Data in any manner that violates Applicable Data Protection Law, infringes the rights of any Data Principal, or is inconsistent with this DPA, Terms of Use or the Privacy Policy. PetBoard shall be entitled to rely on the Operator’s instructions as lawful unless PetBoard reasonably believes that such instructions are unlawful, impractical, technically infeasible, or inconsistent with this DPA.
• Accuracy and Data Quality. The Operator shall ensure, to the extent reasonably practicable, that Category B Data uploaded, submitted, entered, or maintained by the Operator or its authorised users on the Platform is accurate, complete, up to date, relevant, and limited to what is necessary for the Operator’s pet-care business operations. The Operator shall promptly correct or instruct PetBoard to correct any inaccurate or outdated Category B Data upon becoming aware of the same or upon receiving a verified request from a Data Principal.
• Data Minimisation. The Operator shall not collect, request, upload, or store any Personal Data on the Platform that is excessive, irrelevant, unnecessary, unlawful, or unrelated to the permitted purposes set out in this DPA. Without limiting the foregoing, the Operator shall avoid collecting government identification details, financial information, medical or health-related information, children’s data, or other high-risk Personal Data unless such collection is strictly necessary for the Operator’s services and supported by appropriate notice, consent, safeguards, and internal controls.
• Use of Tokenised Public Links. The Operator shall use Tokenised Public Links only for authorised operational purposes, including intake forms, booking-related updates, stay-status pages, training-progress updates, pack-receipt pages, and other permitted Platform features. The Operator shall not publish, share, forward, or make available any Tokenised Public Link in a manner that may permit unauthorised access to Category B Data. The Operator shall be responsible for ensuring that links are shared only with the intended Data Principal or authorised recipient and shall promptly notify PetBoard if any Tokenised Public Link is suspected to have been accessed, disclosed, misused, or compromised without authorisation.
• Authorised Users and Access Controls. The Operator shall ensure that only duly authorised personnel are granted access to the Platform and Category B Data. The Operator shall maintain appropriate internal access controls, including timely onboarding and offboarding of users, role-based access allocation, password hygiene, device security, and restrictions on shared credentials. The Operator shall be responsible for all actions, omissions, instructions, entries, uploads, exports, deletions, downloads, and communications made through its account or by its authorised users.
• Staff and Employee Data. Where the Operator uploads Personal Data relating to its staff, employees, contractors, trainers, groomers, sitters, or other personnel, the Operator shall be solely responsible for providing appropriate notices and obtaining any required consents or lawful basis for such processing. The Operator shall ensure that such data is processed only for legitimate operational purposes, including scheduling, attendance, role allocation, service fulfilment, and related business administration.
• Data Principal Requests. The Operator shall be responsible for receiving, verifying, assessing, responding to, and maintaining records of all Data Principal requests relating to Category B Data, including requests for access, correction, completion, updating, erasure, withdrawal of consent, grievance redressal, and any other rights available under Applicable Data Protection Law. Where PetBoard’s assistance is required to fulfil a verified request, the Operator shall provide PetBoard with clear written instructions and reasonable supporting details. PetBoard shall not be required to act on any request relating to Category B Data unless instructed by the Operator, except where required by applicable law.
• Withdrawal of Consent and Erasure Requests. Where a Data Principal withdraws consent or requests deletion of Category B Data, the Operator shall promptly determine whether such request is valid and whether any lawful retention basis applies. The Operator shall then instruct PetBoard regarding deletion, restriction, retention, or other action required. The Operator shall be solely responsible for ensuring that continued retention of Category B Data after withdrawal of consent or deletion request is supported by applicable law or a legitimate legal requirement.
• Communications with Data Principals. The Operator shall be responsible for the content, legality, accuracy, timing, and recipient selection of all communications sent to Data Principals through or in connection with the Platform, including booking confirmations, reminders, intake requests, stay-status updates, promotional messages, and other notifications. The Operator shall ensure that any marketing or promotional communication is sent only where permitted under applicable law and supported by appropriate consent or lawful basis.
• Breach Cooperation and Notifications. The Operator shall promptly notify PetBoard upon becoming aware of any actual or suspected unauthorised access, disclosure, loss, misuse, compromise, or breach involving Category B Data, the Platform, the Operator’s account, its authorised users, or any Tokenised Public Link. The Operator shall cooperate with PetBoard in investigating, containing, remediating, and documenting such incident. The Operator shall remain responsible for notifying the Data Protection Board, affected Data Principals, and any other authority in respect of Category B Data where required under Applicable Data Protection Law, except to the extent the breach is attributable solely to PetBoard’s acts or omissions as Data Processor. Nothing in this Clause shall require PetBoard to make any notification directly to Data Principals in relation to Category B Data unless required by applicable law.
• Platform Configuration. The Operator shall be responsible for configuring intake forms, workflows, fields, user permissions, communication templates, retention preferences, exports, and other Platform settings in a manner consistent with Applicable Data Protection Law and the Operator’s own privacy notices and consents. The Operator shall not configure the Platform or use any Platform functionality to collect unlawful, excessive, misleading, discriminatory, or unnecessary Personal Data.
• Children’s Data and Parental Consent. To the extent the Operator collects or processes Personal Data of children through the Platform, the Operator shall be solely responsible for identifying such processing, obtaining verifiable parental consent where required, implementing age-appropriate safeguards, and ensuring that such processing does not involve tracking, behavioural monitoring, targeted advertising, or any other activity restricted under Applicable Data Protection Law.
• Records and Accountability. The Operator shall maintain appropriate records demonstrating its compliance with Applicable Data Protection Law in relation to Category B Data, including records of notices, consent artefacts, withdrawal records, Data Principal requests, deletion instructions, breach assessments, retention decisions, and lawful processing purposes. The Operator shall provide reasonable information to PetBoard where necessary for PetBoard to demonstrate compliance with its obligations as Data Processor.
• Restrictions on Uploads. The Operator shall not upload, store, transmit, or process through the Platform any data that is unlawful, obtained without proper authority, unrelated to the permitted purposes, or prohibited under the Terms of Use or this DPA. The Operator shall not use the Platform to process data for surveillance, profiling, credit scoring, targeted advertising, unlawful marketing, data brokerage, or any purpose not expressly permitted under this DPA.
• Third-Party Sharing by Operator. The Operator shall be solely responsible for any disclosure, export, download, transfer, or sharing of Category B Data by the Operator or its authorised users, whether to local devices, spreadsheets, cloud storage services, third-party software, communication tools, external systems, or any third party, including veterinarians, groomers, trainers, payment service providers, consultants, auditors, insurers, regulators, or other service providers. The Operator shall ensure that any such sharing is lawful, necessary, proportionate, and supported by appropriate contractual, confidentiality, and data protection safeguards.

6. SECURITY MEASURES

• PetBoard shall implement and maintain commercially reasonable technical and organisational measures appropriate to the nature, scope and sensitivity of the Processing. Such measures currently include, without limitation, encryption of Personal Data both at rest and in transit; role-based access controls based on the principle of least privilege; action-level audit logging for administrative, financial and care-related activities; automated backup and recovery mechanisms, including point-in-time recovery capabilities and periodically tested restoration procedures; and data minimisation practices designed to limit the collection and retention of Personal Data, including the deliberate non-collection of government-issued identification documents (such as Aadhaar), mechanisms to facilitate Data Principal rights requests, and self-service data export functionality for Operators. PetBoard shall continue to enhance its security programme in line with evolving industry practices and the scale and sensitivity of the Processing, including the phased implementation of additional administrative access controls, monitoring capabilities, and independent security testing, as appropriate.
• PetBoard shall implement logical and technical controls designed to ensure that Category B Data associated with one Operator remains logically segregated from the data of all other Operators. Category B Data submitted by or on behalf of one Operator shall not be shared with, pre-filled for, or otherwise made accessible to any other Operator except where expressly authorised by the relevant Operator or required by applicable law.

7. SUB-PROCESSORS

• Authorisation and Notice- The Operator grants PetBoard general authorisation to engage the Sub-Processors listed in Schedule 2. Each Sub-Processor is subject to appropriate confidentiality, security, and data protection obligations.

PetBoard shall maintain an up-to-date list of its authorised Sub-processors, which shall be made available to Operators through a publicly accessible webpage or other reasonable means. Where PetBoard proposes to appoint a new Sub-processor or make a material change to an existing Sub-processor that is reasonably likely to affect the Processing of Category B Data, PetBoard shall provide the Operator with at least fifteen (15) days' prior notice before such appointment or change becomes effective. During such notice period, the Operator may raise a reasonable written objection on legitimate data protection grounds. The Parties shall discuss such objection in good faith with a view to resolving the concern. If the Parties are unable to reach a mutually acceptable resolution, the Operator may terminate this DPA and the associated Terms without penalty and export or retrieve its Category B Data in accordance with this DPA.

• PetBoard shall use reasonable endeavours to ensure that each Sub-Processor is bound by data protection obligations no less protective than those required under Applicable Data Protection Law, to the extent such Sub-Processor's standard terms permit. PetBoard remains responsible for the acts and omissions of its Sub-Processors to the extent required under Applicable Data Protection Law, subject to the limitations of liability contained in the Terms of Use and this DPA. Where a Sub-Processor operates under its own standard terms which cannot be bilaterally modified, PetBoard's obligation shall be limited to selecting Sub-Processors whose published terms and certifications are consistent with Applicable Data Protection Law.

8. DATA PRINCIPAL RIGHTS

• Category A Data- PetBoard as Data Fiduciary- For Category A Data (Operator account, billing, and support data), PetBoard handles Data Principal rights requests directly in its capacity as Data Fiduciary, pursuant to its Privacy Policy and the DPDP Act. Operators' authorised users may exercise their rights by contacting PetBoard's Grievance Officer through the Grievance Redressal Mechanism as provided in the Privacy Policy.
• Category B Data — PetBoard as Data Processor- For Category B Data (pet-parent data), the Operator is the Data Fiduciary responsible for receiving, verifying, assessing and responding to Data Principal requests. PetBoard shall provide reasonable assistance to the Operator, taking into account the nature of the processing and the functionality of the Platform, to enable the Operator to comply with its obligations under Applicable Data Protection Law. Such assistance may include:
• providing functionality that enables the Operator to access, export, correct, update, restrict, or delete Category B Data through the Platform;
• implementing the Operator's lawful and documented instructions relating to Category B Data, where such action cannot reasonably be performed by the Operator through the Platform;
• processing deletion, correction, restriction, or consent-withdrawal instructions within a commercially reasonable period, subject to technical feasibility and any applicable legal retention requirements;
• notifying the Operator without undue delay if PetBoard receives a Data Principal request directly relating to Category B Data and, where appropriate, forwarding such request to the Operator for further handling.

PetBoard shall not be responsible for independently assessing the validity of any Data Principal request relating to Category B Data and may rely on the Operator's instructions in relation thereto.

9. PERSONAL DATA BREACH NOTIFICATION

• PetBoard shall notify the Operator without undue delay upon becoming aware of a Personal Data Breach affecting Category B Data. PetBoard shall provide the Operator with available information regarding the nature of the breach, the categories of data affected, the likely consequences, and the remediation measures taken or proposed, to the extent such information is reasonably available at the time. For Personal Data Breaches affecting Category A Data, PetBoard shall comply with its notification obligations under Applicable Data Protection Law in its capacity as Data Fiduciary. The Operator shall reasonably cooperate with the PetBoard in investigating, containing, and remediating any Personal Data Breach
• Operator's Obligations- The Operator, as Data Fiduciary for Category B Data, shall be responsible for assessing and fulfilling any notification obligations to the Data Protection Board, affected Data Principals, or other authorities under Applicable Data Protection Law. PetBoard shall provide reasonable assistance and technical information reasonably requested by the Operator in connection with such obligations.
• Platform-Level Response- PetBoard shall manage platform-level security monitoring, incident response, investigation, containment, and remediation activities relating to the Platform. Operators remain responsible for fulfilling their obligations as Data Fiduciaries in relation to Category B Data, including any notification or communication obligations under Applicable Data Protection Law.

10. DATA STORAGE AND CROSS-BORDER TRANSFERS

• Data Storage- PetBoard may store and process Personal Data using its own infrastructure and approved Sub-Processors in connection with the provision, maintenance, support, security, and improvement of the Platform. PetBoard shall implement reasonable measures to ensure that any processing of Personal Data is conducted in accordance with Applicable Data Protection Law and this DPA.
• Permitted Cross-Border Transfer- The Operator acknowledges and agrees that Personal Data may be processed, accessed, transmitted, or stored by PetBoard and its approved Sub-Processors in jurisdictions outside India in connection with the Services. PetBoard shall ensure that such processing is undertaken in accordance with Applicable Data Protection Law and subject to reasonably appropriate confidentiality, security, and data protection safeguards.

11. RETENTION AND DELETION

• Retention Periods- PetBoard shall retain Personal Data only for as long as necessary for the purposes set out in this Privacy Policy and DPA and as required or permitted by applicable law. For Category B Data, PetBoard may apply default retention settings within the Platform, and the Operator may request earlier deletion of Category B Data, subject to applicable legal requirements, technical limitations, and PetBoard's standard backup and retention practices.
• Deletion on Termination- Upon expiry or termination of this DPA, PetBoard shall securely delete all Category B Data, including backup copies, within thirty (30) calendar days, except where retention is required by law. Upon the Operator's written request PetBoard shall provide confirmation that deletion has been completed in accordance with its standard procedures.
• Inactive Accounts- Where an Operator account is inactive for twelve (12) continuous months, PetBoard shall notify the Operator. Absent a response within fifteen (15) days, PetBoard may delete Category B Data in accordance with its Company policy, and its data retention practices, unless continued retention is required by applicable law or is necessary for the establishment, exercise or defence of legal claims. Such notice shall include a means by which the Operator may export a complete copy of its Category B Data ("Export Everything") before any deletion takes effect.
• Category A Data- Retention of Category A Data is governed by PetBoard's Privacy Policy and applicable law.
• Retention as per Law - Notwithstanding the foregoing, PetBoard may retain records, invoices, payment information, tax records and any other information required to be retained under applicable law, including the Central Goods and Services Tax Act, 2017 and other applicable tax, corporate or regulatory laws, for the applicable statutory retention period. Such retained information shall continue to be protected in accordance with this DPA and shall not be processed for purposes incompatible with the applicable legal obligation.

12. CONFIDENTIALITY

• Each Party shall treat all Personal Data and Confidential Information of the other Party as strictly confidential. Disclosure is permitted only to: (a) employees, contractors, or Sub-Processors bound by equivalent obligations and with a need to know; (b) regulatory or judicial authorities as required by law (with prior notice to the extent legally permissible); or (c) with the other Party's prior written consent. PetBoard's confidentiality obligations for Category B Data survive termination.
• If PetBoard receives any legally binding request from a governmental, regulatory, law enforcement, or judicial authority seeking disclosure of Category B Data, PetBoard shall, unless prohibited by law, promptly notify the Operator and provide reasonable cooperation.

13. LIABILITY AND INDEMNITY

• Indemnity for Operator Breach. The Operator shall indemnify, defend, and hold harmless PetBoard, its directors, officers, employees, affiliates, and representatives from and against all claims, losses, penalties, damages, costs, expenses, regulatory actions, and liabilities arising out of or in connection with: (a) the Operator’s failure to provide required notices or obtain valid consent; (b) unlawful or excessive collection or upload of Category B Data; (c) unlawful instructions issued to PetBoard; (d) misuse of Tokenised Public Links; (e) breach of Platform access controls by the Operator or its authorised users; (f) failure to respond to Data Principal requests; or (g) any other breach by the Operator of its obligations as Data Fiduciary under this DPA or Applicable Data Protection Law. Operator's aggregate liability under this DPA shall not exceed the amounts paid by the Operator in the twelve (12) months preceding the event. The limitation to liability shall not apply in cases of gross negligence, wilful misconduct or breach of confidentiality.
• PetBoard’s Indemnity. PetBoard shall indemnify the Operator from any direct losses, damages, penalties, and reasonable costs finally awarded by a competent authority or agreed in settlement, to the extent arising directly from PetBoard’s material breach of its obligations as Data Processor under this DPA in respect of Category B Data, including any unauthorised processing or disclosure of Category B Data caused by PetBoard’s acts or omissions; provided that PetBoard shall not be liable to the extent such loss arises from the Operator’s unlawful instructions, failure to obtain valid consent or provide required notices, misuse of the Platform or Tokenised Public Links, inaccurate or unlawful data uploaded by the Operator, or breach of the Operator’s obligations as Data Fiduciary. PetBoard’s liability under this indemnity shall be subject to the limitation of liability set out in the Terms of Use and this DPA. PetBoard's aggregate liability under this DPA shall not exceed the amounts paid by the Operator in the twelve (12) months preceding the event. The limitation to liability shall not apply in cases of gross negligence, wilful misconduct or breach of confidentiality.

14. TERM AND TERMINATION

• This DPA shall become effective on the Effective Date and shall remain in force until the earlier of: (a) termination or closure of the Operator's Account or the Operator's access to the Services under the Terms of Use; or (b) deletion of Account in accordance with Clause 11.3 (Inactive Accounts), unless continued retention is required under applicable law. Termination or expiry of the Terms of Use shall automatically terminate this DPA, except to the extent that PetBoard continues to Process Category B Data in accordance with applicable law or this DPA. Clauses 11 (Retention and Deletion of Data), 12 (Confidentiality), 13 (Indemnity), together with any other provisions which by their nature are intended to survive termination, shall survive such termination.

15. GENERAL PROVISIONS

• Governing Law- This DPA is governed by and construed in accordance with the laws of India, including the DPDP Act.
• Dispute Resolution- Disputes shall first be subject to good-faith negotiation for thirty (30) days, failing which they shall be referred to arbitration under the Arbitration and Conciliation Act, 1996, with a sole arbitrator mutually agreed, seated at Bangalore, India.
• Amendments- PetBoard may amend this DPA to reflect changes in Applicable Data Protection Law. PetBoard shall provide the Operator with at least fifteen (15) days' prior written notice of any material amendment. During such notice period, the Operator may notify PetBoard in writing of any reasonable objection relating to the proposed amendment. The Parties shall discuss such objection in good faith with a view to reaching a mutually acceptable resolution. If the Parties are unable to resolve the objection before the effective date of the proposed amendment, the Operator may terminate this DPA and the associated Terms without penalty and export or retrieve its Category B Data in accordance with this DPA.
• Entire Agreement- This DPA, Terms of Use, Privacy Policy, and Schedules constitute the entire agreement on data protection and supersede any prior agreements or discussions. In the event of any dispute, the DPA shall prevail on data protection matters.
• Severability and Waiver- Invalid provisions shall be modified to the minimum extent necessary. No failure to exercise a right constitutes a waiver.

IN WITNESS WHEREOF, the Parties have executed this Data Processing Agreement as of the date of signing.

Grievance & Notices

Any grievance or notice under this DPA may be addressed to PetBoard’s Grievance Officer at grievance@petboard.in, in accordance with the Grievance Redressal Mechanism set out in the Privacy Policy.

FOR AND ON BEHALF OF PETBOARD TECHNOLOGIES PVT. LTD.

FOR AND ON BEHALF OF THE OPERATOR

SCHEDULE 1 — DETAILS OF PROCESSING

Part A — Category B Data (PetBoard as Data Processor)

Part B — Category A Data (PetBoard as Data Fiduciary)

SCHEDULE 2 — APPROVED SUB-PROCESSORS

The following Sub-Processors are approved as of the Effective Date for processing Category B Data.

© 2026 PetBoard Technologies Private Limited. All rights reserved.
Version 2.0 — Effective 1 August 2026
Sub-processor list revised 8 August 2026 (PostHog added, effective 24 August 2026) under §6.
Sub-processor list revised 2 October 2026 (Anthropic added, effective 18 October 2026) under §6.
Sentry region corrected to EU (Germany) 15 August 2026 — correction of an inaccurate entry; no change of sub-processor and no change to processing.