Version 1.0. Effective 10 October 2026. Published at: https://oclever.com/legal/dpa
This Data Processing Addendum ("DPA") forms part of the OClever Master Subscription Agreement (the "Agreement") between OClever Private Limited ("OClever") and the Customer named in, or that accepted, the Agreement. It applies automatically when the Agreement is accepted and needs no separate signature. A Customer that needs a countersigned copy for its records may request one at [email protected].
Capitalised terms not defined in this DPA have the meanings given in the Agreement.
1. Definitions
1.1 "Applicable Data Protection Law" means all laws relating to privacy and the processing of personal data that apply to a party's processing of Customer Personal Data under the Agreement, which may include: (a) the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 of India (the "DPDP Act"), as and when their provisions come into force; (b) the Information Technology Act, 2000 and the rules made under it, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, for as long as they apply; (c) Regulation (EU) 2016/679 (the "EU GDPR"); (d) the EU GDPR as it forms part of UK law and the UK Data Protection Act 2018 (the "UK GDPR"); (e) the Swiss Federal Act on Data Protection; (f) the California Consumer Privacy Act of 2018 as amended (the "CCPA") and similar US state laws; and (g) Canada's Personal Information Protection and Electronic Documents Act and similar laws.
1.2 "Customer Personal Data" means personal data contained in Customer Data that OClever processes on behalf of Customer under the Agreement, as described in Annex 1.
1.3 "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data processed by OClever or its Sub-processors.
1.4 "Sub-processor" means a third party engaged by OClever that processes Customer Personal Data.
1.5 "Data Subject" means the individual to whom Customer Personal Data relates, and includes a "Data Principal" under the DPDP Act.
1.6 The terms "controller", "processor", "data fiduciary", "data processor", "processing", "personal data", "business", "service provider", "sell" and "share" have the meanings given in Applicable Data Protection Law. A reference to "controller" includes "data fiduciary" and "business", and a reference to "processor" includes "data processor" and "service provider".
2. Roles and scope
2.1 Roles. For Customer Personal Data, Customer is the controller (or, where Customer acts for its own clients, a processor) and OClever is a processor (or sub-processor) acting on Customer's behalf.
2.2 Out of scope. This DPA does not apply to personal data that OClever processes as an independent controller, such as account and login details of Users, billing contact details, support communications and website visitor data. OClever processes that data under its Privacy Policy at https://oclever.com/privacy.
2.3 Details of processing. The subject matter, nature, purpose, duration, categories of data and categories of Data Subjects are described in Annex 1.
3. Customer's obligations
3.1 Customer is responsible for: (a) having a lawful basis, and where required valid consent, for the processing of Customer Personal Data under the Agreement, including through Connected Accounts; (b) giving Data Subjects all notices required by Applicable Data Protection Law, including notice that their data may be processed by service providers such as OClever; (c) the accuracy and quality of Customer Personal Data; and (d) ensuring that its instructions comply with Applicable Data Protection Law.
3.2 Customer must not provide OClever with special category or sensitive personal data (such as health, biometric, financial account or government identification data), or personal data of children, unless OClever agrees in writing in advance.
3.3 Customer must not include personal data in tracked prompts, because prompts are sent to Third-Party AI Platforms and data-collection service providers as described in Schedule A of the Agreement.
4. OClever's obligations
4.1 Instructions. OClever will process Customer Personal Data only on Customer's documented instructions, unless required otherwise by law, in which case OClever will inform Customer before processing unless the law prohibits it. The Agreement, this DPA, Customer's configuration of the Service and Customer's use of its features are Customer's complete instructions. Additional instructions require written agreement. OClever will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.
4.2 Purpose limitation. OClever will process Customer Personal Data only to provide, maintain, support and secure the Service, and to comply with law. Section 9.4 of the Agreement (Aggregated Data and service improvement) applies only to data that has been de-identified so that it no longer constitutes personal data.
4.3 Confidentiality. OClever will ensure that personnel authorised to process Customer Personal Data are bound by written confidentiality obligations or an appropriate statutory duty of confidentiality, and have access only to the extent necessary.
4.4 Security. OClever will implement and maintain the technical and organisational measures in Annex 2, which are designed to protect Customer Personal Data against Personal Data Breaches. OClever may update these measures provided it does not materially reduce the overall level of protection.
4.5 Completeness and accuracy. Where the DPDP Act requires, OClever will, on Customer's written instruction, correct, complete or update Customer Personal Data held in the Service.
5. Sub-processors
5.1 General authorisation. Customer gives general authorisation for OClever to engage Sub-processors. The current list is at https://oclever.com/legal/subprocessors.
5.2 Sub-processor obligations. OClever will (a) enter into a written agreement with each Sub-processor that imposes data protection obligations no less protective than those in this DPA, to the extent applicable to the services the Sub-processor provides, and (b) remain responsible to Customer for each Sub-processor's performance of those obligations.
5.3 Changes. OClever will give at least 30 days' notice before engaging a new Sub-processor, by updating the Sub-processors page and emailing Customers who have subscribed to updates on that page. Enterprise Customers will be notified by email to their account owner. In an emergency (for example, to maintain availability or security), OClever may engage a replacement Sub-processor with shorter notice, and will notify Customer as soon as reasonably practicable.
5.4 Objection. Customer may object to a new Sub-processor on reasonable data protection grounds by emailing [email protected] within the notice period. The parties will discuss the objection in good faith. If OClever cannot provide a reasonable alternative within 30 days, Customer may terminate the affected part of the Service by notice and receive a refund of prepaid Fees for the remaining Subscription Term for that part.
6. Data Subject requests
6.1 If OClever receives a request from a Data Subject relating to Customer Personal Data, it will direct the Data Subject to Customer and will not respond itself, except to confirm that the request relates to Customer, unless Customer instructs otherwise or the law requires.
6.2 Taking into account the nature of the processing, OClever will provide reasonable assistance, including through features of the Service, to enable Customer to respond to requests to access, correct, complete, update, erase or port Customer Personal Data, to withdraw consent or to nominate, and to handle grievances under Applicable Data Protection Law.
7. Assistance
7.1 OClever will provide reasonable information and assistance to help Customer comply with its obligations relating to security, breach notification, data protection impact assessments, data protection audits and consultation with regulators, taking into account the nature of the processing and information available to OClever.
7.2 OClever may charge reasonable fees for assistance that goes beyond what the Service's features provide, other than assistance needed because of OClever's own breach.
8. Personal Data Breach
8.1 Notification. OClever will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach. Notification will be sent to the Customer's account owner email address and any security contact Customer has provided.
8.2 Content. The notification will describe, to the extent then known: (a) the nature of the breach, including the categories and approximate number of Data Subjects and records concerned; (b) the likely consequences; (c) the measures taken or proposed to address it and mitigate its effects; and (d) a contact point. Where information is not available at once, OClever will provide it in phases without undue delay.
8.3 Response. OClever will take reasonable steps to contain, investigate and mitigate the breach, and will provide information reasonably required for Customer to notify the Data Protection Board of India, supervisory authorities and affected Data Subjects where Customer is required to do so.
8.4 Regulatory reporting by OClever. OClever will also make any report it is itself legally required to make, including reports of cyber security incidents to the Indian Computer Emergency Response Team (CERT-In) under directions issued under the Information Technology Act, 2000. Except where required by law, OClever will not notify Data Subjects or regulators of a Personal Data Breach on Customer's behalf without Customer's prior agreement.
8.5 No admission. OClever's notification of or response to a Personal Data Breach is not an admission of fault or liability.
9. Return and deletion
9.1 During the Export Window described in Section 8.8 of the Agreement, Customer may export Customer Data, including Customer Personal Data.
9.2 Within 30 days after the end of the Export Window, OClever will delete Customer Personal Data from its active systems. Copies in backups will be deleted in the ordinary course of backup rotation, and in any event within 90 days after the end of the Export Window.
9.3 Customer may request earlier deletion by emailing [email protected]. OClever will delete the data within 30 days of the request, after which it cannot be restored.
9.4 OClever may retain Customer Personal Data where required by law (including log retention required by CERT-In directions), in which case OClever will keep it confidential, protect it under this DPA, and process it only for the purpose for which the law requires its retention.
9.5 On request, OClever will confirm deletion in writing.
10. Audits and information
10.1 OClever will make available to Customer, on written request and subject to confidentiality, information reasonably necessary to demonstrate compliance with this DPA, including written responses to reasonable security questionnaires (not more than once a year, unless required by a regulator or following a Personal Data Breach), and any third-party audit reports or certifications OClever holds at the time.
10.2 If that information is not reasonably sufficient to demonstrate compliance, or a regulator requires it, Customer may conduct an audit, including an inspection, of OClever's processing of Customer Personal Data, subject to the following: (a) at least 30 days' written notice; (b) no more than once in any 12-month period, except following a Personal Data Breach or at a regulator's request; (c) during business hours, without disrupting OClever's operations; (d) by Customer or an independent auditor bound by confidentiality who is not a competitor of OClever; (e) limited to OClever's own systems, and not those of Sub-processors, whose audit reports OClever will make available where it has them; and (f) at Customer's cost, including OClever's reasonable costs of supporting the audit, unless the audit reveals a material breach of this DPA by OClever.
11. Data location and international transfers
11.1 Hosting. Customer Data is hosted on Amazon Web Services in the Mumbai (India) region.
11.2 Transfers outside India. Some Sub-processors process Customer Personal Data outside India, as stated on the Sub-processors page. Customer authorises these transfers. OClever will not transfer Customer Personal Data to any country or territory that the Government of India has restricted by notification under the DPDP Act.
11.3 Transfers from the EEA, UK and Switzerland. Where Customer Personal Data subject to the EU GDPR, UK GDPR or Swiss law is transferred to OClever in India, or onward to a Sub-processor in a country without an adequacy decision, the following apply and are incorporated into this DPA by reference:
(a) EU Standard Contractual Clauses. The standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 (the "SCCs"), with Module Two (controller to processor) applying where Customer is a controller and Module Three (processor to processor) applying where Customer is a processor. For both Modules: Clause 7 (docking clause) applies; under Clause 9, option 2 (general written authorisation) applies with the notice period in Section 5.3 of this DPA; the optional wording in Clause 11 does not apply; under Clause 13, the competent supervisory authority is determined by Customer's establishment or representative; under Clause 17, option 1 applies and the governing law is the law of Ireland; under Clause 18, disputes are resolved by the courts of Ireland. Annexes I and II of the SCCs are completed by Annex 1 and Annex 2 of this DPA, with Customer as data exporter and OClever as data importer.
(b) UK. For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (the "UK Addendum") applies. Table 1 is completed with the parties' details in the Agreement; Table 2 refers to the SCCs as completed in Section 11.3(a); Table 3 is completed by Annexes 1 to 3 of this DPA; and in Table 4, either party may end the UK Addendum as set out in its Section 19.
(c) Switzerland. For transfers subject to Swiss law, the SCCs apply as completed in Section 11.3(a), with references to the EU GDPR read as references to the Swiss Federal Act on Data Protection, the competent supervisory authority being the Swiss Federal Data Protection and Information Commissioner, and the term "member state" not being interpreted so as to exclude Data Subjects in Switzerland from bringing claims in their place of habitual residence.
(d) If the SCCs or UK Addendum are replaced or invalidated, the parties will cooperate in good faith to put in place an alternative lawful transfer mechanism.
11.4 Conflict. If the SCCs or UK Addendum conflict with this DPA or the Agreement, the SCCs or UK Addendum prevail to the extent of the conflict.
12. CCPA
To the extent the CCPA applies to Customer Personal Data, OClever acts as Customer's service provider and will not: (a) sell or share Customer Personal Data; (b) retain, use or disclose Customer Personal Data for any purpose other than the business purposes specified in the Agreement, or outside the direct business relationship between OClever and Customer; or (c) combine Customer Personal Data with personal data OClever receives from or on behalf of other persons, except as permitted by the CCPA. OClever will notify Customer if it can no longer meet its obligations under the CCPA, and Customer may then take reasonable steps to stop and remediate unauthorised processing. OClever certifies that it understands and will comply with these restrictions.
13. Liability, term and precedence
13.1 Each party's liability under or in connection with this DPA is subject to the limitations and exclusions of liability in the Agreement, except to the extent the SCCs or Applicable Data Protection Law do not permit such limitation as regards Data Subjects.
13.2 This DPA remains in effect for as long as OClever processes Customer Personal Data.
13.3 If this DPA conflicts with the Agreement on the processing of Customer Personal Data, this DPA prevails, subject to Section 11.4.
Annex 1: Details of processing
Parties. Data exporter: Customer, as identified in the Agreement or Order. Data importer: OClever Private Limited, Hanto Workspace, No. 2734, 3rd Floor, 16th Cross, HSR Layout, Bangalore South, Bengaluru 560102, Karnataka, India. Contact: [email protected].
Subject matter and purpose. Provision of the OClever AI visibility and marketing platform, including analysis of AI crawler traffic, integration with Customer's search and analytics accounts, AI-assisted content and ad creation, Knowledge Bases, and related support.
Nature of processing. Collection through Connected Accounts and uploads, storage, structuring, analysis, generation of Outputs, transmission to Sub-processors, display, export and deletion.
Duration. For the Subscription Term and the Export Window, plus the deletion period in Section 9.
Frequency of transfer. Continuous, for the duration of the Agreement.
Categories of Data Subjects. (a) Visitors to Customer's websites whose requests appear in CDN or server logs that Customer connects. (b) Individuals whose personal data appears in files, Knowledge Base content, brand material or instructions that Customer uploads (for example, Customer's staff, spokespersons or clients named in that material). (c) Individuals whose personal data appears in data imported from Customer's content management systems.
Categories of personal data. (a) From CDN and server logs: IP address, user-agent string, timestamp, requested URL, referrer, response status and similar request metadata. (b) From uploads and content systems: names, job titles, business contact details and other personal data that Customer chooses to include. (c) Data from Google Search Console and Google Analytics 4 is imported in aggregated form and is not expected to contain personal data.
Sensitive data. None is intended to be processed. Customer must not provide sensitive or special category data (Section 3.2).
Retention. As set out in Section 9. Log data used for AI crawler analysis is retained for the Subscription Term unless Customer deletes it earlier, subject to Section 9.4.
Sub-processor transfers. As listed on the Sub-processors page, for the purposes stated there.
Annex 2: Technical and organisational security measures
1. Hosting and infrastructure. Production systems and Customer Data are hosted on Amazon Web Services in the Mumbai (India) region, relying on AWS's physical and environmental security controls. 2. Encryption. Data is encrypted in transit using TLS 1.2 or higher. Data at rest in databases and storage is encrypted using AWS-managed encryption. 3. Credentials and tokens. User passwords are stored only as salted one-way hashes. Access tokens for AI assistant (MCP) connections are stored as one-way hashes. OAuth tokens for Connected Accounts are stored server-side, encrypted, and are never exposed to the browser. 4. Access control. Access to production systems is limited to authorised personnel on a least-privilege basis, protected by multi-factor authentication, and revoked promptly when no longer needed. 5. Tenant separation. Customer Data is logically separated by Account, and application-level access controls prevent one Account from accessing another's data. 6. Logging and monitoring. Administrative access and security-relevant events are logged and monitored. Logs are retained as required by applicable law, including CERT-In directions. 7. Backups and resilience. Customer Data is backed up regularly, backups are encrypted, and restoration is tested periodically. 8. Secure development. Code changes are reviewed before deployment, dependencies are monitored for known vulnerabilities, and secrets are kept out of source code. 9. Vulnerability management. Security patches for production systems are applied in a timely manner according to severity. 10. Incident response. OClever maintains an incident response process covering detection, containment, investigation, notification (including under Section 8 of this DPA and to CERT-In) and post-incident review. 11. Personnel. Personnel with access to Customer Data are bound by confidentiality obligations and receive guidance on data protection and security. 12. Vendor management. Sub-processors are assessed for security and data protection before engagement and are bound by written terms under Section 5. 13. Data minimisation. The Service imports aggregated data from Google Search Console and Google Analytics 4 rather than user-level data, and prompts sent to Third-Party AI Platforms are designed not to contain personal data.
Annex 3: Sub-processors
The list of Sub-processors is at https://oclever.com/legal/subprocessors and forms part of this Annex.