Rannkly Data Processing Agreement

Version 2.0 · Effective date: 30th Oct 2026

This Data Processing Agreement ("DPA") is between Codervalue Solutions Private Limited (CIN U72900UP2021PTC141154), H-109, Sector 63 Rd, H Block, Sector 63, Noida, Uttar Pradesh 201309, India, which operates Rannkly ("Rannkly"), and the customer that has agreed to the Rannkly Terms of Service or a signed Order Form ("Customer"). It forms part of that agreement (the "Agreement").

• Data Protection Laws:all laws that apply to the processing of Customer Personal Data under the Agreement, including India's Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 ("DPDP"), the Information Technology Act, 2000 and rules under it, the EU General Data Protection Regulation 2016/679 ("EU GDPR"), the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection, each as amended or replaced.
• Customer Personal Data:personal data in Customer Data (as defined in the Terms) that Rannkly processes on the Customer's behalf to provide the Services.
• Data Subject / Data Principal:the individual to whom Customer Personal Data relates.
• Controller / Data Fiduciary and Processor / Data Processor:as defined in the applicable Data Protection Laws. In this DPA, "controller" includes a Data Fiduciary and "processor" includes a Data Processor.
• Personal Data Breach:a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data, including a "personal data breach" under DPDP.
• Subprocessor:a third party engaged by Rannkly to process Customer Personal Data.
• SCCs:the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914.
• UK Addendum:the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.

Capitalised terms not defined here have the meaning given in the Terms.

This DPA takes effect on the date the Customer accepts the Terms or signs an Order Form that refers to it, and lasts as long as Rannkly processes Customer Personal Data. No separate signature is needed; a counter signed copy is available on request from vishnu@rannkly.com.

This DPA applies only to Customer Personal Data. Rannkly's processing of its own account, billing and marketing data is governed by the Rannkly Privacy Policy, where Rannkly is the controller.

If this DPA conflicts with the Terms on data protection, this DPA prevails. If the SCCs or UK Addendum apply and conflict with this DPA, they prevail.

The Customer is the controller (Data Fiduciary) of Customer Personal Data and Rannkly is its processor (Data Processor). Where the Customer acts as a processor for its own client (for example, a marketing agency), the Customer confirms it has authority from that client, and Rannkly acts as its subprocessor.

Annex 1 describes the subject matter, duration, nature and purpose of processing, the types of personal data and the categories of Data Subjects. Annex 1 is binding.

The Agreement, this DPA, and the Customer's configuration and use of the Services are the Customer's complete documented instructions. Further instructions must be in writing and consistent with the Agreement; instructions that change the scope or cost of the Services may require a change to the Order Form.

The Customer is responsible for:

• having a lawful basis, and giving any notice and obtaining any consent required, for Rannkly to process Customer Personal Data, including for review requests, campaigns, WhatsApp and SMS messages, AI calls and call recording;
• honouring withdrawals of consent, opt-outs and do-not-disturb preferences in its contact lists;
• the accuracy and quality of Customer Personal Data;
• configuring retention settings, AI auto-publish and call-recording settings appropriately.

Restricted data.The Customer will not submit health data, biometric data, government identification numbers, financial account or card numbers, or other special category data, unless a Service feature is designed for it and the parties have agreed in writing. The Customer will not use the Services to process the personal data of children (under 18) unless it has obtained verifiable parental consent as required by DPDP Sec. 9 and has told Rannkly in writing.

Instructions.Rannkly will process Customer Personal Data only on the Customer's documented instructions, including for transfers outside India or the EEA, unless the law requires otherwise. In that case Rannkly will tell the Customer before processing, unless the law prohibits it.

Unlawful instructions.Rannkly will promptly tell the Customer if it believes an instruction breaches Data Protection Laws, and may suspend that processing until the instruction is confirmed or changed.

No other use.Rannkly will not sell Customer Personal Data, use it for its own marketing or advertising, combine it with data from other customers to build profiles, or retain, use or disclose it outside the direct business relationship with the Customer, except to create aggregated, de-identified statistics as allowed by the Terms.

Personnel.Rannkly will ensure that everyone authorised to process Customer Personal Data is bound by confidentiality, receives privacy and security training, and has access only as needed for their role.

Requests from authorities.If a government authority, court or law enforcement agency asks Rannkly for Customer Personal Data, Rannkly will: (a) try to redirect the request to the Customer; (b) notify the Customer promptly before disclosing, unless the law prohibits it; (c) challenge requests it reasonably considers unlawful or overbroad; and (d) disclose only the minimum required.

Rannkly will implement and maintain the technical and organisational measures in Annex 2, appropriate to the risk, including protection against accidental or unlawful destruction, loss, alteration, and unauthorised disclosure or access, as required by GDPR Art. 32 and DPDP Sec. 8(5) and Rule 6.

Rannkly may update Annex 2 over time, provided the update does not materially reduce the overall level of protection.

The Customer gives general authorisation for Rannkly to engage Subprocessors. The current list is at https://www.rannkly.com/subprocessors.

Rannkly will:

• impose data protection obligations on each Subprocessor, by written contract, that are no less protective than this DPA;
• carry out due diligence on each Subprocessor's security and privacy practices before engaging it;
• remain fully liable to the Customer for each Subprocessor's performance.

New Subprocessors.Rannkly will notify the Customer of a new Subprocessor at least 30 days in advance by email to the account owner and by updating the Subprocessors page. In an emergency, such as a provider's sudden failure, notice may be shorter, and Rannkly will explain why.

Objections.The Customer may object on reasonable data protection grounds within 15 days of notice. The parties will discuss alternatives in good faith for up to 30 days. If none is found, the Customer may terminate the affected Services without penalty and receive a prorate refund of prepaid fees for the remaining term.

Rannkly will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. This gives the Customer time to meet the DPDP requirement to report to the Data Protection Board of India within 72 hours, and the GDPR 72-hour deadline.

The notice will include, as far as then known: the nature and scope of the breach; the categories and approximate number of Data Subjects and records affected; the likely consequences; the measures taken or proposed; and a contact person. Rannkly will update the Customer as more information becomes available.

Rannkly will promptly take reasonable steps to contain, investigate and remediate the breach, preserve evidence and logs, and cooperate with the Customer's investigation and notifications.

Rannkly will not notify Data Subjects or regulators about a breach of Customer Personal Data on the Customer's behalf without its approval, unless the law requires Rannkly to. Notification by Rannkly is not an admission of fault.

Data Subject requests.Rannkly provides tools in the Services that let the Customer access, correct, export and delete Customer Personal Data. If those tools are not enough, Rannkly will help the Customer respond to requests from Data Subjects under Data Protection Laws. If Rannkly receives a request directly, it will forward it to the Customer within 5 working days and will not respond itself except to confirm the request was forwarded.

Assessments and regulators.Rannkly will provide reasonable information and help for the Customer's data protection impact assessments, consultations with regulators, and DPDP compliance obligations, taking into account the nature of processing and information available to Rannkly.

Cost.Assistance under this section is free, except where a Customer's requests are manifestly excessive or repetitive, or require work beyond the standard Services, in which case Rannkly may charge reasonable fees agreed in advance.

Rannkly hosts Customer Personal Data primarily in India (AWS Mumbai, ap-south-1). Some Subprocessors at https://www.rannkly.com/subprocessors process data outside India.

From India.Rannkly will transfer Customer Personal Data outside India only in compliance with DPDP Sec. 16 and any restrictions the Central Government notifies, and with the safeguards in this DPA.

Rannkly will ensure that Subprocessors outside the EEA that process EU personal data are bound by the SCCs or another valid transfer mechanism, such as the EU-US Data Privacy Framework.

Rannkly will make available to the Customer, on request and under confidentiality, the information needed to show compliance with this DPA, including completed security questionnaires (once a year), summaries of penetration test results and current certification reports.

If that information is not enough to show compliance, or a regulator requires it, or after a Personal Data Breach, the Customer (or an independent auditor bound by confidentiality who is not a Rannkly competitor) may audit Rannkly once per year with at least 30 days' written notice, during business hours, in a way that minimises disruption and does not compromise other customers' data.

Each party bears its own audit costs. If an audit finds a material breach of this DPA, Rannkly will reimburse reasonable audit costs and fix the breach promptly.

After the Agreement ends, the Customer may export Customer Personal Data during the 30 day Export Window set out in the Terms.

Rannkly will then delete Customer Personal Data from production systems within 60 days, and from backups within a further 35 days as they are overwritten, and will certify deletion in writing on request.

Rannkly may keep Customer Personal Data only where law requires it, and then only for the required period, isolated from further processing and still protected by this DPA.

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms, including any higher cap for data protection breaches agreed in an Order Form.

Nothing in this DPA limits either party's liability to Data Subjects under the SCCs or under Data Protection Laws where the law does not allow it to be limited.

• Rannkly Data Protection Officer: Vishnu Sharma, vishnu@rannkly.com 
• Security incidents: vishnu@rannkly.com 
• The Customer's privacy contact is the account owner unless the Customer names another contact in the account settings or in writing.

This DPA ends when Rannkly no longer processes any Customer Personal Data. Sections 8, 12 and 13 survive.

Rannkly may update this DPA to reflect changes in law or the Services, with at least 30 days' notice for material changes. Changes will not reduce the level of protection for Customer Personal Data during the current Subscription Term unless required by law.

This DPA is governed by the law that governs the Terms, except where the SCCs or Data Protection Laws require otherwise. If any provision is unenforceable, the rest remains in force.