Data Processing Addendum

Purpose and parties

This Data Processing Addendum ("DPA") is part of the agreement between the Customer and Tuling Creative Hub ("Tuling"). In it, the Customer is the Data Fiduciary and Tuling is the Data Processor, as those terms are used in the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it. This DPA applies to the personal data the Customer puts into Tuling HRMS ("Customer Personal Data"), including employee and candidate data.

Customer's responsibilities

• The Customer decides the purposes and means of processing and is responsible for notices, consent or other lawful basis, and the accuracy of what it enters.
• The Customer gives Tuling only the personal data needed for the Service and uses role-based access in line with its own policies.

What Tuling will do

• Process Customer Personal Data only on the Customer's documented instructions (the agreement, its use of the Service, and this DPA) and as the law requires.
• Make sure people authorised to process the data are bound by confidentiality.
• Apply reasonable security safeguards (see Security below).
• Help the Customer respond to requests from data principals (access, correction, erasure, grievance), through the product tools and on reasonable request.
• Help the Customer meet its duties on breach notification and data protection assessments, with information we hold.
• Not use Customer Personal Data to train third-party models or for our own marketing, and not sell it.

Security

Tuling maintains reasonable security safeguards appropriate to the risk, including access controls by role, firewalling of servers, logging, and separation of each customer's data inside the system. Tuling will keep these measures in place during the term and will not materially reduce them. The Customer may ask in writing for a description of current measures.

Personal data breach

If Tuling becomes aware of a personal data breach affecting Customer Personal Data, it will tell the Customer without undue delay and in any case within 72 hours, and give the information it has to help the Customer notify the Data Protection Board of India and affected people as the law requires. Tuling will take steps to contain and fix the breach.

Sub-processors

The Customer agrees that Tuling may use the sub-processors listed on the Sub-processors page. Tuling will remain responsible for them, bind them to terms no less protective than this DPA, and give the Customer at least 30 days' notice before adding or replacing a sub-processor. The Customer may object in writing on reasonable data protection grounds, and the sides will work in good faith to resolve it.

Location and transfers

Tuling hosts the application and its database in India. Tuling will not transfer Customer Personal Data outside India except where Indian law permits, to a sub-processor listed on the Sub-processors page, or on the Customer's written instruction.

Return and deletion

On ending the agreement, the Customer may export its data for 30 days. After that, Tuling will delete Customer Personal Data from live systems, and from backups as they expire in the normal cycle, unless the law requires it to be kept. Tuling will confirm deletion on written request.

Audit

Tuling will give the Customer the information reasonably needed to show compliance with this DPA, and allow a reasonable audit once a year on 30 days' written notice, in business hours, at the Customer's cost, subject to confidentiality and without access to other customers' data.

Liability and order of precedence

Liability under this DPA is subject to the limits in the Terms of Service. If this DPA conflicts with the Terms on the processing of personal data, this DPA applies.

Contact

Data protection questions: support@tulingcreativehub.com. Effective date: 2 November 2026.