Data Processing Addendum
Last updated: September 29, 2026
This Data Processing Addendum ("DPA") is part of the Terms of Service between you (the "Customer") and Baljia AI ("Baljia"). It applies when Baljia processes personal data on your behalf while providing the platform, and takes effect on September 28, 2026 or, if later, when you accept the Terms. Baljia AI is operated by Baljia AI Private Limited, India. If this DPA conflicts with the Terms on data protection, this DPA wins.
1. Scope and roles
- Customer personal data means personal data that Baljia processes for you through the platform, including your prospects and contacts, people who message or comment on your connected accounts, recipients of messages Baljia sends for you, and the users of apps and websites Baljia builds and hosts for you.
- For customer personal data, you are the controller (data fiduciary) and Baljia is your processor. Baljia is a separate controller for the account, billing and usage data described in our Privacy Policy.
- You are responsible for having a lawful basis for the processing, for the notices you give to the people concerned, and for the instructions you give Baljia.
2. Details of the processing
- Subject matter and purpose: providing the platform, including building and hosting apps, finding prospects, sending and replying to messages, publishing content, and running ads, as you direct.
- Duration: for the term of your use of the platform, then until deletion under section 9.
- Data subjects: your prospects, contacts, customers, app users, and people who interact with your connected accounts.
- Categories of data: names, business contact details, job titles and companies, public profile and post data, message and comment content, and the data your app users enter in your apps.
- Sensitive data: you should not use the platform to process special-category or sensitive personal data unless the law allows it and you have told us in writing.
3. Processing on your instructions
Baljia processes customer personal data only on your documented instructions, which are these Terms and DPA, your configuration of the platform, and the tasks, approvals and automations you set, unless the law requires otherwise. If the law requires other processing, we will tell you first unless the law forbids it. We will tell you if we believe an instruction breaks data protection law.
4. Confidentiality
Baljia ensures that everyone it authorises to process customer personal data is bound by a duty of confidentiality, and gives access only to those who need it.
5. Security
Baljia maintains appropriate technical and organisational measures to protect customer personal data, including encryption in transit, encryption of access tokens, keys and passwords when we store them, separation of each customer's data within the platform, access controls, revocable sessions, and audit records for sensitive actions. We may update these measures as long as the overall level of protection does not decrease.
6. Subprocessors
You authorise Baljia to use the subprocessors listed on our Subprocessors page. Baljia requires its subprocessors to protect personal data under written terms appropriate to the service they provide, and remains responsible for their performance. Baljia aims to give notice of a new subprocessor at least 14 days in advance to customers who have asked for change notices at privacy@baljia.ai. If you object on reasonable data protection grounds, we will work with you in good faith to find a solution; if we cannot, you may stop using the affected feature or end your subscription.
7. Assistance
Taking into account the nature of the processing, Baljia will help you respond to requests from people exercising their data protection rights (access, correction, deletion, objection and others). If Baljia receives such a request directly about customer personal data, it will pass the request on to you and act on it only on your instructions or where the law requires, except that when a person asks not to be contacted, Baljia marks them as opted out of your outreach straight away. Baljia will also give reasonable help with data protection impact assessments and consultations with regulators where the law requires them.
8. Personal data breaches
Baljia will notify you without undue delay, and aims to do so within 72 hours, after becoming aware of a personal data breach affecting customer personal data. The notice will describe what happened, the data and people likely affected, the likely consequences, and the steps taken or proposed, with further details as they become available.
9. Deletion or return at the end
When you ask us to close your account, or on your other written request, Baljia will delete customer personal data, or return it to you first if you ask before deletion, as described on our Data Deletion page. This includes, when you ask for it, the data your app users entered in apps Baljia hosts for you. We delete it within 30 days of confirming your request, except where the law requires us to keep it. Deletion is permanent and cannot be undone. Backup copies are deleted when the backup lifecycle completes.
10. Information and audits
Baljia will make available the information reasonably needed to show compliance with this DPA, in response to reasonable written requests sent to privacy@baljia.ai, no more than once a year unless a regulator requires it or there has been a personal data breach. Information we share is confidential.
11. International transfers
Baljia and its subprocessors may process customer personal data outside the country where it was collected. Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, where required we rely on Standard Contractual Clauses or another lawful transfer mechanism for that transfer.
12. Liability
Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service, except where the law does not allow them to be limited.
13. Contact
Questions about this DPA: privacy@baljia.ai.