Legal

Data Processing Addendum

This Data Processing Addendum ("DPA") sets out the terms on which Liyagent Private Limited processes personal data on behalf of its customers. It forms part of the customer's order form, master agreement or other agreement for Liyagent's products and services (the "Agreement").

Last updated 23 October 2026Liyagent Private Limitedliyagent.com

Liyagent Private Limited is a private limited company being incorporated in India. Its Corporate Identity Number and registered office will be published here once issued. A UK company will follow.

01Parties, scope and order of precedence

In this DPA, "Liyagent" means Liyagent Private Limited (CIN U62011KA2026PTC230273, registered office [to be published]), and "Customer" means the entity that signed the Agreement. Terms such as "controller", "processor", "personal data", "processing", "data subject", "personal data breach" and "supervisory authority" have the meanings given in the GDPR. "Data Protection Law" means, as applicable, Regulation (EU) 2016/679 (the GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, India's Digital Personal Data Protection Act, 2023 and its Rules (the DPDP Act), and the California Consumer Privacy Act as amended (the CCPA). "Customer Personal Data" means personal data that Liyagent processes on Customer's behalf in providing the services.

This DPA applies when Liyagent processes Customer Personal Data: when it hosts a pilot or a deployment for Customer, provides support with access to Customer's environment or data, or receives Customer Personal Data in any other way under the Agreement. For a deployment that Customer runs itself, in its own environment and with its own AI models, Liyagent does not ordinarily receive Customer Personal Data, and this DPA applies only to what Customer chooses to give Liyagent access to.

If this DPA conflicts with the Agreement, this DPA prevails for the processing of Customer Personal Data. If it conflicts with the Standard Contractual Clauses, the Standard Contractual Clauses prevail.

02Roles and instructions

• Customer is the controller of Customer Personal Data (or a processor acting for its own controller), and Liyagent is its processor (or sub-processor). Under the DPDP Act, Customer is the data fiduciary and Liyagent is its data processor.
• Liyagent processes Customer Personal Data only on Customer's documented instructions, which are the Agreement, this DPA, and Customer's configuration and use of the services (for example, which agents it enables, which systems it connects, which AI models it chooses, and the retention periods it sets). Liyagent tells Customer promptly if it believes an instruction infringes Data Protection Law.
• If a law requires Liyagent to process Customer Personal Data otherwise, Liyagent tells Customer first, unless that law forbids it.
• Customer is responsible for the lawfulness of its instructions, for having a lawful basis (and, for special category data, a condition under GDPR Article 9) for the processing, and for the notices it gives data subjects.
• Under the CCPA, Liyagent is a service provider: it does not sell or share Customer Personal Data, retain, use or disclose it outside the direct business relationship or for any purpose other than providing the services, or combine it with other personal data except as the CCPA permits.

03Details of the processing (Annex I)

Subject matter

Providing Liyagent's governed AI agent platform (TicketIQ and the Liya agents for IT service, HR, SAP and finance), the hosted pilot or deployment, and support.

Duration

The term of the Agreement, plus the period until the data is deleted or returned as described under deletion or return at the end.

Nature and purpose

Receiving requests from Customer's channels (for example Microsoft Teams, email, Jira, ServiceNow or a web chat); classifying, routing, de-duplicating and answering them with AI agents; looking up and, with confirmation, updating records in Customer's connected systems; storing tickets, conversations, knowledge and audit records; and support.

Categories of data subjects

Customer's employees, contractors and other users of the services; people who send requests through Customer's channels (for example Customer's own customers); people named in those requests or in Customer's knowledge.

Categories of personal data

Identity and contact data (name, email address, user principal name, employee or customer number); request content (ticket text, chat messages, emails and attachments); records the agents look up in connected systems (for example HR records such as time-off balances, onboarding tasks and job details; purchasing and invoice records); account, access and audit data; usage data.

Special category data

Not intended. HR agents may receive it if a person volunteers it. The services refuse sensitive HR matters at the input guardrail, escalate them to Customer's HR team and keep their transcripts as metadata only; Customer decides any further measures under GDPR Article 9.

Frequency

Continuous, for the term of the Agreement.

Retention

As Customer configures it (retention windows per store and per tenant, above a minimum floor, with legal holds), and otherwise until the end of the Agreement. Defaults are listed in the documentation.

Sub-processors

As listed on the sub-processors page (Annex III).

04Liyagent's obligations

• Confidentiality. Liyagent ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality, and gives access only to those who need it to provide the services.
• Security. Liyagent implements the technical and organisational measures in Annex II, and reasonable security safeguards under the DPDP Act, appropriate to the risk. It may update them provided the overall level of protection does not decrease.
• No other use. Liyagent does not use Customer Personal Data to train AI models, for its own purposes, or to build profiles.
• Records. Liyagent keeps the records of processing GDPR Article 30(2) requires.

05Technical and organisational measures (Annex II)

These are measures the services implement today. Customer configures several of them for its own deployment.

Liyagent does not hold third-party security certifications at the date of this DPA and does not claim any.

06Sub-processors

• Customer gives Liyagent general written authorisation to engage the sub-processors on the sub-processors page, and new ones under this section.
• Liyagent gives at least 30 days' notice before a new sub-processor processes Customer Personal Data, by updating that page and, if Customer has asked at privacy@liyagent.com, by email.
• Customer may object on reasonable data protection grounds within the notice period. The parties will discuss it in good faith; if Liyagent cannot offer a reasonable alternative, Customer may terminate the affected services and receive a refund of prepaid fees for the period after termination.
• Liyagent imposes on each sub-processor, by written contract, data protection obligations that offer at least the same protection as this DPA, and remains liable to Customer for its sub-processors' performance.
• For self-hosted deployments, the AI model providers and other services Customer chooses are engaged by Customer, not by Liyagent, and are not Liyagent's sub-processors.

07Assistance with data subject requests and assessments

• Data subject requests. Liyagent forwards to Customer, without undue delay, any request it receives from a data subject about Customer Personal Data, and does not answer it except on Customer's instructions. The services give Customer tools to answer requests itself: search for a person across every store, export their data as JSON, and erase it with a receipt per store and a residual check (see the documentation). Where Customer needs more, Liyagent assists by appropriate technical and organisational measures.
• Assessments and consultations. Liyagent gives Customer reasonable information and assistance for data protection impact assessments and prior consultations with supervisory authorities about the services, including the services' documentation, its EU AI Act screening records, and audit-log exports.

08Personal data breaches

Liyagent notifies Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notice describes, as far as then known, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point; further information follows as it becomes available. Liyagent takes reasonable steps to contain and remedy the breach and gives Customer the assistance it needs to notify supervisory authorities (including the Data Protection Board of India) and data subjects. Notifying a breach is not an admission of fault.

09Deletion or return at the end

When the services end, Liyagent, at Customer's choice, returns Customer Personal Data (Customer can export it through the services' export functions) or deletes it, within 30 days, and confirms deletion in writing on request, unless a law requires Liyagent to keep it, in which case Liyagent keeps it confidential and processes it only as that law requires. Copies in backups are deleted as the backups are replaced. For a self-hosted deployment the data stays with Customer, and Liyagent deletes any copies it was given.

10Information and audits

Liyagent makes available to Customer the information necessary to demonstrate compliance with GDPR Article 28 and this DPA, including written answers to reasonable security questionnaires and exports of the audit log for Customer's deployment. If that information is not enough, Customer (or an independent auditor bound by confidentiality, not a competitor of Liyagent) may audit Liyagent's compliance once a year, or after a personal data breach or at a supervisory authority's request, on at least 30 days' notice, during business hours, without disrupting Liyagent's operations or other customers' data, and at Customer's cost.

11International transfers

• EU Standard Contractual Clauses. Where Customer Personal Data subject to the GDPR is transferred to Liyagent or its sub-processors in a country without an adequacy decision, the Standard Contractual Clauses in the Annex to Commission Implementing Decision (EU) 2021/914 are incorporated into this DPA by reference: Module 2 (controller to processor) where Customer is a controller, and Module 3 (processor to processor) where Customer is a processor. For both: Clause 7 (docking) applies; in Clause 9, option 2 (general written authorisation) applies with the notice period under sub-processors; the optional wording in Clause 11 does not apply; in Clause 13, the competent supervisory authority is the one determined by Customer's establishment or representative; in Clause 17, option 1 applies and the governing law is that of Ireland; in Clause 18, the courts of Ireland. Annex I is details of the processing, Annex II is technical and organisational measures, and Annex III is the sub-processors page.
• UK. For Customer Personal Data subject to the UK GDPR, the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0) is incorporated, with its Tables 1 to 3 completed from this DPA, and either party may end it as its section 19 allows.
• Switzerland. For data subject to the Swiss FADP, the Standard Contractual Clauses apply with references to the GDPR read as references to the FADP and the competent authority being the Federal Data Protection and Information Commissioner.
• India. Liyagent transfers Customer Personal Data out of India only in accordance with the DPDP Act, and not to any country the Government of India restricts.
• Hosting locations for the hosted services are on the sub-processors page; a customer can require that its AI model calls stay in a chosen geography using the services' residency controls.

12India: DPDP Act

Where Customer is a data fiduciary under the DPDP Act, Liyagent processes Customer Personal Data as its data processor only under this DPA (DPDP Act section 8(2)); implements reasonable security safeguards to prevent personal data breaches (section 8(5)); informs Customer of any personal data breach so that Customer can inform the Data Protection Board of India and affected data principals; helps Customer meet data principals' rights to information, correction, erasure and grievance redressal; and erases Customer Personal Data when Customer withdraws its instruction or the purpose is served, unless a law requires retention.

13General

This DPA lasts as long as Liyagent processes Customer Personal Data. Each party's liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Law or the Standard Contractual Clauses do not allow them. If a provision is invalid, the rest remains in force. Questions about this DPA: privacy@liyagent.com. To sign a copy of this DPA, write to the same address.