Data Processing Agreement

IrisOS, available at https://irisos.app, is operated by GRL Enterprises (we, us, or our). Our business address is 307, Grima Unnathi, Kyalasanahalli, Bengaluru – 560077, Karnataka, India.

This DPA governs Personal Data in Customer Data processed by GRL Enterprises for the Customer through IrisOS. Personal Data is information relating to an identified or identifiable individual as defined by applicable law. The Customer is controller/data fiduciary or an authorized processor; GRL Enterprises is processor or subprocessor for those instructions. Operator-controlled account, billing, support and security activities remain governed by the Privacy Policy and applicable law.

The DPA prevails over conflicting service terms on processor obligations. Mandatory law and an applicable executed transfer instrument prevail over this DPA. The obligations in this DPA apply throughout the covered processing.

Processing supports the Workspace services described in Annex A, for the duration of the customer service relationship and any lawful return/deletion period. Documented instructions include the accepted agreement, settings, authorized user requests and lawful written directions consistent with the service.

GRL Enterprises will process the covered data only on documented instructions, including transfer instructions, unless legally required otherwise. In that case it will inform the Customer before processing unless law prohibits notice. It will inform the Customer if an instruction appears to infringe applicable data-protection law and may pause the affected processing pending resolution.

The Customer must have authority to provide the instructions and data, give required notices, establish lawful grounds, manage authorized access and avoid unsupported sensitive-data use. If acting for another controller, the Customer must obtain the necessary authorization.

GRL Enterprises will restrict covered data access to authorized persons bound by confidentiality duties and implement measures appropriate to risk under applicable law. Annex B describes controls evidenced in source and identifies matters requiring deployment verification. It does not claim certification or that every operational measure has already been established.

The Customer is responsible for lawful configuration, endpoints, credentials and user permissions. The parties will cooperate on material security issues affecting the processing; neither party’s responsibilities excuse the other’s legal duties.

The Customer gives general written authorization for GRL Enterprises to use the subprocessors identified in the Provider Register to the extent they are used to provide the Customer’s enabled services. GRL Enterprises will bind each subprocessor to data-protection obligations appropriate to the processing and remain responsible for its performance to the extent required by applicable law.

GRL Enterprises will give advance written notice of a proposed new or replacement subprocessor and a reasonable opportunity for the Customer to object on data-protection grounds. The parties will seek a suitable alternative or agree how to end the affected service if an objection cannot be resolved.

Customer-connected services and a payment provider’s independent activities are not automatically IrisOS subprocessors. Their roles follow the actual purpose, relationship and contract.

• Provider Register

The parties will identify processing locations and implement legally required safeguards before a restricted transfer. Where relevant, this may require executed EU standard contractual clauses with the correct module and completed annexes, an appropriate UK IDTA/Addendum, and transfer assessments and supplementary measures. This DPA neither incorporates unspecified clauses nor claims that transfer instruments have been executed. A residency-restricted workload requires a separately verified arrangement.

Taking account of the nature of processing and information available, GRL Enterprises will assist the Customer with applicable access, correction, deletion, restriction, portability, objection and other rights requests through appropriate technical and organizational measures. Requests received directly will be referred to the Customer where appropriate; we will not independently decide requests about customer-controlled data unless authorized or required by law.

GRL Enterprises will provide reasonable information and assistance needed for the Customer’s applicable security, breach-response, impact-assessment and supervisory-consultation duties. Any additional service charges must be agreed in advance and cannot obstruct mandatory duties.

GRL Enterprises will notify the Customer without undue delay after becoming aware of a personal-data breach affecting covered processing where this is required of the processor under applicable law. The notice will provide available details of the incident, affected data and individuals, likely consequences, contact point and measures taken or proposed, with updates as information becomes available.

The parties will cooperate on containment, remediation and legally required notices. The Customer remains responsible for controller notifications unless law requires otherwise. This is not a universal promise of a fixed notification deadline for every event; applicable legal and expressly agreed contractual deadlines govern.

GRL Enterprises will make available information reasonably necessary to demonstrate compliance with its applicable processor obligations and allow and contribute to legally required audits, including inspections by the Customer or its mandated independent auditor. The parties may coordinate confidentiality, access controls, reasonable scheduling and scope to protect other customers and service security, without restricting mandatory supervisory or audit rights.

No SOC 2, ISO 27001, GDPR certification or independent audit report is represented as available by this DPA. Requests for evidence should identify the processing and requirement concerned.

At the end of processing services, and at the Customer’s choice as required by applicable law, GRL Enterprises will return or delete covered Personal Data and existing copies unless law requires retention. GRL Enterprises and the Customer will coordinate a feasible return format, schedule and backup handling. Available feature downloads are not a complete automated workspace export.

Current self-service controls have the limits described in the Privacy Policy: a workspace wipe preserves account and certain other records; entire-account deletion is organization-wide and separates application and authentication removal. Neither automatically proves deletion from provider systems, support copies or all cached artifacts. Where self-service controls do not complete a required return or deletion, GRL Enterprises will use an assisted procedure consistent with applicable law, provider constraints and lawful retention requirements.

Legally retained data must be limited to the necessary purpose and protected until deletion is permitted. Any backup retention, restoration suppression and final deletion timeline must be verified and documented; no unsupported retention period is stated.

• Privacy Policy

Liability follows the limitations in the accepted Terms, subject to mandatory data-subject remedies, applicable law and any controlling transfer instrument. This DPA creates no additional unlimited contractual indemnity. Indian law and competent Bengaluru courts apply subject to non-waivable rights and any required transfer-instrument law/forum.

For matters concerning GRL Enterprises in its role as a data processor or subprocessor under this DPA, email cto.admin@irisos.app or write to GRL Enterprises at the business address above. Include the relevant customer, Workspace and processing request; do not send passwords or payment-card credentials.

• Data subjects: customer personnel, contractors, leads, clients and their contacts, document signers, message participants and other people whose data the customer lawfully submits.
• Data categories: identity/contact details, roles, project/task records, commercial and invoice details, documents/signature evidence, messages and encrypted attachment records, calendar/advertising data, OAuth credentials, prompts, AI outputs and related usage metadata.
• Operations and purposes: collection, hosting, retrieval, organization, editing, calculation, communication, document generation/signing, AI inference and routing, authorized synchronization, access control, export and deletion for the customer’s business workflows.
• Frequency and duration: user-triggered and configured workflow processing throughout the service relationship, subject to lawful deletion and retention instructions. Optional integrations and AI receive only data passed through their enabled workflow; supported-provider status is not proof of every production deployment.
• Special-category data: no general authorization or assurance for regulated sensitive-data workloads. Any such use requires an expressly supported feature, lawful basis and documented safeguards.
• Systems and recipients: Prisma/PostgreSQL application storage, Supabase authentication, configured hosting and communications, AI providers and customer-selected integrations used for the Customer’s enabled workflows as specified in the Provider Register. GRL Enterprises will provide available processing-location information on request and implement any legally required transfer mechanism before a restricted transfer.

• Source-evidenced controls: authenticated routes, organization/role checks, administrator restrictions on destructive operations, ownership checks for AI chat deletion, and database transactions for grouped workspace deletions.
• Credential and communication controls: an AES-256-GCM integration-credential helper, encrypted messaging/attachment workflows, signing audit/hash records and server-side credential handling. Scope must be checked per integration; this is not a blanket encryption claim.
• Payment and abuse controls: Razorpay signature, order ownership and captured-payment validation; request rate limits; separate administrative authorization; AI quota reservation checks.
• Deployment verification required: database RLS and service-role exposure, TLS coverage, infrastructure encryption, secret rotation, staff access reviews/confidentiality, logging and retention, backup access and restoration tests, incident procedures, patching and vulnerability management.
• Known implementation limitations requiring remediation or an agreed lawful procedure: retained derived artifacts and remote copies, cross-system deletion retries, large-workspace identity enumeration, durable AI-usage deduplication and provider usage reconciliation.