VANINXT MICRO Data Processing Addendum

1. Roles and scope

The customer company is the Data Fiduciary for personal data in its business content and instructs Zertical Private Limited to process it only to provide and secure VANINXT MICRO. Zertical Private Limited is a separate Data Fiduciary for account, security, subscription, support and legal-administration data.

2. Processing

Processing may include collection, browser-based deterministic text recognition when the customer selects it, storage, organisation, retrieval, calculation, display, export, backup, restriction and verified deletion. When the customer turns on Munimji, the optional AI helper, it also includes sending each request, the records needed to answer it, and any supplier purchase bill a user gives it to read, to the AI subprocessors listed in the Subprocessor Register. Data subjects may include customer personnel, customers, suppliers and other people whose data the customer lawfully enters.

3. Processor commitments

• Process customer content only on documented instructions and for contracted services.
• Use reasonable technical and organisational safeguards and confidentiality controls.
• Support rights, breach response, export and deletion requests reasonably required from the customer.
• Notify the customer without undue delay after confirming a personal-data breach affecting its content.
• Use subprocessors under equivalent protection commitments.

4. Customer obligations

The customer must have a lawful purpose and authority, provide required notices, keep data accurate, minimise what it enters, administer users, and respond to rights requests for its business content.

5. Subprocessors, transfers and audit

Current providers are listed in the Subprocessor Register. When the customer turns on Munimji, its requests may be processed in China and the United States by the AI subprocessors listed there, as the Privacy Policy explains. Cross-border processing will be limited where law or government notification requires it. Reasonable security and compliance information will be provided without exposing another customer’s data or security secrets.

6. Return, deletion and precedence

On a verified request, data is exported or deleted according to the approved lifecycle manifest and legal-retention duties. A signed customer agreement prevails over this public Addendum where it expressly says so.