Data Processing Agreement &
Security Architecture.

This Data Processing Agreement ("DPA") constitutes a legally binding agreement between AutoBiz ("AutoBiz", "we", "us", or "Data Processor") and the registered commercial enterprise or subscriber ("Merchant", "Customer", or "Data Controller") using the AutoBiz automated messaging platform.

This DPA supplements and forms an integral part of the AutoBiz Terms of Service, Privacy Policy, and Acceptable Use Policy. In the event of any direct conflict between the Terms of Service and this DPA regarding personal data processing, the provisions of this DPA shall prevail.

This agreement is drafted to adhere strictly to the requirements of the Personal Data Protection Act No. 9 of 2022 of Sri Lanka ("PDPA"), the European Union General Data Protection Regulation ("GDPR" - Regulation (EU) 2016/679), and international data protection conventions.

For the purposes of this DPA, the following capitalized terms have the meanings set forth below:

• "Data Controller" (or "Controller"): The natural or legal entity that determines the purposes and means of processing personal data. Under this DPA, the Merchant is the Data Controller.
• "Data Processor" (or "Processor"): The entity that processes personal data on behalf of the Data Controller. AutoBiz operates exclusively as the Data Processor.
• "Data Subject": Any identified or identifiable natural person who interacts with the Merchant's automated WhatsApp, Messenger, or Instagram channels.
• "Personal Data": Any information relating to an identified or identifiable natural person processed through the AutoBiz platform.
• "Sub-processor": Any third-party infrastructure vendor, cloud host, or API service provider engaged by AutoBiz to perform specialized processing activities.
• "Personal Data Breach": A confirmed breach of technical security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored, or processed by AutoBiz.

Purpose & Scope of Processing: AutoBiz processes personal data solely to provide, operate, maintain, and support the multichannel conversational automation platform (WhatsApp, Messenger, Instagram), parse customer inquiries via Large Language Models, manage e-commerce orders, schedule appointments, and dispatch transactional SMS alerts.

In operating as Data Processor, AutoBiz covenants and agrees to:

• Process Strictly on Documented Instructions: Process personal data only in accordance with the documented instructions of the Controller, as set forth in the Terms of Service and this DPA, unless required to do so by applicable Sri Lankan or international law.
• Confidentiality Commitment: Ensure that all AutoBiz personnel, engineers, and contractors authorized to process personal data have committed themselves to strict confidentiality agreements.
• Technical Security Implementation: Implement and maintain state-of-the-art Technical and Organizational Measures (TOMs) as detailed in Clause 6.0.
• No Commercial Data Exploitation: Never sell, rent, commercialize, or share merchant or customer personal data with advertising brokers, third-party lead generation networks, or data brokers.

The Controller hereby grants general written authorization for AutoBiz to engage third-party sub-processors strictly necessary to deliver the platform services. Our infrastructure stack comprises tier-1 enterprise providers under strict data privacy agreements:

AutoBiz maintains an extensive information security architecture designed to prevent unauthorized access, alteration, disclosure, or destruction of personal data:

In the event of a confirmed Personal Data Breach impacting personal data processed on behalf of the Controller, AutoBiz shall:

• Notify the Controller in writing without undue delay and strictly within seventy-two (72) hours of becoming aware of the confirmed breach.
• Provide a comprehensive incident report describing the nature of the breach, the categories and approximate number of data subjects impacted, and the estimated records affected.
• Detail the immediate remedial countermeasures deployed to contain and mitigate the incident.
• Assist the Controller in fulfilling its statutory reporting obligations to the Data Protection Authority of Sri Lanka or relevant regulatory oversight bodies.

AutoBiz maintains an active list of sub-processors. When we intend to engage a new sub-processor or replace an existing vendor, we will provide at least fourteen (14) calendar days prior notice via platform dashboard notification or email.

The Controller has the right to object to the appointment of a new sub-processor on reasonable data protection grounds within ten (10) days of notification. If an objection cannot be resolved amicably, the Controller may terminate the affected subscription without penalty.

Taking into account the nature of the processing, AutoBiz provides technical capabilities within the merchant dashboard to assist the Controller in fulfilling statutory Data Subject Rights requests, including:

If AutoBiz receives a data subject request directly from an end-consumer, we shall notify the merchant within forty-eight (48) hours and advise the consumer to contact the merchant directly.

AutoBiz shall make available to the Controller all documentation reasonably necessary to demonstrate compliance with the obligations laid down in this DPA:

• Providing summary reports of third-party security assessments and SOC/ISO compliance certifications from our underlying cloud host (AWS) and edge CDN (Cloudflare).
• Completing reasonable enterprise vendor security questionnaires submitted by the Controller (limited to one review per 12-month period, unless triggered by a confirmed breach).

Upon termination of the commercial subscription or merchant agreement:

• The Controller is granted a thirty (30) day export grace period to download all conversation histories, customer records, and product catalogs.
• Following the expiration of the 30-day grace period, AutoBiz will securely delete, overwrite, and cryptographically erase all live database instances containing the Controller's personal data, save for encrypted database backup archives that age out within thirty (30) days.
• A formal Certificate of Cryptographic Deletion can be issued upon written request to our compliance desk.

Where the provision of services involves cross-border transfers of personal data (e.g. from Sri Lanka or the EEA to AWS data centers or Meta Cloud APIs), AutoBiz ensures that such transfers comply with statutory cross-border mechanisms, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission where applicable.
• Compliance with cross-border data transfer safeguards under Part V of the Sri Lanka Personal Data Protection Act No. 9 of 2022.
• End-to-end encryption in transit to neutralize intercepted transit risk.

This Data Processing Agreement shall be governed by, and construed in accordance with, the laws of the Democratic Socialist Republic of Sri Lanka. Any legal disputes arising under this agreement shall be subject to the exclusive jurisdiction of the competent courts of Colombo, Sri Lanka.