# Gloibox Data Protection Addendum Draft

**Status: Draft for review. Effective date: 2026-10-28.**

This Addendum forms part of the agreement between Gloitel Consulting Pvt. Ltd. ("Gloibox") and the subscribing Customer. It governs personal information Gloibox processes on the Customer's behalf to provide the purchased services. For this processing, the Customer determines purposes and instructions; Gloibox acts as processor. Applicable legal terminology and obligations depend on the jurisdictions involved.

## Instructions and confidentiality

Gloibox will process Customer personal information only on documented lawful instructions, including the agreement and authorized service configuration, unless law requires otherwise. Where permitted, it will inform the Customer of a conflicting legal requirement or an instruction it considers unlawful. Access will be restricted to authorized personnel subject to confidentiality duties.

The Customer is responsible for its authority to provide the information, required notices, and lawful employment-related processing decisions. Gloibox remains responsible for obligations imposed directly on it by applicable law.

## Processing schedule

| Item                  | Scope to complete                                                                                                                                               |
| --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Purpose               | Delivery of the purchased workforce-management modules and related support                                                                                      |
| Operations            | Receiving, organizing, storing, retrieving, calculating, reporting, exporting, and deleting records as instructed                                               |
| Individuals           | Customer employees and other authorized personnel                                                                                                              |
| Information           | Identity and contact details, employment assignments, attendance, shifts, leave, payroll, enabled location and device records; attendance, location, and payroll data as configured by the Customer |
| Sensitive information | Personal data relating to employment status, location, attendance, payroll, and other employee records, subject to customer instructions and local legal requirements |
| Duration              | Subscription term plus the agreed export and deletion periods                                                                                                   |
| Locations             | India (primary hosting); backups in the same region unless otherwise required; support access as needed for service operations                                     |

## Security measures

Gloibox will maintain measures appropriate to the agreed processing and risk. Before execution, the parties will complete a security schedule describing verified identity and access management, transport and storage encryption, tenant separation, logs, vulnerability handling, backup and recovery, personnel access, and incident response. The service is hosted on AWS and uses Firebase and Google Workspace as supporting infrastructure. This draft does not assert certification or audit status.

## Subprocessors and transfers

The Customer authorizes the providers identified in the relevant order and support documentation, including AWS, Firebase, Google Workspace, Stripe, and SendGrid. Gloibox will impose appropriate data-protection obligations and remain responsible for their performance as required by the agreement and law.

For proposed changes, Gloibox will give reasonable notice and allow objections on reasonable data-protection grounds. Transfers will occur only with the safeguards required for the relevant transfer. The Company will implement lawful transfer mechanisms where personal information is exported outside India or other applicable jurisdictions.

## Requests and incidents

Gloibox will assist the Customer with applicable individual-rights requests and reasonable compliance inquiries, taking account of the processing and available information. Requests received directly will be referred to the Customer unless law requires a direct response.

On becoming aware of a breach affecting Customer personal information, Gloibox will notify the Customer incident contact without undue delay and within 72 hours of awareness subject to any shorter legal deadline. Available details will include the nature of the incident, affected information, likely consequences, response measures, and a contact for follow-up. Missing details may follow in updates. The parties will coordinate containment, investigation, and legally required notifications without restricting either party's mandatory duties.

## Assurance and assistance

Gloibox will provide information reasonably necessary to demonstrate its processing obligations and support legally required assessments. Audit scope, confidentiality, timing, evidence access, and reasonable costs follow the customer agreement. These arrangements must not prevent a legally required audit or regulator inquiry.

## Return and deletion

At termination, the Customer may request export or deletion through the service or support contact. Exports are provided in CSV or other agreed formats during a reasonable export window. Active records are deleted within 30 days after termination or as otherwise agreed; backup copies expire within 30 days and are not restored to active use except for recovery, with deletion instructions reapplied. Legally required retention is limited to the required information and purpose.

## Priority and execution

This Addendum prevails over conflicting general terms concerning Customer personal data. Mandatory transfer terms and applicable law prevail where required. Liability follows the completed agreement without limiting non-excludable obligations. The accepted order must identify the parties, authorized signatories, effective date, and relevant schedules.