Data Processing Agreement

1. Introduction

This Data Processing Agreement ("DPA") forms part of and supplements the applicable:

• Terms of Service
• Master Service Agreement (MSA)
• Subscription Agreement
• Purchase Order
• Other commercial agreement

between Roboi Private Limited (“Roboi”, “Processor”, “Service Provider”, “we”, “our”, or “us”) and the customer entity (“Customer”, “Controller”, or “you”).

This DPA governs the processing of Personal Data by Roboi in connection with:

• Roboi Edge Kit
• Roboi VMS Platform
• AI Video Analytics Systems
• Roboi Dashboard
• Roboi APIs
• AI/ML event detection systems
• Related cloud, on-premise, or hybrid services

2. Scope

This DPA applies where Roboi processes Personal Data on behalf of the Customer during the provision of services involving:

• CCTV/video feeds
• Video analytics
• AI-generated metadata
• Event detection
• ANPR (Automatic Number Plate Recognition)
• Face detection or face matching
• Occupancy analytics
• Smart surveillance systems
• Edge AI processing
• Security and operational monitoring

3. Definitions

4. Roles of Parties

For purposes of applicable privacy laws:

• The Customer acts as the Data Controller
• Roboi acts as the Data Processor

The Customer retains sole responsibility for:

• legality of surveillance activities;
• obtaining required permissions and consents;
• compliance with employment laws;
• CCTV signage and notices;
• lawful deployment of biometric or surveillance systems.

Roboi acts solely as a technology and infrastructure provider unless otherwise agreed in writing.

5. Nature of Processing

Roboi may process the following categories of data:

6. Purpose of Processing

Roboi processes Personal Data solely for purposes authorized by the Customer, including:

• AI video analytics
• Security monitoring
• Operational automation
• Event detection and notifications
• Smart infrastructure monitoring
• Dashboard visualization
• Reporting and analytics
• System administration and troubleshooting

Roboi shall not process Personal Data for unrelated purposes except where required by law.

7. Customer Responsibilities

The Customer represents and warrants that it:

• Has lawful authority to collect and process Personal Data;
• Has provided required notices and disclosures;
• Has obtained required permissions or consents where applicable;
• Will comply with applicable surveillance, employment, privacy, and biometric laws;
• Will configure retention settings responsibly;
• Will not use the Services for unlawful surveillance or discriminatory purposes.

The Customer is solely responsible for:

• camera placement,
• surveillance legality,
• biometric compliance,
• employment-related monitoring compliance,
• data subject requests.

8. Roboi Security Measures

Roboi implements commercially reasonable administrative, technical, and organizational safeguards aligned with industry standards.

Security controls may include:

• Role-based access control (RBAC)
• Authentication controls
• Encryption in transit where applicable
• VPN/private network deployment options
• Audit logging
• Edge-first architecture
• Secure API access
• Infrastructure monitoring
• Incident response procedures

Roboi maintains security practices aligned with:

• ISO 27001
• SOC 2 Type II

9. Edge and On-Premise Architecture

Roboi supports:

• On-premise deployments
• Hybrid deployments
• Edge AI processing

Depending on deployment configuration:

• video footage may remain entirely within Customer infrastructure;
• only metadata or alerts may be transmitted externally.

Customers remain responsible for configuring deployments according to their compliance obligations.

10. Subprocessors

Roboi may engage subprocessors including:

• cloud infrastructure providers,
• hosting providers,
• support vendors,
• analytics or monitoring providers.

Roboi shall take reasonable measures to ensure subprocessors are subject to confidentiality and security obligations.

A list of major subprocessors may be provided upon reasonable request.

11. Cross-Border Transfers

Where data is transferred across jurisdictions, Roboi shall implement reasonable safeguards consistent with applicable law.

Customers acknowledge that certain support, monitoring, or infrastructure operations may involve international data processing.

12. Confidentiality

Roboi personnel authorized to process Personal Data are subject to confidentiality obligations.

Roboi shall not disclose Customer Personal Data except:

• as required to provide services;
• as instructed by Customer;
• as required by law.

13. Data Retention and Deletion

Customers control retention configurations wherever technically supported.

Upon termination of services, Roboi may:

• delete Customer data,
• return Customer data where applicable,
• retain limited records where legally required.

Customers are responsible for exporting required footage or records before service termination.

14. Security Incident Notification

In the event of a confirmed security incident involving unauthorized access to Customer Personal Data, Roboi shall make commercially reasonable efforts to:

• notify the Customer without undue delay;
• provide relevant incident information reas,onably available.

Notification timelines may vary depending on:

• nature of the incident,
• legal obligations,
• forensic investigations.

15. AI and Analytics Disclaimer

The Customer acknowledges that:

• AI outputs are probabilistic in nature;
• detections and analytics may generate false positives or false negatives;
• environmental factors may affect performance;
• AI outputs should not be solely relied upon for enforcement, safety, employment, or legal decisions.

Human review and operational validation remain the responsibility of the Customer.

Roboi does not guarantee:

• uninterrupted detection,
• 100% accuracy,
• complete prevention of incidents.

16. Prohibited Use

The Customer shall not use Roboi services for:

• unlawful surveillance
• discriminatory profiling
• social scoring
• illegal biometric tracking
• unauthorized employee surveillance
• human rights violations
• unlawful law enforcement activities
• activities prohibited under applicable law

17. Audit Rights

Where required under applicable agreements, Customers may request reasonable information regarding Roboi’s security practices and compliance measures.

Roboi may satisfy such obligations through:

• certifications,
• audit summaries,
• security documentation,
• compliance reports.

Direct audits may be subject to:

• confidentiality obligations
• reasonable notice
• operational limitations

18. Limitation of Liability

To the maximum extent permitted by law, Roboi shall not be liable for:

• indirect damages,
• consequential losses,
• surveillance misuse by Customer,
• Customer non-compliance,
• third-party hardware failures,
• Customer deployment decisions.

Liability shall remain subject to limitations contained in the applicable commercial agreement.

19. Governing Law

This DPA shall be governed by the laws of India unless otherwise agreed in writing.

Disputes shall be subject to the jurisdiction of courts located in Gurugram, Haryana, India.

20. Changes to this DPA

Roboi may update this DPA periodically. Updated versions shall be published on Roboi.ai.

Continued use of services after updates constitutes acceptance of the revised DPA.

21. Contact Information

For privacy, compliance, or data processing inquiries: