Data Processing Agreement

1. Definitions

Controller means the exhibiting organisation using Fingoh.ai to manage visitor data. Processor means Fingoh.ai. Personal Data means any information relating to an identified or identifiable natural person processed under this agreement.

2. Subject matter & purpose

The Processor shall process Personal Data only for the purpose of providing the Fingoh.ai exhibitor intelligence platform as described in the Terms of Service, and strictly on documented instructions from the Controller.

3. Controller obligations

The Controller warrants that it has a valid lawful basis (such as legitimate interest or consent) for collecting and transferring visitor personal data to Fingoh.ai for processing, and that it has provided visitors with appropriate privacy notices.

4. Processor obligations

Fingoh.ai shall:

• Process Personal Data only on Controller instructions
• Ensure persons authorised to process data are bound by confidentiality
• Implement appropriate technical and organisational security measures
• Not engage sub-processors without Controller consent
• Assist the Controller in responding to data subject rights requests
• Delete or return all Personal Data upon termination of services

5. Sub-processors

Fingoh.ai uses the following sub-processors: Supabase (database hosting, AWS Seoul), Anthropic (AI processing, USA), Modal Labs (ML scoring, USA), Vercel (frontend hosting, USA), Railway (backend hosting, USA). Sub-processor details are available on request.

6. Security measures

Fingoh.ai implements: TLS encryption in transit, encrypted storage at rest, role-based access control, audit logging of all data access and deletion events, and regular security reviews.

7. Data subject rights

The Processor shall notify the Controller of any data subject rights request within 48 hours and shall provide reasonable assistance to enable the Controller to fulfil such requests within statutory timeframes.

8. Breach notification

In the event of a personal data breach, Fingoh.ai shall notify the Controller without undue delay and in any case within 72 hours of becoming aware of the breach.

9. Governing law

This DPA is governed by the laws of India. For EU data subjects, the parties agree to comply with GDPR requirements and, where required, to execute Standard Contractual Clauses.

Contact

For DPA enquiries: hello@fingoh.ai