Data Processing Addendum

Roles of the parties

The customer is the controller of Customer Data, or the business under the CCPA. ISHQKALA PRIVATE LIMITED is its processor and service provider. Where the customer is a TPA processing claims for a carrier or self-insured client, Ishqkala acts as its subprocessor and the DPA flows down the same obligations. For protected health information, the Business Associate Agreement also applies and controls on any conflict.

Scope of processing

Subject matter and nature: hosting, extracting, classifying and analyzing claim files to detect subrogation opportunities, score liability, track deadlines and assemble demand package drafts. Duration: the term of the customer agreement plus the deletion period described below.

Data subjects: insureds, named and listed drivers, claimants and injured parties, witnesses, adverse parties, employees in workers' compensation claims, and the customer's own personnel. Data categories: names and contact details, policy and claim numbers, VINs and license plates, driver's license numbers, dates of birth, Social Security numbers where present in source documents, accident descriptions and photographs, payment and settlement amounts, employment details, and medical information in bodily injury files.

Processing instructions and CCPA commitments

Ishqkala processes Customer Data only on the customer's documented instructions, which include the customer agreement, the Order Form and the configuration the customer sets in the platform. Ishqkala will tell the customer if it believes an instruction violates applicable law.

As a service provider, Ishqkala will not sell or share Customer Data, will not retain, use or disclose it for any purpose other than the business purposes in the agreement, and will not combine it with personal information from other sources except as the CCPA regulations allow. The customer may take reasonable steps to stop and remediate any unauthorized use.

No model training

Ishqkala does not use Customer Data to train, fine-tune or evaluate any AI model, ours or a third party's. Model inference runs inside Ishqkala-controlled AWS accounts in US regions, and no third-party AI provider receives Customer Data. Models are developed using public statutes and case law and licensed or synthetic data, never customer claim files.

Confidentiality and security measures

Everyone with access to Customer Data is bound by confidentiality obligations, passes a background check and completes annual security and privacy training. Access follows least privilege and is logged.

The security annex commits Ishqkala to AES-256 encryption at rest, TLS 1.3 in transit, multi-factor authentication, tenant isolation with per-tenant keys, vulnerability management with fixed remediation windows, annual third-party penetration testing, tested backups and a SOC 2 Type II audit every year. These measures are designed to support the customer's vendor oversight duties under 23 NYCRR Part 500 and state laws based on the NAIC Insurance Data Security Model Law.

Subprocessors

The customer authorizes the subprocessors listed on our Subprocessors page. Ishqkala gives at least 30 days' email notice before adding or replacing a subprocessor. The customer may object on reasonable data protection grounds; if the parties cannot resolve the objection, the customer may terminate the affected service and receive a refund of prepaid fees for it. Ishqkala binds each subprocessor to written terms at least as protective as the DPA and remains responsible for its performance.

Data location

Customer Data is stored and processed only in AWS US regions, or in AWS GovCloud (US) where the customer elects it. Authorized personnel, including our team in India, reach production only through virtual workspaces hosted in the same US region, so Customer Data is not downloaded to or stored on devices outside the United States. Customers may require US-based support personnel in their Order Form.

Assistance with requests and regulators

Ishqkala forwards any data subject request it receives to the customer within five business days and gives the customer tools to search, export, correct and delete records. Ishqkala also assists with risk assessments and with inquiries or examinations by state insurance departments and other regulators that concern the services.

Security incident notification

Ishqkala notifies the customer without undue delay, and in any event within 48 hours after confirming a security incident affecting Customer Data, so the customer can meet 72-hour regulator notice duties such as 23 NYCRR 500.17. The notice describes the incident, the data and individuals involved, the steps taken and a contact for follow-up, and Ishqkala updates it as facts develop. Ishqkala does not notify individuals or regulators on the customer's behalf without the customer's approval, unless the law requires it.

Audits

Ishqkala provides its current SOC 2 Type II report, bridge letters and penetration test summary under NDA, and answers one security questionnaire per year. The customer may also conduct one audit, on-site or remote, every 12 months on 30 days' notice, through a mutually agreed auditor bound by confidentiality, and additional audits when a regulator requires one or after a security incident.

Return and deletion

During the term and for 30 days after it ends, the customer can export Customer Data in standard formats, including JSON, CSV and PDF. Ishqkala then deletes Customer Data within 30 days, and encrypted backups age out within a further 35 days. A certificate of deletion is available on request. If the customer places a litigation hold on specific claim files, Ishqkala preserves them until the customer releases the hold.

Liability and precedence

The DPA is subject to the liability terms of the customer agreement. On data protection matters, the DPA prevails over the customer agreement, and the Business Associate Agreement prevails over both for protected health information. To request the full DPA, contact legal@ishqkala.si.