This Data Processing Addendum (“DPA”) forms part of the agreement between the customer identified in the applicable order form (“Customer”) and HSV Media Private Limited, operating as PitchSense (“PitchSense”), for the provision of PitchSense services (the “Agreement”).
1. Definitions
Applicable Data Protection Law means data-protection and privacy laws applicable to the processing under the Agreement, including the Digital Personal Data Protection Act, 2023 and applicable rules, and, where applicable, the EU GDPR, UK GDPR and applicable US state privacy laws.
Customer Personal Data means personal data processed by PitchSense on behalf of Customer in providing the service.
Controller includes a Data Fiduciary under Indian law.
Processor includes a Data Processor under Indian law.
Personal Data Breach means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to Customer Personal Data.
Subprocessor means a third party engaged by PitchSense to process Customer Personal Data in connection with the service.
2. Roles of the parties
For Customer Personal Data, Customer is the Controller/Data Fiduciary and PitchSense is the Processor/Data Processor.
PitchSense may act as an independent Controller/Data Fiduciary for limited personal data processed for its own account administration, security, support, website operation, product analytics, billing and legal compliance. Such processing is governed by the PitchSense Privacy & Personal Data Notice and is outside this DPA to the extent PitchSense independently determines its purposes and means.
3. Scope and instructions
PitchSense will process Customer Personal Data only:
To provide, secure, maintain and support the service.
As documented in the Agreement, this DPA and Customer’s lawful configuration or written instructions.
As required by law, in which case PitchSense will inform Customer before processing unless legally prohibited.
If PitchSense reasonably believes an instruction violates Applicable Data Protection Law, it will notify Customer and may suspend the affected processing until the issue is resolved.
4. Customer obligations
Customer is responsible for:
Providing lawful and documented processing instructions.
Establishing a lawful basis for processing Customer Personal Data.
Providing required notices to users and other individuals.
Ensuring that Customer Content is collected and submitted lawfully.
Configuring appropriate user access, manager visibility and retention settings.
Ensuring appropriate human review of AI-assisted evaluations and outputs.
Responding to individuals where Customer is the Controller/Data Fiduciary.
5. Confidentiality and personnel
PitchSense will ensure that personnel authorised to process Customer Personal Data:
Are subject to confidentiality obligations.
Receive access only where necessary for their responsibilities.
Receive appropriate security and privacy guidance.
6. Security measures
PitchSense will maintain reasonable technical and organisational measures appropriate to the nature of Customer Personal Data and processing risks, including:
Role-based and least-privilege access controls.
Encryption in transit and at rest where supported.
Production-access controls and logging.
Secure software-development and code-review practices.
Vulnerability and dependency management.
Security, uptime and anomaly monitoring.
Backup and recovery controls.
Incident-response procedures.
Periodic review of access and safeguards.
Additional measures are listed in Annex B.
7. Subprocessors
Customer gives PitchSense general written authorisation to use the subprocessors listed at https://pitchsense.ai/trust/subprocessors and in Annex C.
PitchSense will:
Bind each subprocessor to data-protection obligations materially equivalent to those in this DPA for the relevant processing.
Remain responsible for the subprocessor’s performance to the extent required by Applicable Data Protection Law.
Provide at least 30 days’ notice of a new subprocessor where practicable.
Allow Customer to object on reasonable data-protection grounds during the notice period.
If the parties cannot resolve an objection, PitchSense may provide a commercially reasonable alternative or permit termination of the materially affected service without penalty for the unused prepaid period.
8. AI providers
PitchSense may submit Customer Personal Data to approved commercial AI API providers to deliver roleplays, evaluations and other AI features. Current AI providers include OpenAI and Anthropic for text inference and ElevenLabs for voice synthesis and speech-to-text, as listed in Annex C.
PitchSense configures and contracts for commercial use so that Customer Personal Data is not used to train general-purpose provider models. Where a provider’s standard terms would otherwise permit use of submitted data for model development or improvement, PitchSense applies the available account-level opt-out or equivalent contractual control.
Unless a verified zero-data-retention arrangement applies, AI providers may retain API inputs and outputs for the periods listed in Annex C for abuse monitoring, security or legal compliance. PitchSense does not represent that zero-data retention applies unless the relevant account and endpoint configuration has been contractually and technically verified.
9. Data-subject and Data Principal requests
Taking into account the nature of processing, PitchSense will reasonably assist Customer with requests to access, correct, update, delete, restrict, object to or export Customer Personal Data, where applicable.
If PitchSense receives a request relating to Customer-controlled data, PitchSense will:
Verify whether the request relates to a Customer workspace.
Promptly refer the request to Customer, unless prohibited by law.
Not respond substantively except on Customer’s documented instruction or where legally required.
Customer is responsible for determining the appropriate response.
10. Personal Data Breaches
PitchSense will notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data.
The notification will include available information about:
The nature and scope of the breach.
Categories of affected data and individuals.
Likely consequences.
Measures taken or proposed to contain, investigate and remediate the breach.
A contact for follow-up.
PitchSense may provide information in phases as the investigation progresses. Notification does not constitute an admission of fault or liability.
Customer is responsible for regulatory and individual notifications where Customer is the Controller/Data Fiduciary, with PitchSense providing reasonable assistance.
11. Deletion, return and retention
Retention of roleplay recordings, transcripts, evaluations, scores, reports and manager notes follows the schedule documented in the Order Form, workspace configuration or another written instruction.
If no customer-specific schedule is documented, the default retention period is 12 months.
On termination or Customer’s written request, PitchSense will return or delete Customer Personal Data from active systems within 30 days, unless retention is required by law.
Residual copies in backups will expire according to PitchSense’s standard backup lifecycle within a maximum of 90 days, unless longer retention is legally required.
Security and audit logs may be retained for a longer period where reasonably necessary for security, legal compliance or dispute resolution.
12. Audits and compliance information
PitchSense will make available information reasonably necessary to demonstrate compliance with this DPA, which may include security documentation, audit summaries, policies and written responses.
Customer may request an audit no more than once annually, unless required by a regulator or following a material security incident. Audits must:
Be conducted on reasonable notice.
Avoid unreasonable disruption.
Protect PitchSense and other customers’ confidential information.
Use an independent auditor where onsite review is necessary.
Be at Customer’s expense unless the audit identifies a material breach by PitchSense.
13. Data protection impact assessments and consultations
PitchSense will provide reasonable information and assistance required for Customer’s data-protection impact assessment or regulator consultation relating to the service, taking into account the nature of processing and information available to PitchSense.
14. International transfers
Customer Personal Data is hosted and processed in the United States.
Customer authorises transfers to the United States and other disclosed subprocessor locations, subject to appropriate safeguards.
Where the EU GDPR applies and Customer Personal Data is transferred from the EEA to a country without an adequacy decision, the European Commission Standard Contractual Clauses adopted under Decision (EU) 2021/914 are incorporated as follows unless the parties sign a different transfer mechanism:
Module Two: Controller to Processor.
Customer is the data exporter.
PitchSense is the data importer.
The docking clause applies.
The optional independent dispute-resolution language does not apply unless agreed.
The governing supervisory authority and Member State law are determined by the Customer’s EEA establishment or representative.
Annexes I-III are completed by Annexes A-C of this DPA and the Agreement.
For UK transfers, the applicable UK International Data Transfer Addendum or another recognised mechanism applies.
15. Government requests
Unless legally prohibited, PitchSense will notify Customer of a binding request by a public authority for Customer Personal Data. PitchSense will review the request for legal validity and disclose only the data legally required.
16. Liability and precedence
Liability under this DPA is subject to the exclusions and limitations in the Agreement, except where prohibited by Applicable Data Protection Law.
If this DPA conflicts with the Agreement on processing of Customer Personal Data, this DPA controls. If incorporated Standard Contractual Clauses conflict with this DPA, the Standard Contractual Clauses control for the relevant transfer.
17. Term
This DPA remains effective for as long as PitchSense processes Customer Personal Data under the Agreement.
Annex A — Processing Details
Subject matter
Provision of the PitchSense AI sales-readiness and learning platform.
Duration
For the term of the Agreement and the deletion/return period described in Section 11.
Nature and purpose
User authentication and workspace access.
Delivery of learning modules, playcards, documents and presentations.
AI roleplay processing.
Recording and transcription, where enabled.
Quiz administration.
Evaluation, scoring, reporting and analytics.
Manager review and notes, where enabled.
Security, support, monitoring and audit logging.
Categories of individuals
Customer employees, contractors and authorised users.
Managers and customer administrators.
Individuals identifiable in Customer-submitted learning or roleplay content.
Customer support contacts.
Categories of personal data
Work email address and workspace identifiers.
Role, team and manager associations.
Voice recordings and transcripts, where enabled.
Roleplay prompts and responses.
Quiz answers and results.
Evaluations, scores, reports and manager notes.
IP address, device, session, usage, security and audit data.
Personal data included by Customer in uploaded content.
Special-category or sensitive data
Not intentionally required. Customer must not submit special-category or sensitive data unless expressly approved in writing and protected by additional agreed safeguards.
Processing frequency
Continuous or on-demand during Customer’s use of the service.
Annex B — Technical and Organisational Measures
Logical tenant separation.
Role-based access controls.
Restricted production access.
Encryption in transit using current TLS standards.
Encryption at rest where supported by the hosting service.
Centralised logging and monitoring.
Security and uptime alerting.
Secure code review, including automated and human review.
Dependency and vulnerability management.
Backup and recovery procedures.
Incident-response and escalation procedures.
Employee and contractor confidentiality obligations.
Vendor due diligence for subprocessors.
Data-retention and deletion controls.