Data Processing Addendum

This Data Processing Addendum (“DPA”) is between the customer that accepted the Batawn Terms (“Customer”) and Aditya Tickoo, operating as Batawn with Amrit Tickoo acting as legal guardian and adult representative (“Batawn”). It applies to Customer Personal Data that Batawn processes as a processor to provide the service.

“Data Protection Law” means privacy and data-protection law applicable to the processing, including the GDPR, UK GDPR, and California Consumer Privacy Act where applicable. Terms such as controller, processor, process, and personal data have the meanings given by that law.

Customer is the controller and Batawn is the processor of Customer Personal Data. Customer instructs Batawn to process that data to provide, secure, maintain, and support the service under the Terms and Customer’s documented use of Batawn. Batawn will process it only on those instructions unless law requires otherwise, in which case Batawn will notify Customer unless law prohibits notice.

Customer is responsible for the lawfulness of its instructions, notices, permissions, repositories, and personal data. Customer will not intentionally submit special-category, criminal-offence, medical, financial-account, government-identifier, or children’s data unless the parties first agree in writing on appropriate safeguards.

Batawn will ensure that people authorised to process Customer Personal Data are bound by confidentiality obligations. Batawn will maintain technical and organisational measures appropriate to the service and risk, including the measures in Annex II below, and will not materially reduce their overall protection during a subscription.

Customer gives general written authorisation for the subprocessors listed in the Privacy Policy. Batawn will require each subprocessor to protect Customer Personal Data under written terms appropriate to its processing. Batawn remains responsible for its subprocessors to the extent required by Data Protection Law.

Batawn will post a material subprocessor change before the new provider begins processing Customer Personal Data. Customer may object by emailing support@batawn.com with reasonable data-protection grounds. If the parties cannot resolve the objection, Customer may stop the affected use and cancel the service.

Taking account of the nature of processing and information available, Batawn will reasonably assist Customer with data-subject requests, security obligations, breach notifications, impact assessments, and regulator consultations required by Data Protection Law. Customer is responsible for responding to requests as controller. Batawn will not respond for Customer unless instructed or legally required.

Batawn will notify Customer without undue delay after confirming a breach of Customer Personal Data and will provide available information reasonably needed for Customer’s legal duties. Notification is not an admission of fault. Customer must keep its account and integration credentials secure and promptly report suspected compromise.

During the service, Customer may obtain room records through available export functions. On team deletion, Batawn deletes Customer Personal Data associated with that team as described in the Privacy Policy, except information retained for security, legal, backup, billing, or dispute purposes. On written request after termination, Batawn will delete or return remaining Customer Personal Data when reasonably possible and legally permitted.

Batawn will provide information reasonably necessary to demonstrate compliance with this DPA. Customer may request one audit per year, first through documents and written answers. Any additional inspection must be legally required, use an independent auditor bound by confidentiality, avoid other customers’ data, and minimise disruption. Customer bears its audit costs unless a material breach by Batawn is found.

For transfers of Customer Personal Data subject to the EEA GDPR to a country without an adequacy decision, the controller-to-processor clauses in Module Two of the European Commission Standard Contractual Clauses adopted by Decision (EU) 2021/914 are incorporated by reference. Customer is data exporter; Batawn is data importer; the optional docking clause applies; Clause 9 uses general written authorisation with the notice in section 4; Clause 17 uses the law of Ireland; and Clause 18 selects the courts of Ireland. Annexes I–III are completed by this DPA.

For a transfer subject to the UK GDPR, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses is incorporated by reference and completed using the information in this DPA. The parties will use any required successor mechanism. The official EU clauses are available from the European Commission.

Subject and purpose

Providing shared rooms and coordination for Customer’s people and coding-agent sessions.

Duration

The trial or subscription and the retention period described in the Privacy Policy.

People

Customer users, team members, guests, repository contributors, support correspondents, and people identified in Customer Content.

Data

Names, email addresses, identifiers, roles, repository metadata, file paths, shared repository and task instructions, uploaded context files, immutable Git blob references, diffs, terminal output, prompts, messages, tasks, approvals, activity, agent state, and other Customer Content.

Frequency

Continuous while Customer uses the service.

Special categories

None intended.

Contact

support@batawn.com for both parties’ data-protection notices unless Customer supplies another contact.

• Encrypted HTTPS transport and managed encryption at rest.
• Authenticated accounts, scoped service credentials, and short-lived GitHub installation tokens.
• Database row-level security based on team and room membership.
• Repository grants limited to installations and repositories verified through GitHub.
• Customer Content masking and exclusion from analytics and error-monitoring payloads.
• Recorded, time-limited support access and least-privilege service roles.
• Dependency, error, and security monitoring appropriate to the service.
• Deletion procedures for teams, credentials, invitations, and room content.

Supabase provides authentication, database, and realtime services; Vercel provides hosting and request delivery; GitHub provides identity and repository operations. Resend provides transactional email. These providers may process Customer Personal Data. Stripe, Google Workspace, PostHog, and Sentry process the separate controller data described in the Privacy Policy and will process Customer Personal Data only if a support or diagnostic interaction necessarily contains it despite the service’s capture restrictions.

This DPA controls over conflicting Terms only for processing Customer Personal Data. The incorporated transfer clauses control where they require. Batawn may update this DPA for changes in law or processing and will require renewed acceptance when a change materially reduces Customer’s rights.