polysh.
Request early access

Polysh for agents is in early access. Your coding agent records the demo, and Polysh finishes it. Join the waitlist →

Data Processing Addendum

Data Processing Addendum

This addendum sets out our commitments when Polysh processes personal data on behalf of your organization. It is part of our Terms of Service and applies automatically; no signature is needed.

Last updated:

This Data Processing Addendum ("DPA") is between the organization that uses Polysh ("Customer", "you") and Argo Solutions Infotech Private Limited ("Polysh", "we"). It forms part of the Terms of Service or other agreement under which we provide the Service (the "Agreement"). If you need a countersigned copy for your records, write to [email protected].

Terms such as "controller", "processor", "personal data", "processing", and "data subject" have the meanings given in applicable data protection law, including the EU and UK General Data Protection Regulation ("GDPR") and India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), where "controller" includes a data fiduciary and "processor" includes a data processor.

1. Scope and roles

This DPA applies when we process personal data contained in Customer content and workspace data on your behalf while providing the Service ("Customer Personal Data"). You are the controller and we are the processor. Where you are yourself a processor for another controller, we act as your subprocessor. Annex 1 describes the processing.

This DPA doesn't cover data we process as a controller, such as account administration, billing, security, and website data, which our Privacy Policy covers.

2. Processing on your instructions

We process Customer Personal Data only on your documented instructions, which are the Agreement, this DPA, and your use and configuration of the Service, unless the law requires otherwise; in that case we'll tell you first unless the law forbids it. We'll tell you if we believe an instruction breaks data protection law.

You're responsible for the lawfulness of the personal data you add to the Service, including giving notices and obtaining consents from the people who appear in recordings and the people you invite to share links.

We don't sell Customer Personal Data or use it to train AI models.

3. Confidentiality of personnel

Everyone we authorise to process Customer Personal Data is bound by confidentiality obligations, and access is limited to what they need to provide, support, and secure the Service.

4. Security

We implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, as described in Annex 2. We may update these measures as long as the overall level of protection is not reduced.

5. Subprocessors

You give general authorisation for us to engage subprocessors. Our current subprocessors are listed on our Subprocessors page. We'll impose data protection obligations on each subprocessor that are no less protective than this DPA, and we remain responsible for their performance.

We'll update the list at least 30 days before a new subprocessor processes Customer Personal Data. You can object on reasonable data protection grounds within that period, as set out on the Subprocessors page.

6. Requests and assistance

If we receive a request from a data subject about Customer Personal Data, we'll pass it to you and won't respond ourselves except to direct them to you. The Service lets you find, export, and delete content, and we'll provide reasonable further help where you can't respond using the Service. We'll also provide reasonable help with data protection impact assessments and consultations with authorities relating to the Service.

7. Personal data breaches

We'll notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We'll describe the breach, the data and people likely affected, its likely consequences, and the measures taken, and we'll update you as we learn more. We'll take reasonable steps to contain the breach and reduce its effects. Notifying you is not an admission of fault.

8. International transfers

Our core application, database, and job processing run in the European Union. Some processing takes place in the United States and India, as listed on the Subprocessors page. Where Customer Personal Data from the European Economic Area, the United Kingdom, or Switzerland is transferred to a country without an adequacy decision, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor) or Module Three (processor to processor) as applicable, with the UK International Data Transfer Addendum and the Swiss adaptations, are incorporated into this DPA by reference. For those clauses: the optional docking clause applies; general authorisation applies to subprocessors with the notice period in section 5; and the governing law and courts are those of Ireland. Annexes 1 and 2 of this DPA complete the clauses' annexes.

9. Return and deletion

You can export and delete content in the Service at any time. When the Agreement ends, you may request an export of your content within 30 days. We'll then delete Customer Personal Data from active systems within 30 days, and it will expire from backups on their normal schedule (currently 7 days), unless the law requires us to keep it.

10. Information and audits

We'll make available the information reasonably needed to show compliance with this DPA, including answers to security questionnaires. If that isn't enough, or an authority requires it, you may audit our compliance, once a year, with at least 30 days' written notice, during business hours, at your cost, and under confidentiality, in a way that doesn't compromise the security of other customers. We may use an independent auditor's report to satisfy an audit request.

11. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Agreement. If this DPA conflicts with the Agreement, this DPA prevails for the processing of Customer Personal Data. If the Standard Contractual Clauses apply and conflict with this DPA, the clauses prevail. This DPA lasts as long as we process Customer Personal Data.

Annex 1: Details of processing

Annex 2: Security measures

Polysh is operated by Argo Solutions Infotech Private Limited, C/O Anima Saha, R.R.N. Road, Cooch Behar, Koch Bihar, West Bengal 736101, India. Questions: [email protected].