Data Processing Agreement

1. When this DPA applies

This DPA applies when you use Niyam to process personal data relating to individuals other than yourself — for example, when you upload documents containing client details, matter information, witness statements, counterparty data, or other personal data of third parties.

In this context, you (the legal professional or organisation) act as the Data Controller — the entity that determines why and how personal data is processed. NIYAM.AI APP PRIVATE LIMITED acts as the Data Processor — the entity that processes personal data on your behalf, under your instruction, solely to deliver the Service.

If you use Niyam purely for research queries that do not involve third-party personal data (for example, asking about a point of law without referencing any individual), this DPA may not be engaged for that specific use. In practice, legal work often involves personal data, and we recommend treating this DPA as applicable to your use of Niyam generally.

2. Nature and purpose of processing

We process personal data included in your inputs solely to provide the Service to you — that is, to generate research outputs, drafting assistance, document review, and related features in response to your specific requests.

We do not process personal data for our own independent commercial purposes. We do not sell, license, share, or otherwise use personal data included in your inputs for any purpose other than delivering the Service and maintaining its security and integrity.

Processing activities include: receiving input data from your queries and document uploads; passing that data to AI model providers for inference under contractual data handling terms; returning outputs to you; and temporarily retaining input and output data in logs for security and operational purposes for a limited period.

3. Types of personal data

The types of personal data processed depend entirely on what you choose to include in your queries and documents. This may include names, contact details, matter facts, financial information, identification numbers, or other information relating to your clients, counterparties, witnesses, or other individuals involved in a legal matter.

We recommend data minimisation: include only the personal data that is strictly necessary for the specific research or drafting task. A research query about a legal principle rarely requires you to include client names or identifying matter details. Redact or anonymise where the task does not require the identifying information.

Avoid including special categories of sensitive personal data — such as health records, financial account details, or biometric information — unless it is genuinely required for the specific task.

4. Our obligations as Processor

We will process personal data only on your documented instructions (as expressed through your use of the Service) and not for any other purpose.

We will ensure that personnel with access to personal data are bound by appropriate confidentiality obligations.

We will implement security measures appropriate to the risk, as described in our Security page at niyam.ai/security.

We will assist you in responding to requests from data subjects exercising their rights under applicable law, to the extent we hold relevant data.

We will notify you without undue delay if we become aware of a personal data breach affecting data processed under this DPA.

We will delete or return personal data at your request or on termination of the Services, subject to any legal retention obligations.

5. Sub-processors

We use third-party sub-processors to deliver the Service, including AI model providers and cloud infrastructure providers. These sub-processors are contractually bound to process data only for the purposes required to deliver the Service.

We maintain a list of current sub-processors and will provide it on request at [email protected]. We will give you reasonable notice of material changes to our sub-processors.

6. Data transfers

Niyam's infrastructure and certain sub-processors may operate outside India. Where personal data is transferred internationally, we rely on contractual safeguards with our sub-processors.

If your organisation has specific requirements about data localisation or cross-border transfer restrictions, please contact us at [email protected] before using the Service.

7. Your obligations as Controller

You are responsible for ensuring that you have a lawful basis to process any personal data you submit to the Service, and that individuals whose data you submit have been informed of such processing to the extent required by applicable law.

You are responsible for the accuracy of data you provide and for ensuring your use of the Service complies with applicable data protection law.

8. Governing law and jurisdiction

This DPA is governed by the laws of India. Disputes arising from or relating to this DPA are subject to the exclusive jurisdiction of the competent courts at Gurugram (Gurgaon), Haryana, India.

9. Contact

NIYAM.AI APP PRIVATE LIMITED. Registered office: 136, 1st Floor, Orchid Business Park, Sector-48, Narsinghpur, Gurgaon (Gurugram), Haryana, India 122004. For DPA-related enquiries or to request sub-processor information, contact us at [email protected].