Enterprise Data Processing Policy

Last updated: August 5th, 2026

1. Our Role: Data Processor, Not Data Fiduciary

In every enterprise engagement, mple.ai acts solely as a Data Processor under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). The Subscribing Organization is the Data Fiduciary — it determines the purposes and means of processing Personal Data relating to its Platform Users, and it is responsible for establishing the lawful basis (including any necessary consent) for that processing.

mple.ai processes Personal Data strictly on behalf of, and under the instructions of, the Subscribing Organization, as set out in the governing Data Processing Agreement ("DPA") between mple.ai and the Subscribing Organization. mple.ai does not independently determine the purpose or means of processing Platform User data, and does not hold Data Fiduciary status in respect of any data processed under an enterprise engagement.

2. Data We Process on the Subscribing Organization's Behalf

Depending on how the Subscribing Organization has configured the Service, mple.ai may process the following categories of Personal Data relating to Platform Users, where applicable:

• Name
• Email address (where applicable)
• Phone number (where applicable)
• Employee code / organization-issued identifier (where applicable)
• Date of joining (where applicable)
• Audio and video recordings from practice, roleplay, coaching, or assessment activities (where applicable)

Only the data categories that the Subscribing Organization has configured for its deployment are collected. Where a category is not enabled for the Subscribing Organization, mple.ai does not process it.

3. Purposes of Processing

mple.ai processes the above data solely to deliver the Service to the Subscribing Organization, for purposes including:

• Creating and managing Platform User accounts
• Delivering training content and roleplay/practice modules
• Providing AI-driven coaching and feedback
• Generating performance reports and analytics for the Subscribing Organization
• Sending training reminders and account or service notifications via email, SMS, WhatsApp, or other channels configured by the Subscribing Organization

Model Training Exclusion: mple.ai does not use Personal Data, including audio or video recordings, to train, fine-tune, or improve any AI models. mple.ai does not use Platform User data for any purpose beyond those instructed by the Subscribing Organization.

Where the Service collects audio or video recordings, mple.ai presents a consent notice to Platform Users on behalf of the Subscribing Organization prior to recording, as configured by the Subscribing Organization.

4. Data Principal Rights Management (DPRM)

Because the Subscribing Organization is the Data Fiduciary for Platform User data, requests from Platform Users to access, correct, erase, or otherwise exercise their rights under the DPDP Act ("DPRM Requests") are routed through the Subscribing Organization, and are not handled by mple.ai directly.

Platform Users wishing to exercise their rights should contact their organization's designated administrator or Data Protection Officer. mple.ai will provide reasonable technical and operational assistance to the Subscribing Organization to help fulfil such requests, as set out in the DPA.

5. Sub-processors

mple.ai engages the following categories of sub-processors to support delivery of the Service:

• Google Cloud Platform (GCP) — cloud hosting, storage, and infrastructure
• Other third-party service providers engaged from time to time to support specific Service features, as disclosed in the applicable DPA or available upon request

All sub-processors are bound by data protection obligations consistent with this Policy and the applicable DPA.

6. Data Residency

Personal Data processed under this Policy is stored and processed on secure cloud infrastructure located in India (GCP Mumbai region), with encryption in transit and at rest. Access is restricted to authorized personnel and logged for audit purposes.

7. Breach Notification

In the event of a Personal Data breach affecting Platform User data, mple.ai will notify the affected Subscribing Organization without undue delay. The Subscribing Organization, as Data Fiduciary, is responsible for determining whether and how to notify affected Platform Users and/or the Data Protection Board of India, in accordance with its obligations under the DPDP Act.

8. Governing Agreement

The specific terms governing mple.ai's processing of Personal Data on behalf of a Subscribing Organization — including processing instructions, security measures, sub-processor arrangements, and liability — are set out in the Data Processing Agreement ("DPA") executed between mple.ai and the Subscribing Organization. In the event of any conflict between this Policy and the DPA, the DPA governs.

9. Retention and Deletion

mple.ai retains Personal Data processed under this Policy for the duration of the contract between mple.ai and the Subscribing Organization, and in accordance with the retention and deletion terms set out in the applicable DPA. Upon termination of the enterprise engagement, Personal Data is deleted or returned to the Subscribing Organization as governed by the DPA.

10. Grievance Officer

In accordance with the DPDP Act, mple.ai has appointed a Grievance Officer to address concerns regarding Personal Data processing under this Policy.

Platform Users should first raise concerns with their Subscribing Organization's administrator; mple.ai's Grievance Officer is available for matters requiring escalation to mple.ai directly, consistent with the DPA.

11. Changes to This Policy

mple.ai may update this Policy from time to time to reflect changes in applicable law, Our processing activities, or the terms of Our DPAs. We will update the "Last updated" date above and notify Subscribing Organizations of material changes.

12. Contact Us

For questions about this Enterprise Data Processing Policy, contact: