Data Processing Agreement

For personal data contained in systems we build or operate for you, you act as the data controller (or Data Fiduciary under the DPDP Act) and we act as processor (Data Processor), acting only on your documented instructions.

Subject matter: delivery of the contracted software, support, cloud and automation services. Duration: the term of the engagement plus agreed retention. Categories of data subjects: your employees, customers, suppliers and applicants. Data types: identity, contact, transactional and, where configured by you, employment or financial records.

TLS 1.3 in transit and encryption at rest; role-based access with least privilege; mandatory MFA for staff; parameterised queries and input validation; hardened baselines and patch management; audit logging; segregated environments; tested backups and documented recovery objectives.

Access is limited to personnel who need it for delivery, all of whom are bound by written confidentiality obligations and receive security-awareness training.

We maintain a current list of subprocessors (hosting, email, monitoring and support tooling) and will give you at least 30 days' notice of any addition, allowing you to object on reasonable data-protection grounds. Subprocessors are bound by equivalent obligations.

We assist you in responding to data-subject requests, in carrying out impact assessments and in consultations with supervisory authorities, taking into account the nature of processing and the information available to us.

We notify you without undue delay and in any case within 48 hours of becoming aware of a personal data breach, providing the nature of the incident, categories and approximate volumes affected, likely consequences and remedial measures taken.

On reasonable notice and no more than once per year, you may audit our compliance with this agreement, or accept an equivalent third-party assessment report where available.

At the end of the engagement we return your data in a commonly used format and delete remaining copies within 90 days, except where retention is required by law.

Any transfer outside India or the EEA is made under Standard Contractual Clauses or another lawful transfer mechanism, with supplementary measures where required.