01Roles
The Customer is the Data Fiduciary (controller) and determines the purposes and means of processing. We are the Data Processor and process Customer personal data only to provide the services under the Agreement. Details of processing are set out in Annex 1.
02Processing on instructions
We process Customer personal data only on the Customer's documented instructions, including those in the Agreement and given through the services, unless the law requires otherwise. In that case we will inform the Customer first, unless the law prohibits it. We will tell the Customer if we believe an instruction breaks data protection law.
03Confidentiality
Everyone we authorise to process Customer personal data is bound by confidentiality obligations and receives appropriate training.
04Security
We implement reasonable technical and organisational security measures appropriate to the risk, including those in Annex 2, and review them regularly.
05Subprocessors
The Customer gives general authorisation for us to use the subprocessors listed on our Subprocessor page and any project-specific subprocessors listed in the statement of work. We will:
- impose data protection obligations on each subprocessor that are no less protective than this DPA;
- give at least 14 days' notice of new or replacement subprocessors, during which the Customer may object on reasonable data-protection grounds;
- remain responsible for our subprocessors' performance.
If the Customer objects and we cannot reasonably accommodate the objection, the Customer may terminate the affected service and receive a refund of prepaid fees for the unused period.
06Helping the Customer
Taking into account the nature of the processing, we will help the Customer respond to requests from Data Principals (data subjects), carry out data protection impact assessments, and meet its security and breach-notification obligations. We will promptly forward any request we receive directly from a Data Principal.
07Personal data breaches
We will notify the Customer without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting Customer personal data. We will provide the information reasonably available to help the Customer notify the Data Protection Board of India, supervisory authorities and affected individuals. We will also take reasonable steps to contain the breach and reduce its effects.
08International transfers
We will transfer Customer personal data outside India only as permitted by the DPDP Act and never to a country restricted by the Government of India. Where the GDPR applies, transfers are made under appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), which are incorporated by reference when needed.
09Audits
On reasonable request, we will make available the information necessary to demonstrate compliance with this DPA. The Customer may audit our compliance once a year, with at least 30 days' notice, during business hours, at its own cost and under confidentiality obligations, or more often if required by a regulator or after a personal data breach.
10Return and deletion
When the services end, we will, at the Customer's choice, return Customer personal data in a commonly used format or delete it within 30 days, unless the law requires us to keep it. Data in backups is deleted in line with our normal backup cycle and kept secure until then.
11Customer responsibilities
The Customer is responsible for having a lawful basis for processing, including any notices and consents required by the DPDP Act, for the accuracy of the data, and for ensuring its instructions comply with law.
12Liability, term and precedence
Liability under this DPA is subject to the limitations in the Agreement. This DPA lasts for as long as we process Customer personal data. If this DPA conflicts with the Agreement on data protection matters, this DPA prevails.
13Annex 1: Details of processing
| Item | Description |
|---|---|
| Subject matter and duration | Providing the services under the Agreement, for the term of the Agreement and any agreed transition period |
| Nature and purpose | Hosting, storage, development, testing, support, maintenance, analytics, automation, AI features and marketing operations, as specified in the Agreement |
| Data Principals (data subjects) | The Customer's employees, customers, end users, leads, suppliers and other individuals whose data the Customer provides |
| Categories of personal data | Contact and identity details, account and usage data, transaction and order data, communications, and other data the Customer chooses to process through the services |
| Special or sensitive data | Only if the Agreement specifically allows it, with additional safeguards agreed in writing |
14Annex 2: Security measures
- encryption in transit (TLS) and, where supported, at rest;
- role-based access, least privilege, multi-factor authentication and prompt removal of access when no longer needed;
- separate development, test and production environments; use of production personal data in testing only with Customer approval and appropriate masking;
- logging and monitoring of administrative access;
- vulnerability management, patching and secure development practices;
- regular backups and tested recovery procedures for managed environments;
- incident response procedures, including CERT-In reporting;
- confidentiality agreements and security awareness for staff and contractors.
15Annex 3: Subprocessors
See our Subprocessor list and the project-specific subprocessors named in your statement of work.