Data Processing Addendum (summary)

Who is responsible for what

As the Data Fiduciary, you decide why and how personal data is used. You stay responsible under the DPDP Act for what we do on your behalf. That includes giving notice, getting valid consent (including verifiable parental consent for children's data) and answering the people whose data it is. As your Data Processor, we act only for you and help you meet those duties.

What each project records

Each SOW records what the processing is about and how long it lasts, what we do with the data and why, the types of personal data involved, the people it relates to, the sub-processors we use, and where the data is stored and handled.

Your instructions

We process personal data only on your written instructions and for the purposes in the SOW, never for our own. That includes any transfer outside India. If we believe an instruction breaks the law, we will tell you.

Confidentiality

Everyone on our team who handles your personal data is bound by confidentiality, and only the people who need access get it.

Security safeguards

We take reasonable security safeguards to prevent a personal data breach, as the DPDP Act and the Digital Personal Data Protection Rules, 2025 (the "DPDP Rules") require. They match how sensitive the data is, and include:

• encryption in transit, and at rest wherever the platform supports it;
• access limited to the people who need it;
• logs of access and activity, kept for the period you set and the law requires;
• backups, so processing can continue after a problem;
• separate environments for development and live systems;
• secure coding and code review.

AI systems

Where a project uses AI models, we record which providers are used, where they process the data and whether their business terms allow them to train on it. We choose providers whose business terms rule out training on your data, unless you tell us otherwise. We also help with any data protection impact assessment you need or choose to carry out.

Sub-processors

We use carefully chosen sub-processors, such as cloud hosting, AI model and messaging providers, under written terms that protect the data at least as well as our DPA. Each one is named in the SOW for your project, with where it handles data. We tell you before we add or replace one, and you may object on reasonable grounds. We stay responsible to you for the work our sub-processors do.

Requests from the people whose data it is

We help you answer requests from Data Principals (the people the data is about) to access, correct, complete, update or erase their data, to withdraw consent or to nominate someone, and to handle their grievances. We do this quickly enough for you to reply within the time the DPDP Rules set. If someone sends such a request to us directly, we pass it to you and do not answer it ourselves unless you ask us to.

When you tell us that consent has been withdrawn, or that data must be erased, we stop processing it or erase it within a reasonable time, as the Act requires.

Breaches

If we become aware of a personal data breach or a cyber security incident affecting your data, we tell you without delay. This lets you meet your own duties, including reporting to CERT-In within six hours under the CERT-In Directions of 28 April 2022, and informing the Data Protection Board of India and the people affected under the DPDP Rules. We give you the facts you need: what happened, when, how much data was affected, the likely impact and what we are doing about it. We work with you to contain it. Where the CERT-In Directions require us to report an incident ourselves, we do so and tell you.

Transfers outside India

We store and handle your personal data in India where you or the law require it, for example in Indian cloud regions. Where data needs to go outside India, we transfer it only as section 16 of the DPDP Act allows. We never send it to a country the Government of India has restricted, and we follow any stricter rule for your sector, such as RBI rules on payment data. We record each location in the SOW.

When the work ends

We return or delete your personal data, as you choose, unless the law requires us to keep it. We ask our sub-processors to do the same, and we confirm deletion in writing if you ask.

Audits

We give you the information you need to show that the DPA is being followed, such as documentation and security summaries. We allow audits on reasonable notice and confidentiality terms.

Getting the full DPA

To sign the full DPA for your project, ask us through the contact form. You can also call us on +91 99966 88404. It comes with every SOW that involves personal data.