Data processing agreement

Data Processing Agreement (DPA)

This Data Processing Agreement ("Agreement") is established between the Data Processor(Infomover Technologies) and the Data Controller(collectively referred to as the "Parties") to define their roles and responsibilities regarding the processing of Personal Data in compliance with applicable data protection laws.

1. Purpose of the Agreement

The purpose of this Agreement is to set forth the obligations of the Data Processor and Data Controller concerning the processing of Personal Data, ensuring compliance with relevant data protection laws and safeguarding the rights of Data Subjects.

2. Definitions

Personal Data: Any information relating to an identified or identifiable individual, as defined by applicable laws, including but not limited to names, identification numbers, location data, and online identifiers.
Processing: Any operation or set of operations performed on Personal Data, such as collection, recording, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, alignment, restriction, erasure, or destruction.
Data Subject: An individual whose Personal Data is being processed.

3. Roles and Responsibilities

Data Controller: The Data Controller determines the purposes and means of processing Personal Data and ensures that they have the necessary legal grounds for processing the data.
Data Processor: The Data Processor processes Personal Data only on behalf of the Data Controller and in accordance with their instructions, as specified in this Agreement.

4. Compliance with Laws

Both Parties agree to comply with all applicable laws and regulations concerning data protection, including but not limited to the Information Technology Act, 2000, and any subsequent amendments or relevant legislation.

5. Data Processing Details

Nature of Processing: The Data Processor shall process Personal Data to provide services as defined by the Data Controller, including, but not limited to, account management, analytics, customer support, and service improvements.
Types of Personal Data: This may include, but is not limited to, names, email addresses, phone numbers, financial information, and usage data.
Categories of Data Subjects: This includes customers, employees, contractors, and any other individuals whose Personal Data is processed by the Data Controller.

6. Data Security

The Data Processor shall implement appropriate technical and organizational measures to protect Personal Data against unauthorized access, loss, destruction, or alteration. Such measures may include encryption, access controls, data masking, and regular security audits.

7. Sub-processors

The Data Processor may engage sub-processors to assist in processing Personal Data. The Data Processor must maintain an updated list of sub-processors and inform the Data Controller of any changes. The Data Processor shall ensure that sub-processors are bound by the same data protection obligations as stipulated in this Agreement.

8. Data Subject Rights

The Data Processor shall assist the Data Controller in fulfilling its obligations to respond to requests from Data Subjects exercising their rights under applicable data protection laws. This includes rights related to access, rectification, erasure, restriction of processing, and data portability.

9. Data Breach Notification

In the event of a data breach affecting Personal Data, the Data Processor shall promptly notify the Data Controller without undue delay, providing all necessary information to facilitate the investigation and any notifications required by law to Data Subjects and regulatory authorities.

10. Data Retention and Deletion

The Data Processor shall retain Personal Data only as long as necessary to fulfill the purposes outlined in this Agreement. Upon termination of this Agreement, the Data Processor shall delete or return all Personal Data as instructed by the Data Controller.

11. Limitation of Liability

The Data Processor's liability for any claims arising from this Agreement shall be limited to the fees paid by the Data Controller for the services rendered in the 12 months preceding the claim, except in cases of gross negligence or willful misconduct.

12. Governing Law

This Agreement shall be governed by and construed in accordance with the applicable laws of India.

13. Amendments

This Agreement may only be amended or modified in writing, signed by both Parties.

14. Awareness and Training

The Data Processor agrees to provide appropriate training and awareness programs for its employees to ensure that they understand and comply with the obligations outlined in this Agreement and relevant data protection laws.

15. Cooperation

Both Parties agree to cooperate in good faith to resolve any disputes arising out of this Agreement and to comply with all data protection obligations in a transparent and effective manner.

16. Third-Party Rights

This Agreement does not create any rights enforceable by any third party, except as expressly provided herein.

Categories

Data processing agreement