Data Processing Agreement

This DPA is entered into between the customer identified in the Order (the Controller) and Zeplinix Technologies Private Limited, registered office 310, Tower 1, World Trade Center, Kharadi, Pune 411014, Maharashtra, India (the Processor).

It applies to all personal data processed by the Processor on behalf of the Controller under the services agreement between the parties.

The Controller determines the purposes and means of processing. The Processor processes only on the Controller's documented instructions.

Terms defined in Applicable Law have the same meaning here. “Applicable Law” means the UK GDPR, the EU GDPR and the Digital Personal Data Protection Act, 2023 (India), as each applies to the processing.

In the event of conflict, the order of precedence is: (a) the Standard Contractual Clauses; (b) this DPA; (c) the Terms of Service; (d) the Order.

The Controller's instructions are: to perform the Services described in the Order, applying the validation rulebook configured with the Controller, and to return the Output to the Controller.

The Processor will inform the Controller if, in its opinion, an instruction infringes Applicable Law, and may suspend the affected processing until the instruction is confirmed or amended.

The Processor will not process personal data for any purpose of its own. Specifically, it will not add Controller data to its own database, use it to enrich any other customer's data, or sell, licence or share it.

Subject matter: validation, verification, discovery, activation, automation and managed collection of business contact records.

Duration: for the term of the services agreement, plus the retention period in clause 15.

Nature and purpose: comparison of submitted records against live sources; correction, scoring and removal of records; appending verified fields; and return of results. Details are set out in Annex 1.

Data subjects: employees, officers and workers of the Controller's target organisations, in their professional capacity.

Categories: identity data, business contact data, employment and seniority data, organisation data, and location data. Full detail in Annex 1.

The parties do not intend for special category data, criminal offence data, payment data, government identifiers or children's data to be processed. The Controller will not submit such data.

The Processor will: process only on documented instructions; ensure the confidentiality of personnel; implement the measures in Annex 2; engage subprocessors only under clause 9; assist the Controller under clause 11; notify breaches under clause 12; and delete or return data under clause 15.

The Processor maintains a record of processing activities carried out on behalf of the Controller and makes it available on request.

The Processor will not transfer personal data outside the jurisdictions listed in Annex 3 without prior written notice.

Access to personal data is restricted to personnel who need it to deliver the Services, on a named, least-privilege basis, and is logged.

All personnel are bound by written confidentiality obligations that survive the end of their engagement, and receive data protection training on induction and annually.

The Processor implements and maintains the technical and organisational measures set out in Annex 2, having regard to the state of the art, the cost of implementation and the risks to data subjects.

The Processor may update the measures provided the level of protection is not reduced.

The Controller gives general written authorisation for the Processor to engage subprocessors. The current list is at Annex 3 and is provided in full on request.

The Processor imposes on each subprocessor data protection obligations no less protective than those in this DPA, and remains fully liable to the Controller for the subprocessor's performance.

The Processor gives the Controller 30 days written notice before adding or replacing a subprocessor. The Controller may object on reasonable data protection grounds within that period, in which case the parties will discuss in good faith; if no resolution is reached the Controller may terminate the affected Service without penalty.

Where the Processor processes personal data originating in the UK or the EEA, the transfer is made under the Standard Contractual Clauses, Module Two (controller to processor), which are incorporated into this DPA by reference and completed by Annexes 1 to 3.

For UK transfers, the UK International Data Transfer Addendum to the SCCs applies.

A transfer impact assessment is maintained by the Processor and provided to the Controller on request.

The Processor will assist the Controller, at the Controller's cost where the assistance is material, in: responding to data subject requests; carrying out data protection impact assessments; consulting a supervisory authority; and demonstrating compliance.

The Processor will provide the information reasonably required for the Controller to meet its own accountability obligations.

The Processor will notify the Controller of a personal data breach affecting the Controller's data without undue delay and in any event within 24 hours of becoming aware of it.

The notification will include, so far as known: the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the measures taken or proposed. Where information is not available at the time, it will be provided in phases without further undue delay.

The Processor will not make any public statement identifying the Controller in connection with a breach without the Controller's prior written consent, unless legally compelled.

Where the Processor receives a request from a data subject relating to the Controller's data, it will not respond substantively but will forward the request to the Controller without undue delay and in any event within 5 business days.

The Processor will assist the Controller in fulfilling the request, including by locating, exporting, correcting or deleting the relevant records.

The Processor will make available the information necessary to demonstrate compliance. In the first instance this is provided as documentary evidence: the security overview, the current subprocessor list, completed security questionnaires, and the summary of the most recent vulnerability scan.

Where documentary evidence is not sufficient for the Controller's regulator or auditors, the Controller may audit once in any twelve-month period on 30 days written notice, at a time that does not unreasonably disrupt processing, with auditors bound by confidentiality and the reasonable cost of the Processor's participation borne by the Controller.

An additional audit may be requested following a personal data breach affecting the Controller's data, without regard to the annual limit.

The Processor deletes Controller personal data when the relevant campaign is removed, and in all cases within 90 days of receipt, whichever is earlier.

On termination of the services agreement, all remaining Controller personal data is deleted within 30 days, or returned in a commonly used format if the Controller so elects before that period expires.

Deletion extends to backups on their normal rotation, which completes within 35 days. The Processor confirms deletion in writing on request.

The Processor may retain data only where required by law, and in that case only for as long as required and only for that purpose.

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, save that those limitations do not apply where Applicable Law prohibits their application.

Nothing in this DPA limits a data subject's rights or remedies under Applicable Law.

This DPA takes effect on the earlier of the date of the Order and the date the first personal data is submitted, and continues until all Controller personal data has been deleted or returned.

A signable copy of this DPA is available on request from hello@zeplinix.com.