Data Processing Agreement

1. Scope

This Data Processing Agreement ("DPA") forms part of the agreement between Prabhix Technologies ("Processor") and the customer entity ("Controller") using Prabhix platform services. It governs Processor's handling of Personal Data on Controller's behalf under applicable data protection law, including the Digital Personal Data Protection Act, 2023 (India).

2. Definitions

• Personal Data: any information relating to an identified or identifiable individual processed through the services.
• Processing: any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
• Sub-processor: a third party engaged by Processor to process Personal Data.

3. Roles and instructions

Controller determines the purposes and means of processing Personal Data of its employees, customers, and contacts. Processor processes Personal Data only on documented instructions from Controller — including configuration of the services, support requests, and compliance with applicable law.

4. Processor obligations

Processor shall:

• Process Personal Data only as instructed and for the purposes of providing the services
• Ensure personnel with access to Personal Data are bound by confidentiality obligations
• Implement appropriate technical and organizational measures as described in our Security documentation
• Assist Controller with data subject requests within reasonable timeframes
• Notify Controller without undue delay (within 72 hours) upon becoming aware of a Personal Data breach
• Delete or return Personal Data upon termination, subject to legal retention requirements
• Make available information necessary to demonstrate compliance and allow audits upon reasonable notice (max once per year)

5. Sub-processors

Controller authorizes Processor to engage sub-processors listed below. Processor will notify Controller of new sub-processors with 30 days' notice; Controller may object on reasonable grounds.

6. International transfers

Personal Data is primarily processed in India. If transfer outside India is required, Processor will ensure appropriate safeguards consistent with applicable law, including standard contractual clauses or equivalent mechanisms approved by relevant authorities.

7. Data subject rights

Processor will assist Controller in fulfilling data subject requests (access, correction, deletion, portability) by providing tools within the platform and responding to Controller-initiated requests within 15 business days.

8. Liability

Each party's liability under this DPA is subject to the limitation of liability provisions in the main service agreement. Nothing in this DPA limits either party's liability for breaches of data protection law where such limitation is prohibited.

9. Term and termination

This DPA remains in effect for the duration of the service agreement. Upon termination, Processor will delete Controller's Personal Data within 90 days unless retention is required by law. Controller may export data during a 30-day post-termination window.

10. Execution

This DPA is incorporated by reference into the Terms of Service for Business and Enterprise plans. Enterprise customers may request a countersigned copy by contacting legal@prabhixtechnologies.com.