Data Processing Agreement

Preamble

This Data Processing Agreement ("DPA") is entered into between:

This DPA supplements the Terms of Service and Privacy Policy and governs all processing activities by ABIS as a data processor.

1. Definitions

• Personal Data: Any information relating to an identified or identifiable natural person as defined under DPDP Act 2023
• Business Data: Financial, operational, and commercial data uploaded by the Customer — which may or may not contain personal data
• Processing: Any operation performed on data including collection, storage, use, analysis, and deletion
• Sub-Processor: Third parties engaged by ABIS to process data (Google Gemini API, Railway hosting)

2. Nature, Purpose & Duration of Processing

3. Obligations of ABIS (Data Processor)

• Process data only on documented instructions from the Customer (i.e., running the requested report module)
• Ensure all personnel with access to Customer data are bound by confidentiality obligations
• Implement appropriate technical and organisational security measures (see Security Document)
• Not engage new Sub-Processors without informing the Customer
• Assist the Customer in responding to Data Principal rights requests under DPDP Act 2023
• Delete or return all Customer data upon termination of the service relationship
• Notify the Customer within 72 hours of becoming aware of a personal data breach

4. Obligations of the Customer (Data Controller)

• Ensure you have lawful basis for uploading any personal data of third parties
• Provide accurate and complete instructions for processing
• Comply with all applicable data protection laws in your jurisdiction
• Not upload special categories of data (health, biometric, financial passwords) beyond what is necessary for reports
• Notify ABIS promptly of any changes to instructions or if you become aware of a security incident

5. Sub-Processors

ABIS currently engages the following Sub-Processors. The Customer authorises their use by accepting this DPA:

ABIS remains fully liable for Sub-Processor compliance. Customers will be notified of Sub-Processor changes with 30 days notice.

6. Data Transfers

Data processed by Google Gemini AI may be transferred outside India. Such transfers are governed by Google's Data Processing Addendum and Standard Contractual Clauses. Railway hosting is in Singapore/India. ABIS does not transfer raw business data to any other jurisdiction.

7. Security Measures

ABIS implements the following as minimum standards (detailed in Security Policy):

• TLS 1.3 encryption in transit
• AES-256 encryption at rest for stored sensitive data
• Access controls: least-privilege, role-based
• Audit logging of all data access events
• Automated deletion of report inputs within 24 hours
• Razorpay webhook HMAC signature verification

8. Breach Notification

In the event of a personal data breach affecting Customer data, ABIS will:

1. Notify the Customer via registered email within 72 hours of discovery
2. Provide details of: nature of breach, categories affected, approximate number of individuals, likely consequences
3. Propose and implement remediation measures
4. Cooperate with any regulatory investigation

9. Audit Rights

Upon 30 days written notice, the Customer may request an audit of ABIS's data processing activities. ABIS will provide documentation and cooperate with reasonable audit requests. Physical audits are subject to mutual agreement and confidentiality undertakings.

10. Term & Termination

This DPA is effective from the date of account registration and remains in force until termination of the service relationship. Upon termination, ABIS will certify deletion of all Customer personal data within 30 days, except where retention is required by Indian law (e.g., GST records for 7 years).

Signatures

This DPA is agreed electronically upon account registration and payment. For enterprises requiring a countersigned hard copy, contact theallworkss@gmail.com.