Data Processing Agreement

1. Parties and incorporation

This Data Processing Agreement (“DPA”) is between the customer identified in the order or subscription (“Customer”) and Vedatricks Technologies Private Limited, CIN U62012KA2025PTC209058, of SMC, Thalaghattapura, Bengaluru, Karnataka 560109, India (“Vedatricks”).

It is incorporated into and forms part of the Terms of Service and any order form or statement of work between the parties. It takes effect when the Customer first begins to process personal data through a Vedatricks service, and no separate signature is needed — although a countersigned copy is available on request (section “Signing”).

2. Roles under the DPDP Act 2023

• The Customer is the Data Fiduciary. It determines the purpose and means of processing the personal data it puts into a Vedatricks product, and it is responsible for the notice, consent, accuracy and lawfulness of that data.
• Vedatricks is the Data Processor under section 2(k) of the DPDP Act, processing that data only on the Customer’s behalf and on its documented instructions, as section 8(2) contemplates.
• Vedatricks is an independent Data Fiduciary for its own account, billing, support and marketing data about the Customer’s staff. That processing is governed by the Privacy Policy, not by this DPA.
• Where a Vedatricks product routes payments, the payment gateway is an independent Data Fiduciary for the payment data it collects.

3. Scope and duration

This DPA covers the personal data described in Annex A, for as long as Vedatricks holds it — that is, for the term of the subscription or engagement and through the export and deletion period in section 13. Obligations of confidentiality and the deletion obligation survive termination.

4. Processing on instructions

• Vedatricks processes Customer personal data only to provide, secure and support the services, and otherwise on the Customer’s documented instructions. The Terms of Service, this DPA, the order form and the Customer’s use of the product’s configuration are the documented instructions.
• Vedatricks does not sell Customer personal data, does not use it for its own marketing, and does not use it to train machine-learning models for itself or anyone else.
• Vedatricks may use aggregated, de-identified operational statistics — counts, latencies, error rates — to run and improve the services. These cannot identify the Customer, its users or their data subjects.
• If Vedatricks is required by law to process the data otherwise, it will inform the Customer before doing so unless the law prohibits it.
• If Vedatricks believes an instruction breaches the DPDP Act or other applicable law, it will tell the Customer promptly and may suspend that instruction until the point is resolved.

5. Personnel and confidentiality

• Access is limited to personnel who need it to deliver or support the service.
• All personnel are bound by written confidentiality obligations that survive their engagement.
• Staff receive data-protection and security training at induction and at least annually.
• Access is on named accounts with least privilege, revoked on the day a person leaves or changes role, and reviewed at [ ● ]term not yet agreed; this document is in legal review.
• Production support access to Customer data is logged. Where a product offers break-glass impersonation for support, every use is recorded in an audit log the Customer can request.

6. Security measures

Vedatricks maintains appropriate technical and organisational measures, described in Annex B, that meet the reasonable-security-safeguards standard in Rule 6 of the DPDP Rules 2025. Measures may change as technology changes, but not in a way that materially reduces overall protection during a subscription term.

7. Sub-processors

• The Customer gives general authorisation for the sub-processors listed in Annex C.
• Vedatricks imposes on each sub-processor written obligations no less protective than this DPA, and remains liable to the Customer for its sub-processors’ acts and omissions.
• Vedatricks will give the Customer at least 30 days’ notice before adding or replacing a sub-processor, by email to the account contact and by updating Annex C.
• The Customer may object on reasonable data-protection grounds within that notice period. The parties will discuss in good faith; if no solution is found, the Customer may terminate the affected service and receive a pro-rata refund of prepaid, unused fees.

8. Cross-border transfers

Customer personal data is stored in [ ● ]term not yet agreed; this document is in legal review. Some sub-processors may process it outside India — in particular the model provider behind AI features and the content-delivery network. Section 16 of the DPDP Act and Rule 15 of the DPDP Rules permit such transfers unless the Central Government restricts a country by order.

• Vedatricks will not transfer Customer personal data to a country restricted by such an order, and will stop an existing transfer if one is made.
• Every recipient is bound by a written contract with confidentiality, security and deletion obligations.
• Where a Customer requires that no processing occur outside India, Vedatricks will confirm whether an India-only configuration is available for the product and features in question, and what it excludes. AI features may not be available in that configuration.
• For Customers established outside India, the availability of European Standard Contractual Clauses or other transfer mechanisms is [ ● ]term not yet agreed; this document is in legal review.

9. Assisting with Data Principal requests

• The products provide the Customer with the ability to access, correct, export and delete records itself, which is normally the fastest way to answer a request.
• Where a request cannot be handled with those tools, Vedatricks will assist within [ ● ]term not yet agreed; this document is in legal review of a written request.
• If a Data Principal contacts Vedatricks directly about data held for a Customer, Vedatricks will not respond on the merits. It will confirm receipt, forward the request to the Customer without undue delay, and tell the individual who the Data Fiduciary is.
• Reasonable assistance is included in the subscription. Extraordinary effort — bulk historical extraction, forensic reconstruction — may be quoted separately, with the estimate given in advance.

10. Personal data breaches

• Vedatricks will notify the Customer without undue delay and in any event within 24 hours of becoming aware of a personal data breach affecting the Customer’s data.
• The notification will describe the nature of the breach, the categories and approximate volume of records affected, the likely consequences, the measures taken or proposed, and a named contact. Where full detail is not yet available, Vedatricks sends what it has and follows up.
• Vedatricks will assist the Customer with its own obligations under Rule 7 of the DPDP Rules — notifying affected Data Principals without delay, notifying the Data Protection Board without delay, and providing the Board’s detailed report within 72 hours.
• Vedatricks will take reasonable steps to contain and remediate, preserve evidence, and provide a written post-incident report within [ ● ]term not yet agreed; this document is in legal review of containment.
• Neither party will make a public statement identifying the other in connection with a breach without prior consultation, except where the law requires it.

11. Other assistance

Taking into account the nature of the processing and the information available to it, Vedatricks will give the Customer reasonable assistance with data-protection impact assessments, security questionnaires and consultations with the Data Protection Board, in each case relating to the services covered by this DPA. Vedatricks maintains a standard security questionnaire response and will provide it on request under NDA.

12. Records and audits

• Vedatricks keeps records of the processing carried out on the Customer’s behalf.
• On reasonable written notice of at least 30 days, and no more than once in any 12 months (unless following a breach or required by a regulator), the Customer may audit Vedatricks’ compliance with this DPA.
• Audits happen during Business Hours, must not unreasonably disrupt operations, must not access another customer’s data or Vedatricks’ confidential commercial information, and are subject to confidentiality. The Customer bears its own costs and Vedatricks’ reasonable costs beyond [ ● ]term not yet agreed; this document is in legal review.
• Vedatricks may satisfy an audit request by providing documentation, architecture descriptions and completed questionnaires where these reasonably answer the Customer’s questions.
• Vedatricks does not currently hold ISO/IEC 27001 or SOC 2 certification and does not present any third-party attestation it does not hold.

13. Return and deletion

• Export tools remain available for 30 days after termination.
• On written request within that window, Vedatricks will provide a final export in a machine-readable format at no charge.
• Vedatricks deletes Customer personal data from live systems within 90 days of termination, and confirms deletion in writing on request.
• Backups age out on their normal rotation; data in a backup is not restored to live systems and is deleted when the backup is.
• Vedatricks may retain data it is required by law to keep — invoices, tax records, access logs — and will keep it protected and process it only for that purpose.

14. AI features and model providers

• AI features are off unless the Customer turns them on, and can be turned off again at any time by an account administrator.
• Where an AI feature is on, the content needed to answer a request is sent to the model provider named in Annex C, which processes it as a sub-processor under this DPA.
• Vedatricks configures model providers so that Customer content is not used to train their models, and sets provider-side retention to the minimum the provider offers. Vedatricks will provide the current configuration on request.
• AI features are constrained to read-only questions or to actions the user confirms; no AI feature writes to Customer data without a human confirming the action.
• The Customer must not enable an AI feature for a workflow where an incorrect output could cause harm without human review. Details are in the AI Disclosure.

15. Liability and order of precedence

Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms of Service. If this DPA conflicts with the Terms of Service on the subject of personal data, this DPA prevails. If it conflicts with a signed, negotiated data-protection agreement between the parties, that agreement prevails.

Annex A — Details of processing

Annex B — Technical and organisational security measures

Annex C — Authorised sub-processors

Signing this agreement

This DPA applies automatically. If your compliance process needs a countersigned copy, email hello@vedatricks.com with your entity name, registered address, the products in scope and the name and designation of your signatory. We return a signed PDF within [ ● ]term not yet agreed; this document is in legal review. We can also complete a standard security questionnaire under NDA.