Data processing agreement.
How we process the data of your customers on your behalf, under the DPDP Act and the GDPR.
1. Parties and scope
This Data Processing Agreement ("DPA") is part of the Altrix.one Terms of service between Altrix.one (legal entity: [LEGAL ENTITY NAME]), [ADDRESS], India, GSTIN [GSTIN], which runs the Altrix.one brand ("Altrix", "we"), and the business that subscribes ("Customer", "you"). It is accepted at sign-up, and we store the version and time of acceptance.
It covers personal data that we process on your behalf while providing the Service ("Customer Personal Data"). It uses the terms of India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 ("DPDP Act") and, where it applies, the EU and UK GDPR.
2. Roles
- For Customer Personal Data, you are the Data Fiduciary (controller) and we are the Data Processor (processor).
- For your account, billing and support data, we act as an independent Data Fiduciary under our Privacy policy.
- You decide what data goes into the Service. You need a lawful basis for it, you give the notices the DPDP Act requires, and you get any consent needed, including for messaging, call recording and location-based attendance. You follow our Acceptable use policy.
3. Our duties as processor
- We process Customer Personal Data only on your documented instructions: the Terms, this DPA, and your settings and actions in the Service. We tell you if we think an instruction breaks the law.
- We do not sell it, use it for advertising, or use it to train AI models that serve other customers.
- People who can access it are bound by confidentiality and get access only when needed. Access is logged.
- We apply the security measures on our Security page.
- We help you answer requests from Data Principals (access, correction, erasure, nomination, withdrawal of consent; and GDPR rights). If a request comes to us, we pass it to you within 5 business days.
- We give reasonable help with impact assessments and questions from the Data Protection Board or other regulators.
4. Sub-processors
You authorise the sub-processors on our Sub-processors page. We give at least 30 days' notice of a new one. You may object on reasonable data protection grounds. If we cannot agree, you may end the affected service and get a pro-rata refund of prepaid subscription fees. We bind each sub-processor to protective terms and stay responsible for it.
5. Data location and transfers
The Service is hosted in India. Some sub-processors (for example Meta and AI providers) process data outside India. We do not transfer Customer Personal Data to any country the Government of India restricts under the DPDP Act. Where the GDPR applies, the EU Standard Contractual Clauses (Module 2, or Module 3 where you are a processor) and the UK Addendum apply to transfers, and they win if they conflict with this DPA.
6. Personal data breaches
| Step | Timeline |
|---|---|
| We notify you of a breach affecting Customer Personal Data | Without undue delay, and within 48 hours of becoming aware |
| We send a detailed follow-up report (facts, cause, mitigation, prevention) | Within 60 hours of becoming aware |
| You inform the Data Protection Board of India (DPDP) | Without delay, with a detailed report within 72 hours |
| You inform affected Data Principals (DPDP) | Without delay, in plain language |
| You inform the supervisory authority (GDPR, where it applies) | Within 72 hours, unless unlikely to cause risk |
We also report cyber security incidents in our own systems to CERT-In as Indian law requires.
7. Return and deletion
- While your account is active, your owner or GM can export your data at any time.
- After your account closes, you have 30 days to ask for an export. We then delete Customer Personal Data from live systems within 30 days, and from backups as they roll over.
- A company deletion requested in the Service can be undone for 7 days. We keep a deletion receipt and the audit trail as proof.
- We keep only what the law requires (such as tax invoices), protected by this DPA.
8. Audits
We provide the information reasonably needed to show compliance, including answers to a reasonable security questionnaire once a year. We do not yet hold ISO 27001 or SOC 2 certifications. If that is not enough, or a regulator requires it, you may audit once a year with 30 days' notice, at your cost, without access to other customers' data.
9. Children (education customers)
If you handle enquiries about people under 18, you must get verifiable consent from a parent or guardian as the DPDP Act requires, and must not track or target ads at children. AI & Automation flags chats that seem to involve an under-18 so a person takes over; you stay responsible.
10. General
This DPA lasts as long as we process Customer Personal Data. Liability follows the limits in the Terms, except where the law does not allow a limit. If this DPA conflicts with the Terms on data protection, this DPA wins. Indian law applies; the courts in India have jurisdiction, except where the Standard Contractual Clauses require otherwise. A signed copy is available on request: corp@altrix.one.