ZipZy® Data Processing Addendum

1.1 “Customer Personal Data” means personal data contained in Customer Data that we process on the Customer's behalf under the Agreement.

1.2 “Data Fiduciary” / “Controller” means the entity that determines the purposes and means of processing personal data.

1.3 “Data Processor” / “Processor” means an entity that processes personal data on behalf of a Data Fiduciary/Controller.

1.4 “Data Principal” / “Data Subject” means the identified or identifiable individual to whom personal data relates.

1.5 “Data Protection Laws” means all laws applicable to the processing under this DPA, including the DPDP Act and rules thereunder, the Information Technology Act, 2000 and the SPDI Rules, and, where applicable, the GDPR and UK GDPR.

1.6 “Personal Data Breach” means a breach of security leading to unauthorised processing of, or accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to, personal data that compromises its confidentiality, integrity, or availability.

1.7 “Subprocessor” means a third party engaged by us to process Customer Personal Data.

1.8 Other capitalised terms have the meanings given in the Terms of Service.

2.1 For Customer Personal Data, the Customer is the Data Fiduciary/Controller and ZipZy is the Data Processor.

2.2 For personal data we process to establish and manage the commercial relationship — account administration, billing, support, security, product analytics, and compliance — ZipZy is the Data Fiduciary/Controller, governed by the Privacy Policy rather than this DPA.

2.3 Where the Customer is itself a processor for a third-party controller, the Customer warrants that it has authority to appoint us as a subprocessor and to give the instructions in this DPA.

3.1 Documented Instructions. We process Customer Personal Data only on the Customer's documented instructions, which comprise: the Agreement and this DPA; the Customer's configuration and use of the Services; and any additional written instructions the parties agree.

3.2 Permitted Processing. These instructions authorise us to process Customer Personal Data to: provide, maintain, and support the Services; secure the Services and prevent abuse and fraud; perform backup and disaster recovery; and comply with law.

3.3 Legal Compulsion. If we are required by law to process Customer Personal Data other than on the Customer's instructions, we will inform the Customer before processing unless legally prohibited. See the Law Enforcement Request Policy.

3.4 Unlawful Instructions. We will notify the Customer if, in our opinion, an instruction infringes Data Protection Laws, and may suspend performance of that instruction until it is amended or confirmed.

3.5 No Independent Use. We will not sell Customer Personal Data, use it for our own marketing, or use it to train foundation models.

4.1 The Customer warrants that it has a valid lawful basis and, where required, verifiable consent for all Customer Personal Data submitted to the Services, and that it has provided all required notices to Data Principals.

4.2 The Customer is responsible for the accuracy, quality, and legality of Customer Personal Data and the means by which it was acquired.

4.3 The Customer will configure the Services appropriately, including access controls, retention settings, and sharing settings, and will not submit special-category or sensitive data to modules not designed to receive it.

4.4 The Customer will not instruct us to process Customer Personal Data in a manner that breaches Data Protection Laws.

We will:

• process Customer Personal Data only as set out in Section 3;
• implement and maintain the technical and organisational measures in Annex B;
• ensure personnel with access are bound by confidentiality obligations and appropriately trained;
• engage Subprocessors only in accordance with Section 8;
• assist the Customer as set out in Sections 10 and 11;
• notify the Customer of Personal Data Breaches as set out in Section 12;
• make available information necessary to demonstrate compliance and submit to audits as set out in Section 13;
• return or delete Customer Personal Data as set out in Section 14; and
• maintain records of processing activities carried out on the Customer's behalf.

6.1 Access to Customer Personal Data is restricted to personnel who require it to perform their duties, on a least-privilege basis.

6.2 All personnel are bound by written confidentiality obligations that survive termination of employment, undergo background verification appropriate to their role, and receive data protection and security awareness training at onboarding and annually thereafter.

6.3 Access rights are reviewed at least quarterly and revoked promptly on role change or exit.

7.1 We implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against Personal Data Breaches, taking into account the state of the art, cost of implementation, and the nature, scope, context, and purposes of processing.

7.2 Current measures are described in Annex B and in the Security Policy.

7.3 We may update these measures provided that the overall level of security is not materially reduced.

8.1 General Authorisation. The Customer grants general authorisation for us to engage Subprocessors to process Customer Personal Data, subject to this Section.

8.2 Current Subprocessors. The current list is maintained at Annex C and in the Subprocessor List Policy.

8.3 Obligations Flow-Down. Each Subprocessor is engaged under a written contract imposing data protection obligations no less protective than those in this DPA, including confidentiality, security, transfer safeguards, and deletion obligations.

8.4 Notice of Changes. We will notify Customers of the addition or replacement of a Subprocessor at least 30 days before that Subprocessor begins processing Customer Personal Data. Customers may subscribe to change notifications at privacy@zipzy.in.

8.5 Objection. The Customer may object on reasonable data protection grounds within 15 days of notice. The parties will discuss in good faith. If we cannot provide a reasonable alternative, the Customer may terminate the affected subscription without penalty and receive a prorated refund of prepaid unused fees.

8.6 Liability. We remain fully liable to the Customer for the performance of each Subprocessor's obligations.

8.7 Emergency Engagement. We may engage a Subprocessor without prior notice where necessary to address an urgent security or availability threat, notifying the Customer as soon as practicable afterwards.

9.1 Data Residency. Customer Personal Data is stored primarily on our servers located in India, with Data Backups in the AWS Asia Pacific (Mumbai) region.

9.2 Transfers Outside India. Where a Subprocessor processes Customer Personal Data outside India, we comply with Section 16 of the DPDP Act, do not transfer to any country restricted by notification of the Central Government, and implement contractual safeguards including Standard Contractual Clauses, a documented Data Transfer Impact Assessment, encryption in transit and at rest, and purpose and retention limitation.

9.3 GDPR Transfers. For Customer Personal Data subject to the GDPR or UK GDPR that is transferred outside the EEA or UK, the Standard Contractual Clauses referenced in Annex D apply, together with the UK International Data Transfer Addendum where relevant.

9.4 Government Access. We will challenge overbroad or unlawful government access requests and will notify the Customer unless legally prohibited, per the Law Enforcement Request Policy.

9.5 Data Localisation Requests. Enterprise Customers with specific residency requirements may request a written data residency commitment via privacy@zipzy.in.

Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance to the Customer with:

• responding to requests from Data Principals (Section 11);
• security of processing;
• Personal Data Breach notification to authorities and Data Principals;
• Data Protection Impact Assessments and prior consultation with supervisory authorities; and
• demonstrating compliance with Data Protection Laws.

Assistance beyond the self-service tools provided in the Services and beyond a reasonable volume of requests may be charged at our then-current professional services rates, notified in advance.

11.1 Self-Service. The Services provide tools enabling the Customer to access, correct, export, and delete Customer Personal Data without our involvement. The Customer should use these tools in the first instance.

11.2 Requests Received by Us. If we receive a request from a Data Principal relating to Customer Personal Data, we will not respond substantively but will, without undue delay and in any case within 5 business days, forward the request to the Customer and direct the individual to the Customer.

11.3 Support. Where the Customer cannot fulfil a request using the self-service tools, we will provide reasonable assistance within 10 business days of a written request.

12.1 Notification to Customer. We will notify the Customer of a Personal Data Breach affecting Customer Personal Data without undue delay and, where feasible, within 48 hours of becoming aware, to enable the Customer to meet its own 72-hour regulatory obligations.

12.2 Content. Notification will include, to the extent known: the nature of the breach; categories and approximate volume of Customer Personal Data and Data Principals affected; likely consequences; measures taken or proposed to address the breach and mitigate adverse effects; and a contact point for further information. Where full information is not available initially, we will provide it in phases without undue further delay.

12.3 Method. Notification is sent to the security or administrative contact registered in the Account. The Customer is responsible for keeping that contact current.

12.4 Cooperation. We will cooperate with the Customer's investigation, remediation, and regulatory notifications, and will not make any public statement identifying the Customer without prior consultation, except where legally required.

12.5 No Admission. Notification is not an acknowledgement of fault or liability.

12.6 Regulator Notification. Where we are independently required to notify the Data Protection Board of India, we will do so and will inform the Customer.

13.1 Documentation. On written request, and no more than once per 12 months, we will provide our current security documentation, including our security whitepaper, penetration test summary report, and any third-party attestations or certifications we hold, together with responses to a reasonable security questionnaire.

13.2 Audit Right. Where the documentation in 13.1 is insufficient to demonstrate compliance, the Customer may conduct an audit of our processing of Customer Personal Data, subject to:

• at least 30 days' prior written notice;
• no more than once per 12 months, except following a Personal Data Breach affecting the Customer or where required by a supervisory authority;
• conduct during business hours, without unreasonably disrupting operations;
• execution of a confidentiality agreement by the Customer and any third-party auditor, who must not be a competitor of ours;
• scope limited to systems and records relevant to Customer Personal Data, excluding other customers' data, our commercially sensitive information, and multi-tenant infrastructure internals; and
• the Customer bearing its own costs and our reasonable costs where the audit exceeds one business day.

13.3 Remediation. We will remediate confirmed material findings within a mutually agreed timeframe, and at our own cost where the finding evidences a breach of this DPA.

14.1 During the Term. The Customer may export Customer Personal Data at any time using in-product export tools or the API.

14.2 On Termination. Customer Personal Data remains available for export for 30 days after termination.

14.3 Deletion. After the 30-day window, we delete or irreversibly anonymise Customer Personal Data from live systems. Residual copies in Data Backups are purged on the rolling backup cycle, which does not exceed 35 days. Until purged, backup copies remain subject to all obligations in this DPA.

14.4 Deletion Certificate. A written certificate of deletion is available on request to privacy@zipzy.in.

14.5 Retention Exceptions. We may retain Customer Personal Data where required by law, in which case we will isolate it, restrict processing to that legal purpose, and delete it once the obligation expires. Billing and tax records are retained for 8 years as required by Indian law.

14.6 Further Detail. See the Data Retention Policy.

Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement. Nothing in this DPA limits either party's liability to Data Principals or supervisory authorities under Data Protection Laws.

This DPA takes effect on acceptance of the Agreement and continues until we have ceased all processing of Customer Personal Data. Sections 6, 9, 12, 14, and 15 survive termination.

17.1 Conflict. In the event of conflict, this DPA prevails over the Agreement in respect of the processing of Customer Personal Data, and Annex D prevails over this DPA where GDPR applies.

17.2 Amendment. We may update this DPA to reflect changes in Data Protection Laws or the Services, provided the Customer's protections are not materially reduced. Material changes are notified 30 days in advance.

17.3 Governing Law. As set out in the Agreement, except where Data Protection Laws mandate otherwise.

A.1 Subject Matter. Provision of the ZipZy® Services under the Agreement.

A.2 Duration. For the term of the Agreement, plus the retention and deletion periods in Section 14.

A.3 Nature and Purpose. Hosting, storage, structuring, retrieval, transmission, display, backup, analysis, generation of analytics, delivery of messages, execution of AI Features on request, provision of support, security monitoring, and deletion.

A.4 Categories of Data Principals

• The Customer's employees, contractors, and Users
• The Customer's customers, prospects, subscribers, and contacts
• End Users who click links, scan QR codes, visit hosted pages, or submit forms
• Recipients of messages sent through the Services
• Job applicants and employees, where HRMS functionality is used

A.5 Categories of Personal Data

A.6 Special or Sensitive Categories. Not intended to be processed, except employment-related data submitted deliberately by the Customer to the HRMS module. The Customer must not submit other special-category data.

A.7 Frequency. Continuous, for the duration of the Agreement.

A.8 Retention. As set out in Section 14 and the Data Retention Policy.

B.1 Encryption

TLS 1.2 or higher for all data in transit, including between internal services. AES-256 encryption at rest for databases, file storage, and backups. Passwords stored using a modern memory-hard hashing algorithm with per-user salt. Secrets held in a managed secret store, never in source control.

B.2 Access Control

Role-based access control with least privilege. Mandatory multi-factor authentication for all personnel with production access. Unique named accounts; no shared administrative credentials. Just-in-time, time-bound, approved production access. Quarterly access reviews and same-day revocation on exit.

B.3 Network and Infrastructure Security

Cloudflare edge protection providing DDoS mitigation, Web Application Firewall, bot management, and TLS termination. Nginx reverse proxy with rate limiting and hardened TLS configuration. Network segmentation with production isolated from development and corporate environments. No direct public exposure of database services. Regular patching of operating systems and dependencies.

B.4 Application Security

Secure development lifecycle with peer code review. Automated dependency and vulnerability scanning in CI. Parameterised queries and framework-level protections against injection, XSS, and CSRF. Tenant isolation enforced at the application and query layer. Annual penetration testing by an independent party.

B.5 Logging and Monitoring

Centralised application, access, and administrative audit logs retained for 12 months. Alerting on anomalous authentication, privilege escalation, and data export activity. Availability and performance monitoring with on-call escalation.

B.6 Backup and Resilience

Automated Data Backups on a rolling 35-day cycle. Periodic restore testing. Documented business continuity and disaster recovery plan with defined RPO and RTO targets, reviewed annually.

B.7 Incident Management

Documented incident response plan with defined severity levels, roles, escalation paths, and communication templates. Post-incident review with corrective actions tracked to closure.

B.8 Personnel

Background verification appropriate to role. Written confidentiality agreements. Security and data protection training at onboarding and annually. Documented offboarding checklist including immediate credential revocation and device recovery.

B.9 Vendor Management

Security and data protection assessment before onboarding a Subprocessor, written data processing terms, and periodic review.

B.10 Physical Security

Backup infrastructure hosted in AWS Mumbai facilities with the physical security controls maintained by that provider. Self-managed infrastructure held in access-controlled premises with restricted physical entry and device-level encryption.

B.11 Data Minimisation and Segregation

Collection limited to what is necessary for the stated purpose. IP addresses truncated or hashed for analytics reporting. Logical separation of tenant data. Production data is not used in development or test environments.

The authoritative, continuously updated list is maintained in the Subprocessor List Policy. Categories currently engaged:

Notification of changes is provided under Section 8.4.

D.1 Application. This Annex applies only where Customer Personal Data is subject to the GDPR or UK GDPR and is transferred to us in India.

D.2 EU SCCs. The Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914 are incorporated by reference, with Module Two (Controller to Processor) applying where the Customer is a controller, and Module Three (Processor to Processor) applying where the Customer is itself a processor.

D.3 Completion of the SCCs

D.4 UK Transfers. The UK International Data Transfer Addendum (Version B1.0) is incorporated, with Tables 1–4 completed by reference to Section D.3, and the importer permitted to terminate under Section 19 of the Addendum.

D.5 Swiss Transfers. The EU SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent authority.

D.6 Conflict. In the event of conflict between the SCCs and any other part of this DPA or the Agreement, the SCCs prevail in respect of transfers to which they apply.

Privacy Team — Prince Tyagi
privacy@zipzy.in

Pranava Company Group (ZipZy®), 62, Mandola, Loni, Ghaziabad, Uttar Pradesh 201102, Bharat (India)