Data processing agreement

1. Parties and roles

This agreement is between the business using Kaltline (the “Customer”), as Data Fiduciary, and [Legal entity name] (“Kaltline”), as Data Processor, for personal data Kaltline processes on the Customer’s behalf. It forms part of the terms of service. Terms such as Data Fiduciary, Data Processor, Data Principal and personal data breach have the meanings in section 2 of the DPDP Act.

2. What is processed

Data Principals

The Customer’s customers and contacts, and the Customer’s staff.

Personal data

Names, phone numbers, email addresses, WhatsApp, SMS and email messages, call records and recordings, quotes and orders, and notes the Customer adds.

Purpose

Providing the Kaltline service as the Customer configures it.

Duration

The term of the agreement, then until deletion under section 9.

3. Instructions

Kaltline processes the personal data only on the Customer’s documented instructions: these terms, and how the Customer sets up and uses its workspace. Kaltline will tell the Customer if it believes an instruction breaks the law.

4. Security safeguards

Kaltline maintains reasonable security safeguards, including those listed in Rule 6 of the DPDP Rules:

• encryption of provider credentials and of data in transit;
• access controls that keep each company’s records separate and limit staff access by role;
• logs of access and processing, monitored and reviewed [log store and review process to be confirmed];
• measures for continued processing, such as backups [backup arrangements to be confirmed];
• keeping the logs and related personal data for one year (Rules 6(1)(e) and 8(3)).

Kaltline’s people who can access the personal data are bound by confidentiality. The current measures are described on the security page.

5. Sub-processors

The Customer authorises the sub-processors below. Kaltline will give [number] days’ notice of a new sub-processor; the Customer may object on reasonable grounds. Each sub-processor is bound by a contract with safeguards at least as protective as this agreement, and Kaltline remains responsible for it.

6. Personal data breaches

Kaltline will tell the Customer without undue delay, and in any case within [hours] hours, after becoming aware of a personal data breach affecting the Customer’s data. It will give the information the Customer needs to inform affected Data Principals and the Data Protection Board without delay, and to send the Board’s detailed report within 72 hours (Rule 7): what happened, its extent and timing, the likely impact, the steps taken and planned, and a contact person.

7. Data Principals’ requests

Kaltline will help the Customer answer requests for access, correction, erasure, grievance redressal and nomination within the period the Customer publishes, which may not exceed 90 days (Rule 14). Kaltline will pass on any such request it receives directly.

8. Withdrawal of consent

When the Customer tells Kaltline that a Data Principal has withdrawn consent, Kaltline will stop processing the affected personal data within a reasonable time, unless the law requires otherwise (s.6(6)).

9. Return and deletion

The Customer can export customers, conversations and messages as CSV at any time. When the agreement ends, or when the Customer asks, Kaltline will delete the personal data within [number] days (s.8(7)), except logs and data it must keep for one year under Rule 8(3), or longer where another law requires it.

10. Transfers outside India

The personal data is processed in the locations listed for each sub-processor. Kaltline will not transfer it to a country the Government restricts under section 16 of the DPDP Act.

11. Audits and the Board

Kaltline will give the Customer the information reasonably needed to show that it meets this agreement, and will cooperate with the Customer in any inquiry by the Data Protection Board. [Audit rights and frequency].

12. Contact

Company

[Legal entity name], CIN [CIN]

Registered office

[Registered address]

Grievance officer

[Grievance officer name], [grievance email], [phone], [registered address]