1.Purpose and scope
This Data Processing Addendum ("DPA") forms part of the agreement between [Registered legal entity name] ("AOZO") and the customer that subscribes to AOZO apps ("Customer"). It applies when AOZO processes personal data in Customer's workspaces on Customer's behalf.
Under the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), Customer is the Data Fiduciary and AOZO is the Data Processor for that data. If there is a conflict between this DPA and the rest of the agreement about personal data, this DPA prevails.
2.Details of processing
| Item | Description |
|---|---|
| Subject matter | Providing the AOZO apps Customer subscribes to: CRM, Helpdesk, Projects, Accounting, Teams (HRMS) and Hubble |
| Duration | For as long as Customer has an active subscription, plus the period needed to return or erase data |
| Nature of processing | Hosting, storing, retrieving, displaying, transmitting, backing up and deleting data, as Customer and its users instruct through the apps |
| Types of personal data | Contact details, business and professional details, GSTIN, communication and ticket content, task and project content, attendance, leave and payroll records, bank account details used for payroll, and any other data Customer chooses to put into the apps |
| Categories of Data Principals | Customer's leads, customers and their staff; support requesters; Customer's employees and contractors; other people whose data Customer chooses to store |
3.Processing on Customer's instructions
AOZO will process personal data only on Customer's documented instructions, which are the agreement, this DPA, and Customer's use and configuration of the apps. AOZO will tell Customer if it believes an instruction would break the law, and may stop processing until it is resolved.
AOZO will not use Customer's personal data for its own purposes, other than to provide, secure and support the services, to meet legal obligations, and to create anonymous, aggregated data that does not identify Customer or any individual.
4.Customer's responsibilities
- Customer is responsible for having a valid ground under the DPDP Act to process the data, such as the consent of the Data Principal or a legitimate use (for example, employment purposes).
- Customer is responsible for giving the notices the DPDP Act requires to the Data Principals whose data it puts into AOZO.
- Customer must keep the data accurate and complete where it is used to make decisions about a person.
- Customer must get verifiable parental or guardian consent before processing a child's personal data, as the DPDP Act requires.
- Customer decides who in its organisation has access, and should protect accounts with two-factor sign-in.
5.Confidentiality
AOZO ensures that everyone authorised to process Customer's personal data is bound by a duty of confidentiality, and gets access only to the extent their job needs.
6.Security safeguards
AOZO applies reasonable security safeguards, appropriate to the risk, to protect personal data against a breach, including:
- Encryption of data in transit.
- Role-based access controls within workspaces, and least-privilege access for AOZO staff.
- Strong authentication, including optional email OTP, authenticator app and passkey sign-in.
- Activity logging and monitoring of access to systems.
- Regular backups and a process for restoring service.
- Processes for finding, assessing and fixing security issues.
7.Sub-processors
Customer gives AOZO general authorisation to use sub-processors, such as cloud hosting and message-delivery providers. AOZO will have a written contract with each that requires protection of data at least equal to this DPA, and remains responsible for their performance.
A current list of sub-processors is available on request at privacy@aozo.in. AOZO will give Customer reasonable notice of a new sub-processor, and Customer may object on reasonable data-protection grounds. If the issue cannot be resolved, Customer may stop using the affected service.
8.Transfers outside India
AOZO will not transfer personal data to a country or territory that the Central Government has restricted under Section 16 of the DPDP Act. For any other transfer, AOZO ensures appropriate safeguards are in place.
9.Helping with Data Principal requests
Customer's users can access, correct and erase most data directly in the apps. If AOZO receives a request from a Data Principal about Customer's data, AOZO will pass it to Customer without undue delay and will not respond to it directly unless the law requires. AOZO will give reasonable help so that Customer can respond to requests for access, correction, erasure and grievances.
10.Personal data breach
If AOZO becomes aware of a personal data breach affecting Customer's data, AOZO will notify Customer without undue delay, describe what happened, the data and people affected where known, and the steps taken, and keep Customer informed. This helps Customer meet its duty to report to the Data Protection Board of India and to affected Data Principals.
11.Audits and information
On reasonable request, AOZO will give Customer the information needed to show compliance with this DPA, and will allow audits by Customer or an independent auditor under confidentiality, no more than once a year unless a breach requires otherwise, at reasonable times and without disrupting the services.
12.Return and deletion
When the agreement ends, Customer can export its data. After the export period stated in the Terms, AOZO erases Customer's personal data, and instructs sub-processors to do so, unless the law requires it to be kept. Copies in backups are erased on their normal rotation.
13.Liability and term
Liability under this DPA is subject to the limits in the Terms of Service. This DPA stays in force as long as AOZO processes personal data for Customer.
Questions about this DPA: privacy@aozo.in. To request a signed copy: legal@aozo.in.