Data Processing Agreement

Parties

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Debryx Technologies Pvt. Ltd. (“Processor”) and the customer entity subscribing to the Debryx platform (“Controller”).

Definitions

• Personal Data: Any information relating to an identified or identifiable natural person
• Processing: Any operation performed on Personal Data, including collection, storage, use, and deletion
• Data Subject: The individual to whom the Personal Data relates
• Sub-processor: A third party engaged by the Processor to assist in processing Personal Data

Processing Details

• Subject Matter: Construction waste traceability and compliance management
• Duration: The term of the Customer’s subscription to the Platform
• Nature and Purpose: Providing the Debryx platform for waste batch tracking, evidence management, compliance reporting, and regulatory submissions
• Categories of Data Subjects: Employees, contractors, and representatives of the Controller who use the Platform
• Types of Personal Data: Names, email addresses, phone numbers, job titles, user activity logs, and authentication credentials

Obligations of the Processor

The Processor shall:

• Process Personal Data only on documented instructions from the Controller
• Ensure confidentiality of personnel authorised to process Personal Data
• Implement appropriate technical and organisational security measures
• Not engage another processor without prior authorisation
• Assist the Controller in fulfilling data subject rights requests
• Assist with data protection impact assessments where required
• Delete or return Personal Data at the end of the service term
• Notify the Controller of any personal data breach without undue delay

Sub-processors

The Controller authorises the engagement of the following sub-processors:

• Vercel Inc. — Cloud hosting and infrastructure (US)
• Cloudinary Ltd. — Image and file storage (IL/US)
• Redis Ltd. — In-memory caching and rate limiting (US)
• Google Cloud Platform — Optional OCR processing (US/IN)

The Processor will provide 30 days’ notice before adding or replacing sub-processors. The Controller may object to new sub-processors within 14 days of notice.

Data Subject Rights

The Processor shall assist the Controller in responding to data subject requests to exercise their rights under applicable data protection laws, including rights of access, rectification, erasure, restriction, portability, and objection.

Security Measures

The Processor maintains the following security measures:

• Encryption of Personal Data at rest (AES-256-GCM) and in transit (TLS 1.3)
• Role-based access controls and least-privilege principles
• Regular security assessments and penetration testing
• Employee security training and confidentiality agreements
• Incident response and breach notification procedures

Breach Notification

The Processor will notify the Controller without undue delay (and within 48 hours) upon becoming aware of a personal data breach affecting Controller data. The notification will include the nature of the breach, categories of data involved, and remediation steps.

Audit Rights

Upon 30 days’ notice, the Controller may audit the Processor’s compliance with this DPA. Audits shall be conducted during business hours and shall not unreasonably interfere with the Processor’s operations. The Processor may charge reasonable fees for audit support.

Return and Deletion of Data

Upon termination of the Services, the Processor shall, at the Controller’s direction, return all Personal Data in a common format or securely delete it within 90 days, unless retention is required by applicable law.

Governing Law

This DPA shall be governed by the laws of India. Any disputes shall be subject to the jurisdiction of the courts in Bengaluru, Karnataka.

Accepting This DPA

This DPA is incorporated by reference into the Terms of Service. By using the Platform, you agree to the terms of this DPA. A signed copy can be requested at dpa@debryx.in.