VEDHIN TECHNOLOGY DATA PROCESSING ADDENDUM

Controller-Processor Agreement | Effective: May 2024

DPA REFERENCE: VEDHIN-DPA-2024-01

This Data Processing Addendum ("DPA") forms part of the Master Services Agreement between Client ("Controller") and Vedhin Technology ("Processor"). This DPA reflects the parties' agreement with regard to Processing of Personal Data in accordance with GDPR, DPDP, and other applicable data protection laws.

Execution: This DPA is incorporated by reference into the MSA. By continuing to use Vedhin's services, Client agrees to this DPA.

SCHEDULE 1: DETAILS OF PROCESSING

CategoryDetails
Subject MatterProcessing necessary for provision of IT services as per SOW
DurationTerm of MSA plus data return/deletion period
Nature & PurposeSoftware development, testing, maintenance, support, hosting
Data Categories Client Employee Data: Name, email, business contact
End User Data: As contained in Client applications
Technical Data: IP addresses, device identifiers
Special Categories: Only if explicitly specified in SOW
Data SubjectsClient employees, contractors, end users, business contacts

SCHEDULE 2: SECURITY MEASURES

Technical & Organizational Measures

Access Control
  • Role-based access controls (RBAC)
  • Multi-factor authentication
  • Principle of least privilege
  • Quarterly access reviews
Data Protection
  • Encryption at rest (AES-256)
  • Encryption in transit (TLS 1.3)
  • Data minimization principles
  • Pseudonymization where feasible
Monitoring & Testing
  • 24/7 security monitoring
  • Vulnerability scanning weekly
  • Penetration testing annually
  • Security incident simulation quarterly

SCHEDULE 3: SUB-PROCESSORS

Approved Sub-Processor List

Sub-ProcessorServiceLocationDPA in Place
Amazon Web ServicesCloud InfrastructureUSA, Ireland, SingaporeYes (AWS GDPR DPA)
Microsoft AzureCloud ServicesNetherlands, USA, IndiaYes
Google Cloud PlatformCloud ServicesBelgium, USA, TaiwanYes
FreshworksSupport TicketingUSA, GermanyYes
Slack TechnologiesCommunicationUSAYes

Sub-Processor Engagement Terms:

  1. Vedhin will notify Client of new sub-processors 30 days in advance
  2. Client may object on reasonable grounds within 14 days
  3. Vedhin will impose same data protection obligations on sub-processors
  4. Vedhin remains liable for sub-processor breaches

SCHEDULE 4: INTERNATIONAL TRANSFERS

Transfer Mechanisms

Transfer ScenarioApplicable MechanismReference
EU/EEA to IndiaEU Standard Contractual Clauses (2021)Module Two: Controller to Processor
UK to IndiaInternational Data Transfer Addendum to EU SCCsUK ICO Approved IDTA
Switzerland to IndiaRevised Swiss SCCsFDPIC Approved
Other CountriesAdequacy Decision or SCCsCase-by-case assessment

Transfer Impact Assessments: Vedhin will conduct TIAs for transfers to countries without adequacy decisions. Client will be notified of any high-risk findings.

SCHEDULE 5: DATA SUBJECT RIGHTS COOPERATION

Assistance Obligations

Data Subject RightController ResponsibilityProcessor Assistance
Right to AccessVerify identity, validate requestProvide technical means to access data
Right to ErasureDetermine lawfulness of requestDelete/return data as instructed
Right to RectificationValidate accuracy of correctionImplement correction in systems
Data PortabilitySpecify format requirementsProvide data in structured format

Cost Allocation: Vedhin will bear costs for first 10 hours of assistance per calendar year. Additional assistance billed at ₹2,500 per hour.

SCHEDULE 6: AUDIT RIGHTS

Audit Protocol

  1. Notice: Client must provide 30 days written notice
  2. Scope: Limited to systems processing Client Data
  3. Frequency: Maximum once per calendar year
  4. Duration: Maximum 2 business days on-site
  5. Auditors: Must be independent, qualified, sign NDA
  6. Costs: Client bears all audit costs
  7. Reports: Confidential findings shared with Vedhin
  8. Remediation: Vedhin will address material findings within 90 days

Alternative to Audit: Client may accept Vedhin's most recent:
• ISO 27001 certification
• SOC 2 Type II report
• Penetration test results
• External audit reports

EXECUTION & GOVERNANCE

This DPA becomes effective upon the later of: (i) execution of MSA, or (ii) commencement of Processing.

Termination: Upon termination, Vedhin will delete or return all Client Data as instructed. Deletion certified in writing.

Governing Law: As per MSA, with specific jurisdiction for data protection matters to supervisory authorities where Data Subjects reside.

Amendments: Vedhin may update this DPA to reflect legal changes. Material changes notified 30 days in advance.

VEDHIN TECHNOLOGY
DPO: Ms. Ananya Sharma | Email: dpo@vedhin.com
Address: Jaipur, Rajasthan 302001
Last Updated: May 2025 | DPA Version: 2025.2