Data processing agreement

DRAFT — not legal advice. Review with qualified counsel (Indian law: IT Act 2000, DPDP Act 2023; plus GDPR/UK GDPR if serving EU/UK customers) before publishing.

Last updated: [Effective date]

This data processing agreement ("DPA") forms part of the Terms of service between the customer and [Company legal name], [Registered address] ("vizsu"). If they conflict, this DPA wins on data protection matters.

1. Roles

• The customer is the controller (data fiduciary under the DPDP Act 2023) of personal data in customer content.
• vizsu is the processor (data processor under the DPDP Act) and processes that data only on the customer's documented instructions.
• The terms, this DPA and the customer's use of the dashboard and API are the customer's instructions. vizsu will tell the customer if it believes an instruction breaks the law.

2. Details of processing

3. vizsu's obligations

vizsu will:

• process customer personal data only to provide the service and as instructed;
• make sure staff and contractors with access are bound by confidentiality;
• apply the technical and organisational measures in Annex 2;
• help the customer respond to data subject requests, carry out impact assessments and consult regulators, as far as reasonably possible given the nature of the processing [at the customer's cost for effort beyond the self-service tools];
• not sell customer personal data or use it for its own purposes, other than aggregated, de-identified service metrics and abuse prevention.

4. Sub-processors

• The customer gives general authorisation for the sub-processors listed in Annex 3 and at Sub-processors.
• vizsu will give at least [30] days' notice of a new sub-processor by [email to the account owner / updating the page with a subscription option]. The customer may object on reasonable data protection grounds. If we cannot resolve it, the customer may end the affected service and receive a pro-rata refund of prepaid fees.
• vizsu imposes data protection terms on each sub-processor that are no less protective than this DPA, and remains responsible for their performance.

5. International transfers

Customer data is hosted in India (ap-south-1). Where personal data subject to GDPR or UK GDPR is transferred to India or elsewhere outside the EEA/UK, the parties agree to the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module [2 — controller to processor] [and Module 3 for onward transfers], and the UK International Data Transfer Addendum, which are incorporated by reference. [SCC options: clause 7 docking — [yes/no]; clause 9 option — general authorisation, [30] days; clause 11 — independent redress [no]; clause 17 governing law — [EU member state]; clause 18 forum — [EU member state].] [Counsel to confirm and attach.]

Transfers under the DPDP Act will follow any restrictions notified by the Government of India.

6. Security incidents

• vizsu will notify the customer without undue delay and in any case within 72 hours of becoming aware of a personal data breach affecting customer data.
• The notice will include, as far as known: what happened, the data and number of people affected, likely consequences, what we have done and recommend, and a contact. We will add information as it becomes available.
• The customer, as controller/data fiduciary, decides on notifying regulators (including the Data Protection Board of India) and data subjects. vizsu will help. vizsu will also make any report it must make itself, such as to CERT-In within 6 hours under its 2022 directions.
• Notifying the customer is not an admission of fault.

See Incident response.

7. Audits

vizsu will make available information reasonably needed to show compliance with this DPA, such as security summaries and [third-party audit reports, when available]. The customer may audit at most once a year, with [30] days' notice, at its own cost, during business hours, and subject to confidentiality, unless a regulator requires otherwise or there has been a breach.

8. Data subject requests

Admins can access, correct, export and delete mailbox data themselves through the dashboard and API. If vizsu receives a request directly about customer content, it will pass it to the customer and not answer it, unless the law requires.

9. Deletion and return at the end

• At termination or account closure, the customer has 30 days to export customer content using the export tools (mbox per mailbox plus account metadata).
• After that window, vizsu deletes customer content from live systems. Backup copies expire within a further 30 days on their normal rotation.
• vizsu may keep data the law requires it to keep, protected and only for that purpose.
• On request, vizsu will confirm deletion in writing.

10. Liability

Each party's liability under this DPA is subject to the limits in the terms. [Counsel to confirm whether data protection breaches carry a separate, higher cap.]

11. Term

This DPA lasts as long as vizsu processes customer personal data.

---

Annex 1 — Parties

Annex 2 — Technical and organisational measures

• Encryption in transit with TLS 1.2 or later for webmail, API, IMAP, SMTP submission, and opportunistic TLS between mail servers (MTA-STS supported).
• Encryption at rest for databases, mail storage and backups [confirm per provider].
• Sign-in through vizsu SSO with multi-factor authentication; MFA required for vizsu staff.
• Tenant isolation, role-based access (owner, admin, member), least-privilege staff access.
• Audit log of admin and suspension actions, exportable by the customer.
• Spam, malware and phishing filtering; outbound sending limits and automatic abuse suspension.
• Encrypted nightly backups kept for 30 days, with tested restores [planned; see note].
• Monitoring and alerting, incident response process, vulnerability disclosure at security@vizsu.com.
• Third-party credentials used for imports are encrypted and deleted when the import ends.

Note for the business: as of this draft, nightly encrypted backups and restore tests are a decided plan but not yet implemented (see docs/PRODUCTION_READINESS.md). Do not sign this DPA until they are live, or remove the backup claim.

Annex 3 — Sub-processors

The current list is maintained at Sub-processors.

---

Placeholders to fill

• [Effective date]
• [Company legal name], [Registered address], [DPO / privacy contact email]
• Customer fields in Annex 1
• Sub-processor notice period [30] days and channel
• SCC module and clause options; EU member state for governing law and forum; UK Addendum
• Audit report availability; audit notice [30] days
• Assistance cost position
• Separate liability cap for data protection, if any
• Encryption-at-rest confirmation per provider
• [Gateway legal entity] and location; support/email tooling sub-processors; whether Cloudflare proxies web traffic