Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between you (“Customer”) and YantrAdhigam Labs Pvt Ltd(“VIDU”) and applies where VIDU processes personal data contained in your Customer Content on your behalf. It reflects the requirements of the EU/UK GDPR (Article 28) and India's Digital Personal Data Protection Act, 2023. For Enterprise customers, an executable counterpart is available on request.

1. Roles

For Customer Content, you are the Controller / Data Fiduciary and VIDU is the Processor / Data Processor. You determine the purposes and means of processing; VIDU processes only on your documented instructions (which include the Terms and your use of the Services). You are responsible for having a lawful basis and all required notices/consents for the personal data you provide.

2. Details of processing

• Subject-matter & duration: provision of the VIDU CRM Services for the term of your subscription.
• Nature & purpose: hosting, storage, and processing of CRM records to deliver the Services.
• Types of data: business-contact and CRM data you choose to upload (names, contact details, notes, activity).
• Data subjects: your customers, leads, contacts and personnel.

3. VIDU's obligations

• Process Customer Content only on your documented instructions, including for transfers, unless required by law (in which case we notify you where lawful).
• Ensure personnel who process Customer Content are bound by confidentiality.
• Implement appropriate technical and organisational security measures (Article 32), see our Data & Security page.
• Assist you, taking into account the nature of processing, with data-subject requests and with your security, breach-notification and impact-assessment obligations.
• Not use Customer Content for our own purposes, marketing, or to train models on an identifiable basis.

4. Sub-processors

You authorise VIDU to engage sub-processors listed in our sub-processor register to help deliver the Services. We impose data-protection obligations on each sub-processor no less protective than this DPA and remain responsible for their performance. We will give notice of intended changes and you may object on reasonable data-protection grounds.

5. Data-subject requests

Taking into account the nature of processing, VIDU will assist you by appropriate technical and organisational measures, and via in-product export/erasure tools, to respond to requests from data subjects to exercise their rights. If a data subject contacts VIDU directly about Customer Content, we will direct them to you.

6. Security

VIDU maintains measures including encryption in transit and at rest, access controls (RBAC), tenant isolation, audit logging, and least-privilege access, as described on our Data & Security page.

7. Personal-data breach

VIDU will notify you without undue delay after becoming aware of a personal-data breach affecting your Customer Content, and provide information reasonably available to help you meet your notification obligations (to the Data Protection Board of India, supervisory authorities and/or data subjects, as applicable).

8. Deletion & return

On termination, VIDU will, at your choice, make Customer Content available for export for 30 days, and then delete it from active systems in the ordinary course, subject to legal retention requirements and routine backup cycles.

9. International transfers

Where Customer Content is transferred across borders, VIDU relies on lawful mechanisms (for the EEA/UK, Standard Contractual Clauses or an adequacy basis; for DPDP, transfers only to jurisdictions not restricted by the Central Government).

10. Audit

VIDU will make available information reasonably necessary to demonstrate compliance with this DPA and allow for audits by you or your mandated auditor, on reasonable prior notice, subject to confidentiality and not more than once per year absent a breach or regulator requirement.

11. Liability

Each party's liability under this DPA is subject to the limitations of liability in the Terms of Service.

12. General

This DPA is governed by the same law and dispute-resolution terms as the Terms of Service. If any conflict arises between this DPA and the Terms regarding processing of Customer Content, this DPA prevails. Contact grievance@yalabs.in to request a signed counterpart.