Data Processing Agreement (DPA)

1. Statutory Roles & Scope of Processing

• Customer as Data Fiduciary: Customer determines the statutory purpose, categories, and lawful basis for collecting and processing personal data under DPDP Act Section 4 and Section 6.
• CompTrust as Data Processor: CompTrust processes personal data solely on behalf of and under the documented instructions of the Customer to provide privacy automation, consent logging, DSR portal routing, and retention execution.
• Subject Matter & Duration: Processing shall commence upon Customer subscribing to CompTrust and continue until the termination of Customer's subscription and completion of the data return/erasure period.

2. Obligations of CompTrust as Processor

CompTrust covenants and agrees that it shall:

1. Process personal data strictly in accordance with documented instructions from Customer, including regarding data residency and data transfers.
2. Ensure that all personnel authorized to access Customer personal data are bound by strict statutory non-disclosure and confidentiality obligations.
3. Implement and maintain rigorous Technical and Organizational Measures (TOMs) as specified in Section 3 below.
4. Not sell, retain, or monetize Customer personal data for any purpose other than providing the agreed SaaS services.

3. Technical & Organizational Security Measures (TOMs)

In compliance with DPDP Act Section 8(5) and GDPR Article 32, CompTrust enforces:

• Data Encryption: All Customer data at rest is encrypted using AES-256 bit encryption via AWS Key Management Service (KMS). All data in transit is encrypted using TLS 1.3.
• Data Localization & Sovereignty: All customer data stores, databases, and backup snapshots are strictly hosted in AWS Asia Pacific (Mumbai) `ap-south-1` within the sovereign territory of the Republic of India.
• Logical Tenant Isolation: Every database transaction enforces organizational multi-tenant boundary filters (`WHERE org_id = :orgId`), preventing any cross-tenant data bleed.
• Access Controls & MFA: Multi-factor authentication is enforced across all privileged infrastructure and administrative accounts. Role-based access control (RBAC) restricts internal access on a strict need-to-know basis.
• Tamper-Evident Logging: All administrative and compliance actions generate immutable, synchronized UTC audit logs with cryptographic SHA-256 verification hashes.

4. Subprocessor Controls & Notification

Customer grants general authorization to CompTrust to engage subprocessors to provide infrastructure, payment, and error monitoring services.

• Approved Subprocessors: The current list of authorized subprocessors is publicly available at https://comptrust.in/subprocessors.
• 30-Day Advance Notification: CompTrust shall provide at least thirty (30) days prior notice via email before engaging any new subprocessor or modifying an existing subprocessor's processing scope.
• Objection Rights: If Customer has reasonable data protection grounds to object to a new subprocessor, Customer may terminate the subscription without penalty by providing written notice within thirty (30) days.
• Flow-Down Obligations: CompTrust enforces data protection terms on each subprocessor that are no less protective than those set forth in this DPA.

5. Personal Data Breach Notification & Assistance

In the event of a confirmed Personal Data Breach affecting Customer personal data:

• CompTrust shall notify Customer without undue delay and in all events within twenty-four (24) hours of becoming aware of the incident.
• The notification shall describe: the nature of the breach, affected data categories, estimated number of affected Data Principals, likely consequences, and remediation measures undertaken.
• CompTrust shall reasonably assist Customer in fulfilling its mandatory statutory reporting obligations to the Data Protection Board of India (DPBI) and CERT-In within the statutory 72-hour notification window under DPDP Section 8(6).

6. Data Principal Rights & Regulatory Assistance

Taking into account the nature of processing, CompTrust shall assist Customer by:

• Providing technical features (DSR portal, webhook triggers, OTP verification) enabling Customer to honor Data Principal rights of access, correction, and erasure within the statutory 30-day timeline (Sections 11 and 12).
• Providing an integrated DPIA risk engine and exportable assessment records for Significant Data Fiduciary compliance under Section 10.
• Issuing cryptographically signed Certificates of Erasure with SHA-256 hashes upon purpose-limitation data purges under Section 8(7).

7. Zero Vendor Lock-in & Return/Deletion of Data

• Portability Guarantee: Customer may at any time during the subscription term download a 1-click complete machine-readable JSON archive of all compliance records, consents, DSR histories, and audit logs via the dashboard or API (`GET /api/v1/orgs/:orgId/compliance/export-all`).
• Post-Termination Erasure: Within thirty (30) days following termination of services, CompTrust shall securely delete all Customer personal data from active databases and issue an official, cryptographically verifiable Certificate of Erasure to Customer.

8. Governing Law & Jurisdiction

This DPA shall be governed by and construed in accordance with the laws of the Republic of India. Any disputes arising hereunder shall be subject to the exclusive jurisdiction of the courts of Bengaluru, Karnataka, India.