Data processing agreement

1.Definitions

Controller

The client entity that determines the purposes and means of processing personal data.

Processor

Algobain Technologies OPC Private Limited, acting on the instructions of the Controller.

Personal Data

Any information relating to an identified or identifiable natural person, as defined under GDPR Article 4(1).

Processing

Any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.

Sub-processor

Any third party engaged by the Processor to process Personal Data on behalf of the Controller.

2.Processor obligations

Algobain, as Processor, agrees to:

• Process Personal Data only on documented instructions from the Controller.
• Ensure that persons authorised to process Personal Data are bound by confidentiality obligations.
• Implement appropriate technical and organisational security measures per GDPR Article 32.
• Not engage Sub-processors without prior written authorisation from the Controller.
• Assist the Controller in responding to data subject rights requests (access, erasure, portability).
• Notify the Controller of any Personal Data breach within 24 hours of becoming aware of it.
• Delete or return all Personal Data upon termination of the engagement, at the Controller’s election.
• Make available all information necessary to demonstrate compliance with GDPR Article 28.

3.Security measures

Algobain implements the following technical and organisational measures:

Encryption in transit

TLS 1.3 on all endpoints

Encryption at rest

AES-256 for stored data

Access control

Role-based, least privilege

Audit logging

All data access logged

Vulnerability management

SAST + dependency scanning

Incident response

24h breach notification SLA

4.Sub-processors

Algobain uses the following sub-processors. The Controller provides general written authorisation for these sub-processors subject to the safeguards described:

5.International transfers

Where Personal Data is transferred outside the EEA or UK, Algobain implements Standard Contractual Clauses (SCCs) as approved by the European Commission. Clients may request data residency within the EU (Frankfurt or Ireland AWS/GCP regions) at no additional architecture cost.

6.Governing law

This DPA is governed by the laws of India, without prejudice to the mandatory provisions of GDPR applicable to EU/UK data subjects. Any disputes shall be subject to the exclusive jurisdiction of the courts of Indore, Madhya Pradesh, India, unless otherwise agreed in the Master Services Agreement.