This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Controller") and Ektasi Technology (OPC) Private Limited ("Processor") and applies where we process personal data on your behalf (such as the customer contacts you upload).
You are the controller/Data Fiduciary and determine the purposes of processing; we are the processor/Data Processor and process personal data only to provide the Service and on your documented instructions.
You give general written authorisation for the sub‑processors listed at /subprocessors, which is the authoritative and current list. We impose data‑protection obligations on them no less protective than this DPA and remain fully liable for their performance. We give 30 days' notice before adding or replacing a sub‑processor that processes customer personal data; you may object within that period on reasonable data-protection grounds, and if we cannot offer a workaround you may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees. Emergency replacements may be made immediately, with notice as soon as practicable.
Customer personal data is stored in India. That is the only region we operate — there is no European Union, Singapore or United States shard, and no way to move a workspace to one. Where personal data is transferred out of the EEA or UK to us in India, we rely on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), with the UK International Data Transfer Addendum where UK data is involved. A transfer impact assessment covering Indian government access powers has been completed and is available on request. It is candid: Indian interception law does not meet the European Essential Guarantees on independent oversight or individual redress, and while OAuth tokens and secrets are AES‑256‑GCM encrypted at application level, contacts and content are not. It concludes that transfers may proceed under the SCCs with the supplementary measures described.
We will notify you without undue delay and in any event within 48 hours of becoming aware of a personal‑data breach affecting your data — deliberately inside the 72-hour window in which you must notify your supervisory authority. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken, and a contact point; where full information is not available at once we provide it in phases.
You may export your data at any time while the account is live. On termination we delete customer personal data within 30 days, in every region this deployment can reach, retaining only a tombstone recording that the deletion happened (workspace identifier, region, timestamp, reason, requester — no name, email or content). Encrypted backups containing your data persist until they rotate out under the 7 daily / 4 weekly / 12 monthly schedule, up to roughly twelve months for the oldest monthly copy; any restore triggers a re-purge. Legal hold overrides automated deletion.
We make available the information reasonably necessary to demonstrate compliance: this DPA, our security whitepaper, the sub‑processor list, current restore-verification status, and written answers to a security questionnaire. You may audit our compliance once per twelve months on 30 days' notice, and more frequently after a breach affecting your data.
This DPA lasts for the duration of the Service. Contact our Grievance Officer, Rajan Singh, at legal@ektasi.io, Ektasi Technology (OPC) Private Limited, Sandaha, Varanasi, Uttar Pradesh 221007, India; we respond within 72 hours. Governed by the laws of India, subject to the exclusive jurisdiction of the courts at Varanasi, Uttar Pradesh, India — including, for a commercial dispute of a Specified Value of ₹3,00,000 or more, the Commercial Court at Varanasi under the Commercial Courts Act, 2015, with appeals to the High Court of Judicature at Allahabad at its principal seat at Prayagraj.