Data Processing Addendum

2.1. Roles of the Parties

The parties acknowledge and agree that with regard to the Processing of Personal Data, the Customer is the Controller and Codezep is the Processor.

2.2. Customer’s Instructions

Codezep shall process Personal Data only on the documented instructions of the Customer (which include the Principal Agreement and this DPA), unless required to do so by applicable law.

2.3. Compliance with Laws

• •
  Customer Warranty: The Customer warrants that it has a valid legal basis (e.g., consent) to process the Personal Data and to authorize Codezep to process it.
• •
  Codezep Warranty: Codezep warrants that it will process Personal Data in compliance with Data Protection Laws and will not use the data for its own purposes (marketing, etc.) without express consent.

3.1. Personnel

Codezep shall ensure that its personnel engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data, have received appropriate training on their responsibilities, and have executed written confidentiality agreements.

4.1. Technical and Organizational Measures

Codezep shall implement and maintain appropriate technical and organizational security measures to protect Personal Data from Security Incidents and to preserve the security and confidentiality of the Personal Data, in accordance with Schedule B attached hereto.

4.2. Updates to Security

Codezep may update or modify these security measures from time to time, provided that such updates and modifications do not result in the degradation of the overall security of the Services.

5.1. Authorization

The Customer grants Codezep a general authorization to engage Sub-processors (e.g., AWS, Stripe, etc.) to provide the Services. A current list of Sub-processors is available in Schedule C.

5.2. Liability

Codezep shall be liable for the acts and omissions of its Sub-processors to the same extent Codezep would be liable if performing the services of each Sub-processor directly under the terms of this DPA.

5.3. Objection

Codezep will provide notice of any new Sub-processor. If the Customer has a reasonable objection to a new Sub-processor on data protection grounds, the parties will negotiate in good faith to find a solution.

6.1. Assistance

Taking into account the nature of the Processing, Codezep shall assist the Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Customer’s obligation to respond to requests for exercising the Data Subject’s rights (e.g., access, rectification, erasure).

6.2. Direct Requests

If Codezep receives a request directly from a Data Subject, it will promptly notify the Customer and will not respond to that request except as required by law or strictly to direct the Data Subject to the Customer.

7.1. Notification

Codezep shall notify the Customer without undue delay (and in any event within 72 hours) after becoming aware of a confirmed Security Incident involving Customer Personal Data.

7.2. Content of Notification

The notification shall describe the nature of the breach, the categories of data involved, and the measures taken or proposed to be taken to address the breach.

8.1. End of Provision of Services

Upon termination or expiration of the Principal Agreement, Codezep shall (at the Customer's election) delete or return all Personal Data to the Customer, unless applicable law requires storage of the Personal Data.

8.2. Certification

Upon request, Codezep shall provide written certification to the Customer that it has fully complied with this section.

9.1. Reports

Upon request, Codezep shall supply the Customer with information reasonably necessary to demonstrate compliance with this DPA, including recognized security certifications (e.g., ISO 27001 or SOC 2 reports if available).

9.2. Inspections

If standard reports are insufficient, the Customer may conduct an audit of Codezep’s data processing practices, subject to:

• •
  Giving at least 30 days' written notice.
• •
  Conducting the audit during normal business hours.
• •
  Signing a strict confidentiality agreement.
• •
  Bearing all costs associated with the audit.

10.1. Transfer Mechanism

If Personal Data originates from India or the EEA and is transferred to a country not recognized as providing an adequate level of protection, the parties agree to rely on Standard Contractual Clauses (SCCs) or Government-approved transfer mechanisms as the legal basis for such transfer.

11.1. Governing Law

This DPA shall be governed by and construed in accordance with the governing law and jurisdiction provisions in the Principal Agreement (Laws of India; Courts of Ernakulam, Kerala).

11.2. Conflict

In the event of a conflict between this DPA and the Principal Agreement, the terms of this DPA shall prevail with respect to the subject matter of data processing.