This Data Processing Agreement (“DPA”) outlines the legally binding terms between Dusty Dooms, referred to as the “Data Processor,” and the entity accepting these terms, referred to as the “Data Controller.” This Agreement governs how the Processor handles Personal Data in connection with the services provided.
Roles and Obligations
Data Controller:
- Determines the purpose and lawful basis for processing Personal Data.
- Ensures all processing actions comply with applicable Data Protection Regulations.
Data Processor:
- Processes Personal Data strictly according to the Controller’s documented directions.
- Utilizes Personal Data solely for delivering the services as instructed.
Scope of Processing
The Processor shall process Personal Data strictly for the following objectives:
- Initiating, authorizing, and completing payment transactions.
- Conducting KYC verification and preventing fraudulent activities.
- Authenticating customers through two-factor authentication (2FA) or similar methods.
- Preparing transaction summaries and reconciliation reports.
Security and Data Protection
The Processor is committed to maintaining appropriate technical and organizational safeguards, including:
- Encryption of Personal Data both during storage and transmission.
- Enforcing multi-factor authentication for system-level access.
- Employing secure cryptographic key management protocols.
- Conducting periodic penetration testing and vulnerability assessments.
Additionally, the Processor shall:
- Impose strict confidentiality obligations on all personnel with data access.
- Conduct regular staff training on data protection and security measures.
Data Subject Rights Assistance
The Processor will support the Controller in fulfilling Data Subject rights as mandated by applicable laws, including:
- Right to access Personal Data
- Right to rectification
- Right to erasure (“Right to be forgotten”)
- Right to data portability
- Right to restrict or object to processing
Subprocessors
- The Processor will not appoint any Subprocessor without obtaining prior written approval from the Controller.
- Each approved Subprocessor must enter into a written agreement ensuring data protection standards equivalent to those outlined in this DPA.
Data Breach Notification
In the event of a Personal Data breach, the Processor shall notify the Controller within 24 hours of discovery and include the following information:
- The nature and details of the breach
- Categories and estimated number of affected Data Subjects
- Measures taken to contain and minimize impact
- Corrective actions and preventive measures planned to avoid future incidents
Audit and Compliance Rights
- The Controller may carry out audits or inspections with reasonable prior notice to confirm compliance with this DPA.
- The Processor shall provide access to all relevant documentation, and policies.
Data Retention and Deletion
- Personal Data shall be stored only for as long as necessary to complete payment processing and comply with applicable legal requirements.
- Once services are terminated, the Processor will either securely erase or return all Personal Data unless retention is required by law.
Regulatory and Legal Compliance Updates
The Processor must promptly notify the Controller of any legal, regulatory, or industry changes that could affect the ability to lawfully process Personal Data under this DPA.
Liability and Indemnity
- Each Party shall be liable for any damages caused by its own breach of this Agreement.
- The Processor agrees to indemnify and hold the Controller harmless against penalties, claims, or losses resulting from failure to comply with data protection responsibilities.
Governing Law and Jurisdiction
- This DPA is governed by the laws of India.
- Any disputes arising from or related to this Agreement shall be subject to the exclusive jurisdiction of Indian courts.
Amendments
Any alterations to this Agreement must be made in writing and duly signed by both the Controller and the Processor.
Acknowledgment
By entering into this DPA, both Parties acknowledge that they have thoroughly read, understood, and agreed to all terms and conditions outlined herein.
