1. PURPOSE
This DPA applies where Gretis processes personal data on behalf of a Customer under a Gretis Service. It supplements the Master Software and Technology Services Agreement and applicable Order/SOW.
2. ROLES
Customer determines the purposes and lawful instructions for Customer Data to the extent Customer controls processing. Gretis processes Customer Data on Customer’s documented instructions and as necessary to provide Services, maintain security, provide support, comply with law and perform the Agreement. The parties will comply with applicable data-protection law, including the Digital Personal Data Protection Act, 2023 and applicable Rules when applicable.
3. SUBJECT AND DURATION
The subject matter is hosting, storage, transmission, support, backup where ordered, integration and operation of Services. Processing continues during the Service term and limited periods thereafter as permitted by the Agreement, DPA and law.
4. CATEGORIES OF DATA
Identity/contact data; employment/HR data; payroll/financial data; attendance/time data; location data; government identifiers; documents/attachments; customer/supplier/business records; authentication/access records; dependent/nominee data including information about minors; and other personal data entered into the Customer’s ERP or connected systems.
5. DATA SUBJECTS
Employees, contractors, applicants, former employees, dependants, nominees, customers, suppliers, contacts, Portal users and other individuals whose data Customer enters into the Service.
6. CUSTOMER INSTRUCTIONS
Gretis may process Customer Data to provide/maintain Services; host/store/transmit and back up where ordered; troubleshoot/support; maintain security and prevent fraud; perform integrations and requested changes; and comply with lawful obligations. Gretis will not intentionally sell Customer Data or use it for unrelated advertising.
7. CUSTOMER RESPONSIBILITIES
Customer is responsible for lawful purposes/instructions, notices to data subjects, required consent or other authority, data accuracy, responding to data-subject requests where Customer is responsible, and lawful configuration/use.
8. PERSONNEL
Access is limited to personnel/contractors who need it for authorised purposes and are subject to confidentiality obligations.
9. SECURITY
Reasonable technical and organisational measures may include HTTPS/TLS, Docker isolation, Linux access controls, firewall/network controls, administrative access controls, monitoring/logging, Cloudflare services including Tunnel where appropriate, controlled production access and backups where ordered. Measures may evolve. No measure guarantees that an incident cannot occur.
10. SUBPROCESSORS
Gretis may use Hostinger and may use AWS or other infrastructure/providers in the future. Gretis will apply appropriate contractual/security obligations for relevant subprocessors where required. Customers may request information about material subprocessors through legal/support contacts.
11. PERSONAL DATA INCIDENTS
If Gretis becomes aware of a personal data breach affecting Customer Data, Gretis will notify Customer without undue delay and provide reasonably available information needed for Customer’s response. Parties will cooperate on containment, investigation, remediation and legally required notifications.
12. DATA SUBJECT REQUESTS
Where a request concerns Customer Data for which Customer controls the purpose, Gretis will provide reasonable assistance where technically and legally permitted. Gretis will not independently change Customer’s processing instructions unless required by law.
13. GOVERNMENT REQUESTS
Where legally required to disclose Customer Data, Gretis may disclose it to the extent required. Where legally permitted, Gretis will notify Customer and cooperate with reasonable efforts to limit disclosure.
14. DATA RETURN
Customer may retrieve Customer Data for 14 days after termination. Standard export in an ordinarily supported format is included where technically available. Custom migration, transformation, cleansing or consulting may be chargeable.
15. DELETION
After the 14-day export period, Gretis may delete Customer Data from active systems, subject to legal retention, billing/security records and backup cycles. Backup copies may remain until overwritten according to the applicable backup cycle.
16. AUDITS
Customer may request reasonable information about Gretis processing/security relevant to the Services. Audits must be proportionate, scheduled in advance and must not materially disrupt Gretis or expose other customers’ information. Independent audit costs are borne by Customer unless otherwise agreed.
17. INTERNATIONAL PROCESSING
Cloud/infrastructure providers may process data outside India depending on architecture. Gretis will apply safeguards and comply with applicable transfer requirements.
18. CHILDREN
Customer may submit information about minors as dependants/nominees or for other legitimate business processes. Customer is responsible for required consent or lawful authority. Gretis processes such data only under Customer instructions and for the agreed Service.
19. CONFIDENTIALITY
Customer Data is Confidential Information under the Master Agreement.
20. LIABILITY
DPA liability follows the Master Agreement unless a different cap is expressly agreed. Nothing limits liability that cannot lawfully be limited.
21. PRECEDENCE AND TERMINATION
For data-processing matters this DPA prevails over inconsistent Order/general documentation. It ends when Gretis no longer processes Customer Data on Customer’s behalf, subject to continuing deletion, confidentiality and legal obligations.
22. CONTACT
Gretis India Private Limited, SCO 95, Sector 3, 134109, Panchkula, Haryana, India. legal@gretisindia.com | support@gretisindia.com.