Data processing agreement

1. Definitions and scope

1.1 Terms such as controller, processor, data subject, personal data breach and processing have the meaning in the GDPR / UK GDPR. "Data Protection Law" means all laws that apply to the processing, including the Digital Personal Data Protection Act, 2023 and Rules 2025 (DPDP) and the IT Act 2000 / SPDI Rules 2011 (India), GDPR, UK GDPR and Data Protection Act 2018, Swiss FADP, US state privacy laws (including CCPA / CPRA), UAE PDPL, DIFC DP Law 2020, ADGM DPR 2021, Saudi PDPL, Brazil LGPD, Singapore PDPA, Australia Privacy Act and Canada PIPEDA. "Client Personal Data" means personal data in Client Data.

1.2 Roles: the Client is controller / data fiduciary / business; Origin Pixel is processor / data processor / service provider. Where the Client is itself a processor for its own customer, Origin Pixel is a sub-processor and the Client confirms its instructions are authorised by that controller (EU SCC Module 3).

2. Instructions (GDPR Art. 28(3)(a); DPDP s.8(2))

Origin Pixel processes Client Personal Data only on the Client's documented instructions: this DPA, the Terms, the Client's settings and actions in the platform, and written requests from an authorised admin, including for transfers outside India. Origin Pixel tells the Client promptly if an instruction appears to infringe Data Protection Law, and may suspend that processing until it is confirmed or changed. If the law requires processing without an instruction, Origin Pixel informs the Client first unless the law forbids it.

3. Confidentiality and personnel (Art. 28(3)(b))

Everyone authorised to process Client Personal Data is bound by confidentiality, trained on data protection and secure handling, and gets only the access their role needs. Origin Pixel staff can read client content only through an audited, time-limited support session opened for a ticket, except automated processing and emergencies (logged).

4. Security (Art. 28(3)(c), Art. 32; DPDP s.8(5))

Origin Pixel implements the technical and organisational measures in Annex II and keeps them at least at that level during the term. The Client is responsible for the settings it controls (user access, consent text, retention, recording, India-only processing).

5. Sub-processors (Art. 28(2), 28(4))

5.1 The Client gives general written authorisation for the sub-processors on the Subprocessors page (Annex III). Services the Client connects with its own account are the Client's processors, not Origin Pixel's.

5.2 Origin Pixel gives at least 30 days' notice before adding or replacing a sub-processor, by email to the Client's main login, in the app and on the Subprocessors page (anyone can subscribe to these emails). The Client may object on reasonable data protection grounds before the change takes effect, using the objection button in the app or by email. The parties then discuss in good faith; Origin Pixel may offer to avoid the sub-processor for the Client. If no solution is found, the Client may terminate the affected service and receive a pro-rata refund of prepaid fees. In an emergency (for example a provider outage putting the service at risk) a replacement may start sooner; the notice then explains why and the objection right still applies.

5.3 Origin Pixel imposes data protection obligations on each sub-processor that are no less protective than this DPA (including transfer safeguards and, for AI providers, no use of Client Personal Data for model training) and remains fully liable for their performance.

6. Assistance (Art. 28(3)(e), (f))

• Data subject requests: the platform provides tools to find, export, correct, restrict and erase data and to record consent and grievances; Origin Pixel forwards requests it receives to the Client without undue delay and helps with requests the tools cannot handle.
• DPIAs and consultations: Origin Pixel provides the information it holds (DPIA templates for voice agents, KYC documents, lead scoring and prospecting; system descriptions; this DPA) for the Client's impact assessments and prior consultations.
• Security and breach duties: as in sections 4 and 7.

7. Personal data breaches (Art. 33(2); DPDP s.8(6); CERT-In)

Origin Pixel notifies the Client without undue delay and in any case within [24] hours after becoming aware of a personal data breach affecting Client Personal Data, with what is known: nature, categories and approximate numbers of people and records, likely consequences, measures taken or proposed, and a contact. Information that is not yet available follows in stages. Origin Pixel reports to CERT-In within 6 hours where the Directions of 28 April 2022 require it, and helps the Client meet its own duties to the Data Protection Board of India, supervisory authorities and affected people (including a bulk notice tool). Notice of a breach is not an admission of fault.

8. Return and deletion (Art. 28(3)(g); DPDP s.8(7))

At the end of the service the Client can export its data for [30] days. Origin Pixel then deletes Client Personal Data within [30] days, and from backups as they roll over (about 8 weeks), unless the law requires retention (then it stays protected and is used only for that purpose). Deletions are re-applied if a backup is ever restored. On request Origin Pixel confirms deletion in writing.

9. Audits (Art. 28(3)(h))

Origin Pixel makes available the information needed to demonstrate compliance: this DPA, the Security overview, answers to a reasonable security questionnaire once a year, and third-party reports or certifications when held [none today]. If that is not enough, or after a breach, or if a regulator requires, the Client (or an independent auditor bound by confidentiality) may audit on 30 days' notice, during business hours, at the Client's cost, without access to other clients' data.

10. International transfers

10.1 Client Personal Data is stored in India. Origin Pixel and its sub-processors may process it in the countries listed on the Subprocessors page. India-only processing can be selected per business.

10.2 India: no transfer to a country restricted by the Central Government under DPDP s.16.

10.3 EU / EEA: India has no adequacy decision. For transfers from the Client to Origin Pixel the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated by reference: Module 2 (controller to processor) where the Client is a controller, and Module 3 (processor to processor) where the Client is a processor, with the selections in Annex IV. Origin Pixel puts equivalent clauses in place with sub-processors outside the EEA and adequate countries.

10.4 United Kingdom: the UK International Data Transfer Addendum (version B1.0, issued under s.119A DPA 2018) is incorporated, completed as in Annex IV. Switzerland: the SCCs apply with the FADP amendments in Annex IV.

10.5 UAE free zones, Brazil, Saudi Arabia: the DIFC Standard Contractual Clauses, the ADGM Standard Contractual Clauses, the ANPD standard contractual clauses (Resolution CD/ANPD 19/2024) and the SDAIA standard contractual clauses apply as in Annex IV where those laws govern the transfer.

10.6 Origin Pixel keeps a transfer impact assessment for India and for its main US sub-processors and will help the Client with its own. Origin Pixel challenges overbroad government access requests, tells the Client about them where allowed, and discloses only the minimum required.

11. US state privacy law terms (CCPA § 7051 and equivalent)

For personal information subject to US state privacy laws, Origin Pixel is a service provider / processor and: (a) processes it only for the business purposes in Annex I and as allowed by law; (b) does not sell or share it (including for cross-context behavioural advertising); (c) does not retain, use or disclose it outside the direct business relationship or for any other commercial purpose; (d) does not combine it with personal information from other sources except as the law permits for service providers; (e) complies with the law and provides the same level of protection, and notifies the Client if it can no longer meet its obligations; (f) allows the Client to take reasonable steps to stop and remediate unauthorised use; (g) passes these terms to its sub-processors; and (h) certifies that it understands and will comply with these restrictions. The parties' duties under the Virginia, Colorado, Connecticut, Texas and similar laws (instructions, confidentiality, deletion, assessments, sub-processor contracts) are met by sections 2 to 9.

12. DPDP Act terms

Origin Pixel acts as a Data Processor engaged under a valid contract (s.8(2)); follows the Client's instructions; keeps reasonable security safeguards including encryption, access control, logging and keeping logs for at least one year (Rule 6); supports the Client's notices (Rule 3), consent records and Consent Manager integrations (s.6, Rule 4); helps answer data principal rights within the period in the Rules (including nomination); erases data when the Client instructs or the purpose is served (s.8(7), Rule 8 and the Third Schedule), including the 48-hour pre-erasure notice where it applies; and notifies breaches as in section 7. For children's data the Client is responsible for verifiable parental consent (s.9, Rule 10) and the platform provides the controls described in the Children's data policy.

13. Liability and precedence

Each party's liability under this DPA is subject to the limits in the Terms [counsel: data protection super-cap], except where the law or the SCCs do not allow a limit (for example liability towards data subjects under SCC Clause 12). If this DPA conflicts with the Terms, this DPA prevails for personal data; the SCCs and the other transfer clauses prevail over both.

Annex I. Description of processing

Annex II. Technical and organisational measures

• Access control: row-level security on every table (tenant isolation), roles and permissions per login, seat limits, SSO / SAML and two-step verification options, password minimum length 12 with breached-password check, session revocation, audited time-limited support access for Origin staff.
• Encryption: TLS 1.2+ in transit; encryption at rest by the database provider; AES-256-GCM field encryption for connector secrets, OAuth tokens and sensitive fields with per-organisation keys and rotation; hashed tokens; encrypted backups.
• Minimisation: masking of phone numbers and Aadhaar, IP truncation in product tables, AI prompts limited to the data needed, provider no-training settings.
• Logging and monitoring: append-only hash-chained audit log, structured logs with request ids kept 365 days in India, alerts, uptime monitoring, NTP time sync to NIC / NPL sources.
• Resilience: nightly encrypted backups (14 daily, 8 weekly), weekly restore verification, disaster recovery runbook, circuit breakers and provider failover.
• Secure development: OWASP ASVS L2 controls, dependency review, automated tests including security and RLS matrices, input validation, CSRF protection, rate limits, SSRF-safe outbound requests, signed webhooks.
• Incident response: documented process with 6-hour CERT-In and 24-hour client notification targets.
• Vendor management: sub-processor register with DPAs, transfer safeguards and 30-day change notice.
• People: confidentiality undertakings, least privilege, training, offboarding checklist.

Annex III. Sub-processors

The current list is on the Subprocessors page and forms part of this DPA.

Annex IV. Transfer clause selections

Switzerland: references to the GDPR are read as references to the FADP; the Swiss FDPIC is a competent authority for Swiss transfers; "Member State" includes Switzerland so Swiss data subjects can enforce their rights in Switzerland.

DIFC / ADGM: the DIFC Standard Contractual Clauses (controller-to-processor / processor-to-processor as applicable) and the ADGM Standard Contractual Clauses are incorporated with the details of Annex I and II, governed by DIFC / ADGM law respectively. [Counsel: confirm current versions.]

Brazil: the ANPD standard contractual clauses (Resolution CD/ANPD 19/2024, Annex II) are incorporated in full and without change for transfers subject to the LGPD; Section III information = Annex I and II.

Saudi Arabia: the SDAIA standard contractual clauses for transfers outside the Kingdom apply to transfers subject to the PDPL. [Counsel: attach the current model.]

Contact

Questions about this DPA: Hari Prathish, Origin Pixel Solutions, Chennai, Tamil Nadu, India, hariprathish@originpixel.in. A countersigned copy is available on request.