Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Truestock Private Limited (“Processor”) and the Customer (“Fiduciary”). It applies to personal data of End Users that the Customer sends to the Services (“Customer Personal Data”).

For Customer Personal Data the Customer is the Data Fiduciary and TrueEngage is the Data Processor, as those terms are used in the Digital Personal Data Protection Act, 2023 (“DPDP Act”). Where the Customer is itself processing on behalf of another fiduciary, TrueEngage acts as its sub-processor on the same terms.

The Customer will not send data that it is not permitted to share, and will not send children’s data unless it has obtained verifiable parental consent as the DPDP Act requires.

TrueEngage processes Customer Personal Data only on the Customer’s documented instructions. The Terms, this DPA and the Customer’s configuration of the Services (segments, campaigns, flows, retention settings and API calls) are the Customer’s complete instructions.

If TrueEngage believes an instruction breaks Indian law, it will tell the Customer and may decline to follow it. If the law requires processing the Customer has not instructed, TrueEngage will tell the Customer first unless the law prohibits it.

Access to Customer Personal Data is limited to personnel who need it to operate or support the Services, who are bound by written confidentiality obligations, and who are trained in data protection. Support access to a workspace is logged.

TrueEngage maintains reasonable security safeguards to prevent personal data breaches, as required by section 8(5) of the DPDP Act and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. The current measures are described on the Security page. TrueEngage may update them, provided the overall level of protection does not decrease.

The Customer authorises TrueEngage to engage the sub-processors listed on the Sub-processors page. TrueEngage binds each sub-processor to data protection obligations no less protective than this DPA and remains responsible for its performance.

TrueEngage will give at least 30 days’ notice before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may terminate the affected Services and receive a pro-rata refund of prepaid fees.

Channel Providers that the Customer selects and connects with its own credentials are engaged by the Customer, not by TrueEngage, and are not sub-processors under this DPA.

The Services let the Customer look up, correct, export and erase an End User’s profile and events, and record unsubscribes and channel preferences. If TrueEngage receives a request directly from an End User, it will pass the request to the Customer without undue delay and will not respond itself except to redirect the requester. TrueEngage will give reasonable help where the Customer cannot fulfil a request through the console or API.

TrueEngage will notify the Customer without undue delay, and in any case within 24 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe the nature of the breach, the data and Data Principals likely affected, likely consequences, and the steps taken or proposed.

TrueEngage will give the Customer the information it reasonably needs to inform the Data Protection Board of India and affected Data Principals, and will report the underlying cyber incident to CERT-In where its directions require. TrueEngage will not notify the Customer’s End Users directly unless the Customer asks or the law requires it.

During the term, the Customer can export and delete data through the console and API. When the subscription ends, the Customer has 30 days to export its data. TrueEngage then deletes Customer Personal Data from production systems within the following 30 days and from backups as they expire, within 90 days, unless Indian law requires longer retention. On request, TrueEngage will confirm deletion in writing.

TrueEngage will make available the information reasonably needed to show compliance with this DPA, including answers to security questionnaires and summaries of independent assessments when available. Not more than once a year, and on 30 days’ notice, the Customer may audit compliance at its own cost, by an independent auditor bound by confidentiality, during business hours and without disrupting the Services or exposing other customers’ data.

Customer Personal Data is stored in the selected region. TrueEngage will not transfer it to any country or territory that the Central Government restricts under section 16 of the DPDP Act. Where the Customer is subject to foreign data protection law, the parties will agree any additional transfer terms in writing.

If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails. Limitations of liability in the Terms apply to this DPA.