Data Processing Agreement

Parties & Scope

This DPA is entered into between:

• Data Fiduciary / Controller: The Customer — the business entity or sole proprietor who has accepted the Servyn AI Terms of Service ("Customer")
• Data Processor: Servyn AI, a sole proprietorship owned and operated by Rahul Birwadkar, 4A B.D.D. Chawl, Naigaon, Dadar, Mumbai – 400014 ("Servyn AI")

This DPA applies to all personal data processed by Servyn AI on behalf of the Customer through the Servyn AI ERP platform (web application, PWA, and Android APK).

Definitions

Terms used in this DPA have the meaning given in the Servyn AI Privacy Policy and Terms of Service, and in the Digital Personal Data Protection Act, 2023 (DPDPA 2023). Key terms:

• "Personal Data" — any data about an identifiable individual entered into or generated through the Platform by or on behalf of the Customer
• "Processing" — any operation performed on Personal Data including collection, storage, use, disclosure, and deletion
• "Data Principal" — the individual to whom the Personal Data relates (e.g., the Customer's employees and customers)
• "Sub-Processor" — any third party engaged by Servyn AI to process Personal Data on behalf of the Customer
• "Data Breach" — any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data

Role of Each Party

Nature & Purpose of Processing

Servyn AI will not process Personal Data for any purpose other than those stated above or as documented in writing by the Customer.

Processor Obligations

Servyn AI agrees to:

1. Instructions only: Process Personal Data only on the documented instructions of the Customer, and not for Servyn AI's own purposes
2. Confidentiality: Ensure that all personnel with access to Personal Data are bound by written confidentiality obligations
3. No unauthorised disclosure: Not disclose Personal Data to any third party except authorised Sub-Processors or as required by Indian law
4. No data selling: Never sell, rent, trade, or otherwise commercialise Personal Data
5. No AI training: Never use Customer Personal Data to train, fine-tune, or improve AI or machine learning models
6. Purpose limitation: Use Personal Data only for the purposes described in Section 4
7. Legal requests: Notify the Customer promptly (to the extent permitted by law) before complying with any government, law enforcement, or court order requiring disclosure of Personal Data
8. Compliance assistance: Provide reasonable assistance to the Customer in complying with DPDPA 2023 obligations, including responding to Data Principal rights requests

Security Measures

Servyn AI implements and maintains the following technical and organisational security measures as required under DPDPA 2023 S.8(5) and SPDI Rules 2011 Rule 8:

Technical Measures

• AES-256 encryption of all data at rest in the Supabase database
• TLS 1.2+ encryption for all data in transit (HTTPS enforced)
• Field-level encryption for Aadhaar numbers, PAN numbers, and bank account details
• bcrypt password hashing — passwords never stored in plain text
• JWT-based session management with httpOnly cookies
• Row Level Security (RLS) policies for multi-tenant data isolation
• CSRF protection on all state-changing API requests
• Role-based access control (RBAC) limiting data access by user role
• 30-day rolling automated database backups
• 90-day audit log retention

Organisational Measures

• Production database access restricted to Servyn AI founding personnel only
• Regular review of access controls and security configurations
• Incident response procedure (see Breach Notification Policy)

Servyn AI will maintain these measures throughout the term of this DPA and will notify the Customer of any material downgrade in security measures with at least 30 days' advance notice.

Sub-Processors

The Customer grants Servyn AI general authorisation to engage the following Sub-Processors:

Servyn AI will:

• Notify the Customer at least 14 days before engaging any new Sub-Processor that will process Customer Personal Data
• Give the Customer the opportunity to object to the new Sub-Processor within that 14-day period
• Impose data protection obligations on all Sub-Processors equivalent to those in this DPA
• Remain liable to the Customer for the acts and omissions of its Sub-Processors

Data Breach Notification

In the event of a Data Breach affecting Customer Personal Data, Servyn AI will:

1. Notify the Customer's registered admin email within 24 hours of becoming aware of the breach
2. Provide the following information (to the extent available at the time):
   • Nature of the breach and categories/approximate number of Data Principals affected
   • Categories and approximate volume of Personal Data records affected
   • Likely consequences of the breach
   • Measures taken or proposed to address the breach
   • Contact details of the Grievance Officer
3. Notify the Data Protection Board of India (DPBI) within 72 hours as required by DPDPA 2023 S.8(6) (once DPBI is operational)
4. Cooperate with the Customer in notifying affected Data Principals if required by the DPBI
5. Take all reasonable steps to contain and remediate the breach

Servyn AI maintains a separate Breach Notification Policy with detailed procedures.

Data Principal Rights Assistance

Servyn AI will provide reasonable assistance to the Customer in responding to Data Principal rights requests under DPDPA 2023 Chapter III, including:

• Rights to access, correction, and erasure of Personal Data
• Right to grievance redressal
• Right to nominate

If Servyn AI receives a rights request directly from a Data Principal relating to Customer-controlled data, Servyn AI will forward the request to the Customer within 3 business days and will not independently respond to the request without the Customer's authorisation.

Audit Rights

The Customer has the right to audit Servyn AI's compliance with this DPA by:

• Requesting a written summary of security practices and data processing activities (to be provided within 15 business days)
• Requesting access to relevant audit logs relating to the Customer's data (subject to confidentiality of other customers' data)
• Conducting an on-site or remote audit with at least 30 days' advance notice, at the Customer's own cost, no more than once per 12-month period

Audit requests must be sent to founder@servynai.in with the subject "DPA Audit Request".

Return & Deletion of Data

Upon termination or expiry of the Customer's subscription:

1. The Customer has a 30-day window to request a full data export in CSV/JSON format
2. On Day 31 post-termination, Servyn AI will permanently delete all Customer Personal Data from active databases and backups
3. Servyn AI will provide a written deletion confirmation upon request
4. Exception — Legal Hold: Financial records (invoices, payment records, GST data) may be retained for up to 7 years as required by Indian tax and company law (Income Tax Act 1961, CGST Act 2017, Companies Act 2013). Such records will be stored in an isolated, access-restricted archive and used solely for legal compliance

Cross-Border Transfer

Customer Personal Data is stored on AWS ap-south-1 (Mumbai, India) via Supabase. No cross-border transfer of ERP data occurs.

Limited cross-border transfers may occur for: support email communications (Google/Gmail infrastructure) and WhatsApp communications (Meta global infrastructure). These are governed by the respective providers' Data Processing Terms and Standard Contractual Clauses where applicable.

Servyn AI will comply with any cross-border transfer restrictions notified by the Government of India under DPDPA 2023 S.16 and will inform the Customer if any such restriction affects this DPA.

Duration

This DPA commences on the date the Customer accepts the Servyn AI Terms of Service and continues until the later of:

• Termination or expiry of the Customer's subscription; or
• The date on which Servyn AI has completed deletion of all Customer Personal Data as required under Section 11

Obligations under Sections 5, 6, 8, 11, and 14 survive termination of this DPA.

Liability

Each party's liability under this DPA is subject to the limitation of liability provisions in the Servyn AI Terms of Service (Section 18).

Servyn AI is liable for damages caused by processing that is not in compliance with this DPA or DPDPA 2023 where it has acted outside or contrary to the Customer's lawful instructions.

The Customer is liable for damages arising from processing instructions that are unlawful or that violate the Customer's own obligations as a Data Fiduciary under DPDPA 2023.

Governing Law

This DPA is governed by the laws of the Republic of India. Disputes under this DPA are subject to the dispute resolution and arbitration provisions in the Servyn AI Terms of Service (Section 23).