Data Processing Agreement

This Data Processing Agreement ("DPA") is between the company that has signed up for ECN People (the "Customer") and Easy Connect Private Limited, a company incorporated in India and based in Jaipur, Rajasthan, India ("Easy Connect", "we"). It forms part of the Terms of Service and applies whenever we process personal data on the Customer's behalf while providing ECN People.

Where this DPA and the Terms of Service disagree about personal data, this DPA wins.

• "DPDP Act" means the Digital Personal Data Protection Act, 2023 and the rules made under it, as amended from time to time.
• "Customer Personal Data" means personal data that the Customer, its users or its employees enter into or upload to the service, or that the service generates about them (for example attendance punches, payslips, leave records, candidate profiles, leads and contacts).
• "Data Fiduciary", "Data Processor", "Data Principal" and "personal data breach" have the meanings given in the DPDP Act.
• "Sub-processor" means a third party we engage to process Customer Personal Data as part of providing the service.

For Customer Personal Data, the Customer is the Data Fiduciary: it decides why the data is collected and how it is used. Easy Connect is the Data Processor: it processes the data only to provide ECN People and only on the Customer's documented instructions. This DPA is the contract between a Data Fiduciary and a Data Processor contemplated by section 8(2) of the DPDP Act.

The Customer is responsible for having a lawful basis for the data it puts into the service — for example, giving its employees the notice required by section 5 of the DPDP Act and obtaining consent where consent is the basis — and for the accuracy of that data.

We will:

1. Process Customer Personal Data only on the Customer's documented instructions — the Terms, this DPA and the Customer's use and configuration of the service are those instructions — unless Indian law requires otherwise, in which case we will tell the Customer first unless the law forbids it.
2. Not sell Customer Personal Data, use it to advertise, or use it to train models offered to anyone else.
3. Ensure that our staff and contractors who can access Customer Personal Data are bound by confidentiality and see only what their role requires.
4. Apply the security safeguards described in section 6 and our Security page, which are intended to meet section 8(5) of the DPDP Act and the reasonable security practices required under section 43A of the Information Technology Act, 2000.
5. Help the Customer, through the product's own tools or on request, to respond to Data Principals exercising their rights to access, correction, erasure and grievance redressal under sections 11 to 13 of the DPDP Act.
6. Tell the Customer promptly if we believe an instruction breaks the DPDP Act or other Indian law.

• Encryption in transit (TLS 1.2 or later) and at rest for databases, file storage and backups.
• Each customer's data is logically separated by company; every query is scoped to the signed-in company.
• Role-based access inside the product and an audit log of administrative actions the Customer can read.
• Production access for our staff limited to named engineers, protected by multi-factor authentication and logged.
• Regular database backups, with restores tested in drills.

The Customer authorises us to use the sub-processors below. Each is bound by written terms that protect Customer Personal Data at least as well as this DPA. We remain responsible for their performance.

We will give administrators at least 30 days' notice by email before adding or replacing a sub-processor. If the Customer objects on reasonable data-protection grounds, it may end the affected subscription and receive a pro-rata refund of prepaid fees for the unused period.

Some sub-processors in section 7 store or process Customer Personal Data outside India; their locations are shown there. Data is encrypted in transit. We will not transfer it to a country or territory that the Central Government has restricted under section 16 of the DPDP Act. If the Central Government notifies such a restriction, we will move or stop the affected processing.

If we become aware of a personal data breach affecting Customer Personal Data, we will notify the Customer's administrators without undue delay and in any case within 24 hours, with what we then know: the nature of the breach, the categories and approximate number of Data Principals affected, the likely consequences and the steps taken. We will update the Customer as we learn more and co-operate so that it can meet its own obligations to inform the Data Protection Board of India and affected Data Principals, and CERT-In where the CERT-In Directions of 28 April 2022 apply.

During the subscription the Customer can export its data from the product at any time. When the subscription ends, the workspace is kept read-only for 90 days so the Customer can export its data or reactivate. After that we delete Customer Personal Data from live systems, and from backups within a further 35 days, as the Terms of Service describe, unless Indian law (for example tax or labour record-keeping) requires us to keep a part of it — in which case we keep only that part, only for as long as required.

On written request, no more than once a year, we will answer a reasonable security questionnaire and provide the information the Customer needs to show compliance with the DPDP Act. On-site audits, where required by a regulator, will be arranged with reasonable notice, at the Customer's cost, and subject to confidentiality. Write to info@easyconnectnetwork.com.

Each party's liability under this DPA is subject to the limitations in the Terms of Service. This DPA lasts as long as we process Customer Personal Data. It is governed by the laws of India, and the courts at Jaipur, Rajasthan have exclusive jurisdiction, subject to any dispute-resolution clause in the Terms.