Data Processing Agreement

This agreement forms part of the agreement between you and Divyavyoma Technologies Private Limited under our Terms of Service. It applies whenever personal data is in a system we host, operate, back up, test or support for you.

Under the Digital Personal Data Protection Act, 2023 and the rules made under it, you are the Data Fiduciary and we are your Data Processor. You decide which personal data the system holds, about whom, and why; we process it only to provide the services in your quote — hosting, storage, backup, operation, support and testing — for as long as the agreement lasts, plus the deletion period below.

We process the personal data only on your documented instructions: this agreement, your quote, and the requests you make through your account contacts. We do not use it for any purpose of our own, and never for marketing, analytics or training any model.

If we believe an instruction breaks the law, we tell you and may decline to follow it. If the law requires us to process data otherwise, we tell you first unless the law forbids it.

Only the founders and named engineers on your account can access your systems, each bound by confidentiality, with access limited to what their work needs. Contractors — for example a certified penetration tester on a testing engagement — work under the same confidentiality and only within the scope you approve.

We maintain reasonable security safeguards, at least:

• Zero Trust access by default: no open administrative ports, every session authenticated.
• Hardened systems, TLS in transit, host firewalls, intrusion blocking, network isolation between clients, and DDoS protection at the edge.
• Patching and vulnerability management on managed tiers.
• Nightly backups of every managed workload, a weekly encrypted off-site copy, and a restore tested every month.
• Physical security at our site in Gujarat — founder-operated and currently residential, with UPS and three internet providers and without a generator, and access limited to the founders.

We do not currently hold ISO/IEC 27001 or SOC 2 certification, and we are not CERT-In empanelled. Where you need an empanelled audit report, we arrange it through an empanelled partner.

On Divyavyoma Infra, personal data is stored on our hardware in India. On hyperscaler-managed services it stays in the Indian cloud regions of your own account unless you instruct otherwise. Traffic may pass through Cloudflare's global network in transit. We will not transfer personal data to a country the central government has restricted.

We use these sub-processors, each under terms that protect the data at least as well as this agreement:

Cloudflare

Network edge, Zero Trust tunnels, DNS, content delivery and web application firewall — on services that use them.

Google (Google Workspace)

Email, including any personal data you send us in a message or attachment.

Amazon SES or Resend

Only if you use our managed transactional email service.

AWS, Microsoft Azure and Google Cloud are not our sub-processors on hyperscaler-managed services: your production runs in your own account, under your contract with the provider, and we operate it under the access you grant.

We give you at least 30 days' notice by email before adding or replacing a sub-processor. If you object on reasonable data-protection grounds and we cannot resolve it, you may end the affected service without penalty.

If we become aware of a breach affecting your personal data, we tell you without undue delay and in any case within 24 hours, with what we know: what happened, what data and how many people are affected, what we have done to contain it, and who to talk to. We keep you updated as we learn more.

You decide on and make the notifications to the Data Protection Board and to the people affected; we give you the information and help you need to do so on time. We do not contact them ourselves unless you instruct us to or the law requires it.

We help you respond to requests from the people whose data you hold — access, correction, erasure — when the data is in a system we operate, and tell you promptly if one reaches us directly instead of answering it ourselves. We also help, with information within our knowledge, with your security assessments and audits.

On request we give you the information reasonably needed to show that we meet this agreement, including summaries of our security testing. You, or an auditor bound by confidentiality, may audit our compliance once a year, with 30 days' notice, in working hours and at your cost, or at any time after a breach.

When the agreement ends, you can export your data in standard formats, free, within days. We keep it for 30 days so you can, then delete it, and backup copies age out within the following 30 days. We confirm deletion in writing on request. Where the law requires us to keep any of it longer, we keep only that, protect it under this agreement, and delete it when the requirement ends.

Liability under this agreement is governed by our Terms of Service. If this agreement and the Terms disagree about personal data, this agreement wins.

Divyavyoma Technologies Private Limited (CIN U63111GJ2026PTC184103), registered office: Block-A, 606 Prahladnagar, Trade Center, BH Titanium, Jivraj Park, Ahmadabad City, Ahmedabad 380051, Gujarat.

Enquiries, quotes and billing

enquiry@divyavyoma.com

Grievance Officer

Ashokbhai Solanki, grievance@divyavyoma.com

Working hours

Monday to Saturday, 09:00–19:00 IST