--- title: "Data Processing Agreement — Divyavyoma" description: "The agreement that governs our processing of personal data on your behalf: roles, instructions, sub-processors, security measures, breach notification and deletion on exit." url: "https://divyavyoma.com/legal/dpa" --- Legal # Data Processing Agreement When we host or operate systems that hold personal data, you decide what happens to that data and we act only on your instructions. This agreement sets out how. Effective 25 October 2026 1. [Roles and scope](https://divyavyoma.com/legal/dpa#roles) 2. [Your instructions](https://divyavyoma.com/legal/dpa#instructions) 3. [Our people](https://divyavyoma.com/legal/dpa#people) 4. [Security measures](https://divyavyoma.com/legal/dpa#security) 5. [Where the data is processed](https://divyavyoma.com/legal/dpa#location) 6. [Sub-processors](https://divyavyoma.com/legal/dpa#sub-processors) 7. [Personal data breaches](https://divyavyoma.com/legal/dpa#breach) 8. [Helping you meet your obligations](https://divyavyoma.com/legal/dpa#assistance) 9. [Information and audits](https://divyavyoma.com/legal/dpa#audit) 10. [Return and deletion](https://divyavyoma.com/legal/dpa#deletion) 11. [Liability and precedence](https://divyavyoma.com/legal/dpa#general) 12. [Contact and grievances](https://divyavyoma.com/legal/dpa#contact) ## Roles and scope This agreement forms part of the agreement between you and Divyavyoma Technologies Private Limited under our [Terms of Service](https://divyavyoma.com/legal/terms). It applies whenever personal data is in a system we host, operate, back up, test or support for you. Under the Digital Personal Data Protection Act, 2023 and the rules made under it, you are the **Data Fiduciary** and we are your **Data Processor**. You decide which personal data the system holds, about whom, and why; we process it only to provide the services in your quote — hosting, storage, backup, operation, support and testing — for as long as the agreement lasts, plus the deletion period below. ## Your instructions We process the personal data only on your documented instructions: this agreement, your quote, and the requests you make through your account contacts. We do not use it for any purpose of our own, and never for marketing, analytics or training any model. If we believe an instruction breaks the law, we tell you and may decline to follow it. If the law requires us to process data otherwise, we tell you first unless the law forbids it. ## Our people Only the founders and named engineers on your account can access your systems, each bound by confidentiality, with access limited to what their work needs. Contractors — for example a certified penetration tester on a testing engagement — work under the same confidentiality and only within the scope you approve. ## Security measures We maintain reasonable security safeguards, at least: - Zero Trust access by default: no open administrative ports, every session authenticated. - Hardened systems, TLS in transit, host firewalls, intrusion blocking, network isolation between clients, and DDoS protection at the edge. - Patching and vulnerability management on managed tiers. - Nightly backups of every managed workload, a weekly encrypted off-site copy, and a restore tested every month. - Physical security at our site in Gujarat — founder-operated and currently residential, with UPS and three internet providers and without a generator, and access limited to the founders. We do not currently hold ISO/IEC 27001 or SOC 2 certification, and we are not CERT-In empanelled. Where you need an empanelled audit report, we arrange it through an empanelled partner. ## Where the data is processed On Divyavyoma Infra, personal data is stored on our hardware in India. On hyperscaler-managed services it stays in the Indian cloud regions of your own account unless you instruct otherwise. Traffic may pass through Cloudflare's global network in transit. We will not transfer personal data to a country the central government has restricted. ## Sub-processors We use these sub-processors, each under terms that protect the data at least as well as this agreement: **Cloudflare**: Network edge, Zero Trust tunnels, DNS, content delivery and web application firewall — on services that use them. **Google (Google Workspace)**: Email, including any personal data you send us in a message or attachment. **Amazon SES or Resend**: Only if you use our managed transactional email service. AWS, Microsoft Azure and Google Cloud are not our sub-processors on hyperscaler-managed services: your production runs in your own account, under your contract with the provider, and we operate it under the access you grant. We give you at least 30 days' notice by email before adding or replacing a sub-processor. If you object on reasonable data-protection grounds and we cannot resolve it, you may end the affected service without penalty. ## Personal data breaches If we become aware of a breach affecting your personal data, we tell you without undue delay and in any case within 24 hours, with what we know: what happened, what data and how many people are affected, what we have done to contain it, and who to talk to. We keep you updated as we learn more. You decide on and make the notifications to the Data Protection Board and to the people affected; we give you the information and help you need to do so on time. We do not contact them ourselves unless you instruct us to or the law requires it. ## Helping you meet your obligations We help you respond to requests from the people whose data you hold — access, correction, erasure — when the data is in a system we operate, and tell you promptly if one reaches us directly instead of answering it ourselves. We also help, with information within our knowledge, with your security assessments and audits. ## Information and audits On request we give you the information reasonably needed to show that we meet this agreement, including summaries of our security testing. You, or an auditor bound by confidentiality, may audit our compliance once a year, with 30 days' notice, in working hours and at your cost, or at any time after a breach. ## Return and deletion When the agreement ends, you can export your data in standard formats, free, within days. We keep it for 30 days so you can, then delete it, and backup copies age out within the following 30 days. We confirm deletion in writing on request. Where the law requires us to keep any of it longer, we keep only that, protect it under this agreement, and delete it when the requirement ends. ## Liability and precedence Liability under this agreement is governed by our Terms of Service. If this agreement and the Terms disagree about personal data, this agreement wins. ## Contact and grievances Divyavyoma Technologies Private Limited (CIN U63111GJ2026PTC184103), registered office: Block-A, 606 Prahladnagar, Trade Center, BH Titanium, Jivraj Park, Ahmadabad City, Ahmedabad 380051, Gujarat. **Enquiries, quotes and billing**: [enquiry@divyavyoma.com](mailto:enquiry@divyavyoma.com) **Grievance Officer**: Ashokbhai Solanki, [grievance@divyavyoma.com](mailto:grievance@divyavyoma.com) **Working hours**: Monday to Saturday, 09:00–19:00 IST ## The other documents - [Privacy Policy](https://divyavyoma.com/legal/privacy) - [Terms of Service](https://divyavyoma.com/legal/terms) - [Service Level Agreement](https://divyavyoma.com/legal/sla)