Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Safety Desk, operator of the Vigilo platform ("Processor"), and the organisation that has subscribed to Vigilo ("Controller"). This DPA applies wherever the Processor processes personal data on behalf of the Controller in connection with the provision of the Vigilo service.

In the event of any conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to the processing of personal data.

1. Definitions

• "Personal Data" — any information relating to an identified or identifiable natural person processed by the Processor on behalf of the Controller through the Vigilo platform.
• "Processing" — any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, or deletion.
• "Data Subject" — the individual to whom Personal Data relates (e.g. employees, contractors, workers of the Controller's organisation).
• "Sub-processor" — any third party engaged by the Processor to process Personal Data.
• "Applicable Law" — the Information Technology Act, 2000 and the IT (SPDI) Rules, 2011 of India, and any other applicable data protection law.

2. Roles of the Parties

The Controller determines the purposes and means of processing Personal Data through the Vigilo platform. The Processor processes Personal Data solely on the documented instructions of the Controller and for no other purpose.

3. Subject Matter and Duration

The Processor shall process Personal Data for the duration of the Controller's active subscription to Vigilo, and for 30 days thereafter pending deletion as described in Clause 10. The subject matter of processing is described in Schedule 1.

4. Processor Obligations

The Processor shall:

1. Process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data outside India, unless required by applicable law.
2. Ensure that persons authorised to process the Personal Data have committed themselves to confidentiality.
3. Implement the technical and organisational security measures described in Schedule 2 and in the Data Security Policy.
4. Not engage a Sub-processor without prior written authorisation of the Controller, except as listed in Schedule 1. The Processor shall impose equivalent data protection obligations on any Sub-processor.
5. Assist the Controller in responding to Data Subject requests to the extent possible given the nature of the processing.
6. Assist the Controller in ensuring compliance with security, breach notification, data protection impact assessment, and prior consultation obligations.
7. At the Controller's choice, delete or return all Personal Data after the end of the provision of services, and delete existing copies unless applicable law requires storage.
8. Make available to the Controller all information necessary to demonstrate compliance with this DPA.

5. Controller Obligations

The Controller warrants that:

1. It has the legal basis to collect and transfer the Personal Data to the Processor for processing under this DPA.
2. It has provided all required notices to Data Subjects and obtained all necessary consents where applicable.
3. The instructions it gives to the Processor comply with all Applicable Laws.
4. It will promptly inform the Processor of any changes in applicable law that may affect the Processor's obligations.

6. Sub-processors

The Controller grants general written authorisation to the Processor to engage the Sub-processors listed in Schedule 1. The Processor shall notify the Controller of any intended changes to Sub-processors by updating Schedule 1 and providing at least 30 days' notice, giving the Controller the opportunity to object.

7. Security

The Processor shall implement and maintain appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. The current measures are described in the Data Security Policy and summarised in Schedule 2.

8. Personal Data Breach Notification

The Processor shall notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting the Controller's data. The notification shall include, to the extent known:

• The nature of the breach and categories of Personal Data affected
• The approximate number of Data Subjects and records affected
• The likely consequences of the breach
• Measures taken or proposed to address the breach

A full written incident report shall be provided within 14 days of the initial notification.

9. Data Subject Rights

The Processor shall, taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures to fulfil its obligations to respond to Data Subject requests (access, correction, deletion, restriction, portability). Managers may export, correct, or delete Data Subject records directly from within the Vigilo platform at any time.

10. Retention & Deletion

Following termination or expiry of the subscription, the Processor shall retain the Controller's Personal Data for 30 days to allow recovery, after which all Personal Data shall be permanently deleted from all systems and backups on a rolling basis. The Processor shall provide written confirmation of deletion upon request.

11. Audit Rights

The Processor shall make available all information reasonably necessary to demonstrate compliance with this DPA. The Controller may exercise audit rights by submitting written questions to the Processor's security contact. The Processor shall respond within 14 business days.

12. Limitation of Liability

Each party's liability under this DPA shall be subject to the limitations set out in the Terms of Service.

13. Governing Law

This DPA is governed by the laws of India. Any dispute shall be subject to the exclusive jurisdiction of the courts of Chennai, Tamil Nadu.