Data Processing Addendum
1. Scope and roles
This Data Processing Addendum (“DPA”) forms part of the Terms of Service or other agreement between the Customer and AnvionixLabs for Satyakod. It applies when we process personal data on the Customer’s behalf (“Customer Personal Data”).
The Customer is the data fiduciary or controller and we are the data processor. Terms such as “personal data”, “processing” and “personal data breach” have the meanings given in the applicable data protection law, including the DPDP Act and, where applicable, the GDPR.
2. Details of processing
| Item | Description |
|---|---|
| Subject matter and nature | Generating product codes, verifying scans, detecting counterfeits, clones and diversion, alerts, investigations and reporting |
| Duration | The term of the agreement plus the retention periods in section 9 |
| Data subjects | People who scan the Customer’s products (consumers, mechanics, pharmacists, retailers, distributors, farmers and others), and the Customer’s authorised users |
| Personal data | IP address, approximate location, device and browser data, timestamps, codes scanned, phone numbers and messages for messaging channels, user names and emails |
| Sensitive data | None intended. The Customer must not configure the Service to collect special-category or sensitive personal data |
3. Instructions
We process Customer Personal Data only on the Customer’s documented instructions, which are the agreement, the Customer’s configuration of the Service, and other written instructions. We will tell the Customer if we believe an instruction breaks data protection law.
4. Confidentiality
Everyone we authorise to process Customer Personal Data is bound by confidentiality obligations.
5. Security
We maintain the technical and organisational measures in Annex A and will not materially reduce the overall level of protection during the term.
6. Sub-processors
The Customer authorises the sub-processors listed on our Sub-processors page. We will give at least 30 days’ notice before adding or replacing a sub-processor that processes Customer Personal Data. The Customer may object on reasonable data protection grounds; if we cannot address the objection, the Customer may terminate the affected Service and receive a refund of prepaid fees for the unused period. We bind each sub-processor to data protection terms no less protective than this DPA and remain responsible for its performance.
7. Assistance
Taking into account the nature of processing, we will help the Customer respond to requests from data subjects, carry out impact assessments where required, and meet its security and breach obligations. If we receive a request directly from a data subject about Customer Personal Data, we will pass it to the Customer and not respond ourselves unless instructed or required by law.
8. Personal data breaches
We will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe the breach, the likely consequences, and the measures taken or proposed, with further information as it becomes available, so the Customer can meet its own reporting duties, including to the Data Protection Board of India.
9. Return and deletion
Scan data is retained for up to 26 months unless the Customer configures a shorter period. At the end of the agreement, the Customer may export its data for 30 days; we then delete Customer Personal Data within 90 days, except copies we must keep by law, which remain protected under this DPA.
10. Audits
On request, no more than once a year, we will answer reasonable security questionnaires and provide available summaries of our security practices. Where the law requires more, we will allow an audit by an independent auditor bound by confidentiality, on 30 days’ notice, during business hours, at the Customer’s cost.
11. International transfers
Customer Personal Data may be processed outside the country where it was collected, including in the United States, where our application servers are currently located. Files and email are stored in India (AWS Mumbai region). For transfers from the EU, UK or Switzerland, the Standard Contractual Clauses (Module 2 controller-to-processor, or Module 3 where applicable) and the UK International Data Transfer Addendum are incorporated by reference. We will comply with any transfer restriction notified under the DPDP Act.
12. Liability and precedence
Each party’s liability under this DPA is subject to the limitations in the agreement. If this DPA conflicts with the agreement on data protection, this DPA prevails.
Annex A: Security measures
- Encryption of data in transit with TLS.
- Passwords and API keys stored hashed; secrets that must be read back stored encrypted.
- Logical separation of each customer’s data; requests are scoped to one workspace.
- Role-based access, least privilege, and multi-factor authentication for administrative access.
- Audit logging of signing, downloads, revocations and administrative actions.
- Regular backups and tested restoration procedures.
- Security updates applied to servers and dependencies on a regular schedule.
- Code-signing keys held in AWS Key Management Service (Mumbai region); a separate key is derived for each batch and keys never leave the key service.
- Incident response procedure with defined roles and customer notification.