Data Processing Addendum

For personal data that Customer uploads, stores, or processes using the Services ("Customer Personal Data"), Customer acts as the data controller (or "data fiduciary" under India's Digital Personal Data Protection Act, 2023) and Fix24 acts as the data processor (or "data processor" under the DPDP Act), processing such data only on Customer's documented instructions, including as set out in this DPA and the underlying service agreement.

Fix24 processes Customer Personal Data solely to provide, secure, and support the Services — including storage, backup, transmission, and technical support — for the duration of the applicable service term. The type of personal data and categories of data subjects are determined and controlled by Customer through its use of the Services.

Customer is responsible for ensuring it has a lawful basis to collect and process any personal data it hosts on our infrastructure, for providing any required notices or obtaining any required consents from data subjects, and for the accuracy and legality of Customer Personal Data.

Fix24 may engage sub-processors (such as upstream data center operators, network providers, or infrastructure vendors) to assist in delivering the Services. Fix24 remains responsible for sub-processors' compliance with data protection obligations equivalent to those in this DPA. A current list of material sub-processors is available on request at support@fix24.cloud.

Fix24 implements appropriate technical and organizational measures to protect Customer Personal Data, including encryption in transit, access controls, network firewalls, activity logging, and physical security at our data centers, consistent with our Privacy Policy and Backup & Disaster Recovery Policy.

Customer Personal Data is hosted in the data center region selected by Customer at signup. Fix24 does not transfer Customer Personal Data outside the selected region except as necessary to provide support, ensure business continuity, or comply with law, and will use reasonable efforts to notify Customer of any such transfer where legally permitted.

Where Fix24 receives a request directly from a data subject relating to Customer Personal Data, we will promptly forward the request to Customer and will not respond directly except as required by law. Fix24 will provide reasonable assistance to Customer in responding to data subject access, correction, or deletion requests, to the extent Fix24 can do so through the Services.

If Fix24 becomes aware of a confirmed breach affecting the confidentiality, integrity, or availability of Customer Personal Data, we will notify Customer without undue delay after becoming aware, and provide reasonably available information about the nature and scope of the incident to support Customer's own notification obligations.

Upon termination of the Services, Fix24 will make Customer Personal Data available for export during the applicable grace period described in our Terms of Service, after which it will be deleted or rendered irrecoverable in the ordinary course of our data lifecycle processes, except where retention is required by law.

On reasonable written request, Fix24 will provide Customer with information reasonably necessary to demonstrate compliance with this DPA, subject to confidentiality obligations and applicable security constraints.

For DPA execution requests or data protection questions, contact support@fix24.cloud or call 75759 50003. Fix24.cloud, Datamation Group, Guwahati, Assam, India.