Data Processing Addendum

Last updated: 25 October 2026 · Version 1.0 · Edition: DigiSurvey Enterprise (Mumbai)

1. Definitions. “Personal Data”, “Data Principal”, “Data Fiduciary” and “Data Processor” have the meanings in the Digital Personal Data Protection Act, 2023 (“DPDPA”). “Customer Data” means Personal Data that Customer or its users upload to or generate within the Service.
2. Roles. Customer is the Data Fiduciary for Customer Data. Digitaliiisla is the Data Processor and acts on Customer’s documented instructions. Each party will comply with its obligations under the DPDPA for its role.
3. Scope and duration of processing. Nature: hosting, OCR, damage detection, report generation, delivery and retention of motor-insurance survey data. Purpose: delivering the Service under the Agreement. Duration: for the term of the Agreement and the retention tail set out in clause 11.
4. Categories of Data Principals. Insureds and claimants of the Customer; the Customer’s own employees and contracted surveyors; witnesses whose contact details are captured during a claim; third parties who sign the insured sign-off form.
5. Categories of Personal Data. Identity data (name, phone, email); vehicle data (registration, chassis, engine, odometer); document images (RC, DL, policy copy, cheque leaf); photographs of damage and the surrounding site; GPS co-ordinates and EXIF timestamps; call-recording transcripts; derived assessment figures.
6. Processor obligations. Digitaliiisla will: (a) process Customer Data only on Customer’s documented instructions; (b) impose confidentiality on personnel; (c) implement the security measures in clause 9; (d) assist Customer with Data Principal requests under clause 10; (e) assist Customer with security assessments, breach notifications and prior consultations with the Data Protection Board of India to the extent reasonably required.
7. Hosting region. The DigiSurvey enterprise database and object storage are provisioned in Mumbai (ap-south-1). We will not change the primary processing region out of India without 60 days’ prior written notice and Customer’s right to terminate for convenience during that notice period.
8. Sub-processors. Customer gives general written authorisation for Digitaliiisla to engage sub-processors to deliver the Service, provided Digitaliiisla: (a) imposes data-protection terms no less protective than this DPA; (b) remains liable for sub-processor acts; and (c) maintains an up-to-date list of sub-processors at /legal/subprocessors.html, notifying Customer at least 15 days before adding or replacing a sub-processor, during which Customer may object on reasonable grounds.
9. Security measures. As a minimum: TLS 1.2+ in transit; AES-256 at rest; row-level security on every tenant-scoped table; short-lived presigned URLs for every media read; mandatory MFA on admin consoles; least-privilege IAM; weekly backups retained for 30 days; quarterly backup restore tests; append-only audit log for every destructive action; annual VAPT by an independent assessor.
10. Assistance with Data Principal requests. Where a Data Principal exercises a right under section 11 of the DPDPA (access, correction, erasure, nomination, grievance) directly with Digitaliiisla, Digitaliiisla will acknowledge the request within 72 hours and will route it to the Customer within 5 working days. Where Customer needs technical assistance to fulfil such a request, Digitaliiisla will cooperate within reasonable commercial limits.
11. Retention and deletion. On expiry or termination of the Agreement, Digitaliiisla will: (a) give Customer 30 days of read-only export access in machine-readable form; (b) delete Customer Data within 90 days thereafter, except where applicable law requires longer retention; (c) on written request, provide a Deletion Certificate signed by its Director. Backup copies are overwritten on their scheduled cycle, within 35 days of the primary deletion.
12. Incident response. Digitaliiisla will notify Customer of a Personal Data Breach affecting Customer Data without undue delay and, in any event, within 72 hours of becoming aware. The notice will include: nature of the breach, categories and approximate number of Data Principals affected, likely consequences, measures taken and recommended mitigations. Digitaliiisla will cooperate with Customer’s own notice to the Data Protection Board of India.
13. Audits. Customer, or an independent auditor it appoints under NDA, may audit Digitaliiisla’s compliance with this DPA once per 12 months on 30 days’ prior written notice, during business hours, and in a manner that does not disrupt other customers. Digitaliiisla’s SOC 2 Type II or ISO 27001 audit report (when available) satisfies routine audit requests.
14. Cross-brand isolation. Digitaliiisla operates a separate legacy environment under the digitaliiisla.co.in brand, backed by a different Supabase project in Singapore. Customer Data created under this DPA is routed only to the Mumbai project. Digitaliiisla will not migrate, copy or expose Customer Data to the legacy environment, directly or indirectly, without a signed data-transfer instrument from Customer.
15. Order of precedence. In case of conflict, this DPA prevails over the main Agreement in matters of data protection, and any Customer-signed addendum signed later prevails over this standard DPA.
16. Governing law. This DPA is governed by Indian law. Disputes are subject to the forum stated in the main Agreement.
17. Changes. We may update this DPA. Material changes are notified 15 days in advance by email to Customer’s legal contact. Customer may terminate for convenience during the notice period if the change is materially adverse.

Annex A — Technical & organisational measures

Annex B — Sub-processor list

Live list: /legal/subprocessors.html. Core enterprise sub-processors include Supabase (hosting, Mumbai), Cloudflare (edge, R2 object storage), Netlify (static hosting, functions), Resend (transactional email). We notify at least 15 days before adding a new sub-processor that will handle Customer Data.

Annex C — Signature

This DPA is executed on acceptance of the enterprise order form or on first use of the Service under the Agreement, whichever is earlier. A countersigned copy is available on written request to legal@digitaliiisla.co.in.