Data Processing Agreement

Terms including "Data Fiduciary", "Data Processor", "Data Principal", "personal data" and "personal data breach" have the meanings given to them in the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it.

"Customer Data" means personal data that you, or the end users of your applications, upload to, store on, transmit through, or otherwise process using the Services, and which we process on your behalf.

"Services" means the deployment, hosting, storage, database and related services made available by Riven Deploy.

"Sub-processor" means a third party engaged by us that processes Customer Data in connection with the Services.

You are the Data Fiduciary in respect of Customer Data. You determine the purposes and means of its processing.

We act as a Data Processor in respect of Customer Data, and process it solely on your behalf.

We are an independent Data Fiduciary in respect of the account data we collect from you directly, for example your name, email address, authentication identity and billing information. That processing is governed by our Privacy Policy and not by this DPA.

Nothing in this DPA makes us a joint fiduciary with you, or gives us any right to determine the purposes for which Customer Data is processed.

Subject matter. Provision of application deployment, hosting, compute, storage, database and related services as described in the Agreement.

Duration. For the term of the Agreement, together with the retention period described in Section 12.

Nature and purpose. Hosting, storing, transmitting, processing and making available Customer Data as technically necessary to run the applications and services you deploy, and to provide support you request.

Types of personal data. Determined entirely by you through the applications you deploy. We do not prescribe or inspect the categories of data you choose to process.

Categories of Data Principals. Determined entirely by you. These typically include your own end users, customers, employees, contractors and business contacts.

Your instructions. Your documented instructions to us consist of the Agreement, this DPA, the configuration choices you make within the platform, and any further written instructions you give us in relation to the Services. We will inform you if, in our reasonable opinion, an instruction appears to conflict with the DPDP Act.

We will process Customer Data only for the purpose of providing the Services and only on your instructions as described in Section 3.6.

We will not sell, rent, license or otherwise make Customer Data available to any third party except as permitted under Section 9 (Sub-processors) or as required by law.

We will not use Customer Data for our own purposes, including product development, benchmarking, analytics, advertising or the training of machine learning models.

We will implement and maintain the security measures described in Section 7.

We will ensure that any person we authorise to access Customer Data is subject to a duty of confidentiality and processes Customer Data only as necessary to perform their role.

We will provide you with reasonable assistance, at your cost where the effort is material, in:

1. (a)responding to requests from Data Principals exercising their rights;
2. (b)meeting your own obligations in relation to security safeguards and breach reporting;
3. (c)responding to enquiries from the Data Protection Board of India or any other competent authority.

If we receive a legally binding demand from a public authority for Customer Data, we will, unless prohibited by law, notify you before disclosing anything, and will limit any disclosure to what is legally required.

You are responsible for establishing and maintaining a lawful basis for the collection and processing of Customer Data, including providing any notice to and obtaining any consent from your Data Principals that the DPDP Act requires.

You are responsible for the accuracy, quality and legality of Customer Data and for the means by which you acquired it.

You are responsible for security within your own application, including your source code, dependencies, application-level access controls, user authentication, API keys, database credentials and the configuration of your deployments.

You will not upload to or process through the Services any category of personal data that is subject to additional legal or regulatory requirements beyond those addressed in this DPA, including payment card data subject to PCI DSS, or health records subject to specific regulatory regimes, unless we have agreed to this with you in writing in advance.

You will respond to requests from your own Data Principals. Where such a request relates to Customer Data held on our systems and you cannot fulfil it through the platform's own features, you may ask us for assistance under Section 4.6.

We treat Customer Data as confidential and do not access the contents of your applications, databases or storage volumes except where strictly necessary:

1. (a)to provide technical support that you have requested;
2. (b)to investigate or remedy a fault, outage or security issue affecting the platform;
3. (c)to protect the security, integrity or availability of the Services or of other customers;
4. (d)where required by law or by a competent authority.

Access under Section 6.1 is limited to authorised personnel, restricted to what is necessary in the circumstances, and recorded. We will make a record of such access available to you on reasonable written request.

Our confidentiality obligations survive the termination of the Agreement.

We maintain reasonable technical and organisational security safeguards designed to protect Customer Data against unauthorised access, disclosure, alteration, loss and destruction. Our current measures are described on our security page and include:

1. (a)encryption of data in transit using TLS across the platform and for applications hosted on it;
2. (b)isolation of each customer's workloads, with separate namespaces and separate credentials;
3. (c)restricted and authenticated access to production infrastructure, limited to authorised personnel;
4. (d)role-based access control and audit logging within customer workspaces;
5. (e)continuous monitoring of platform availability, with alerting;
6. (f)handling of payment information entirely by our payment gateway, such that card and UPI details are never stored on our systems.

Our security page also sets out, transparently, the measures we do not currently have in place, including the absence of multi-server failover and the absence of formal certifications such as SOC 2 or ISO 27001. You acknowledge that you have had the opportunity to review that page and have assessed whether the Services are appropriate for your intended use.

We may update our security measures from time to time. We will not make changes that materially reduce the overall level of protection afforded to Customer Data.

You are responsible for assessing whether the measures described in Section 7.1 are appropriate having regard to the nature and sensitivity of the Customer Data you choose to process using the Services.

If we become aware of a personal data breach affecting Customer Data, we will notify you without undue delay, and in any event within seventy-two (72) hours of becoming aware of it.

Our notification will include, to the extent the information is available to us at the time:

1. (a)a description of the nature of the breach;
2. (b)the categories and approximate volume of Customer Data affected;
3. (c)the likely consequences of the breach;
4. (d)the measures we have taken or propose to take to address it and to mitigate its effects.

Where we do not have all of this information at the time of first notification, we will provide it in stages as it becomes available, without further undue delay.

We will notify you using the email address registered on your account. You are responsible for keeping a monitored email address on file for this purpose.

We will take reasonable steps to contain and remediate the breach, and will cooperate with you so that you can meet your own notification obligations to Data Principals and to the Data Protection Board of India.

Our notification to you under this Section is not, and should not be treated as, an acknowledgement of fault or liability on our part.

Breaches occurring within your own application, including those arising from your source code, dependencies, credentials or configuration, are not personal data breaches of ours. We will assist you in investigating such incidents under Section 4.6, but responsibility for them rests with you.

You give us general authorisation to engage Sub-processors to process Customer Data in connection with the Services.

Our current Sub-processors are:

Before we engage a new Sub-processor that will process Customer Data, or replace an existing one, we will give you at least thirty (30) days' notice by email or through the platform.

If you have a reasonable objection to a new Sub-processor on data protection grounds, you may notify us within that notice period. We will work with you in good faith to address the objection. If we cannot, you may terminate the affected Services without penalty, and we will refund any prepaid fees covering the unused remainder of the then-current billing period.

We impose data protection obligations on our Sub-processors that are no less protective than those in this DPA, and we remain responsible to you for their performance.

The platform provides features that allow you to access, export and delete Customer Data held on our systems, so that you can respond to requests from your Data Principals directly.

Where you are unable to fulfil such a request using those features, we will provide reasonable assistance under Section 4.6.

If we receive a request directly from one of your Data Principals in relation to Customer Data, we will not respond to it substantively. We will instead direct the individual to you, and inform you of the request, unless we are legally required to act otherwise.

Applications, services and databases you deploy on Riven Deploy are hosted on infrastructure located in India (AWS Mumbai, ap-south-1).

We do not transfer Customer Data outside India except where a Sub-processor listed in Section 9.2 processes limited operational data outside India as indicated in that table, or where you yourself configure your application to send data to a destination outside India.

Where you configure your application to transmit Customer Data to third-party services outside India, that transfer is made by you and under your control, and this DPA does not apply to it.

You may export Customer Data at any time during the term of the Agreement using the platform's export features, or by connecting directly to your own services and databases.

On termination or expiry of the Agreement, we will retain Customer Data for fifteen (15) days so that you can export it, after which it will be deleted from our active production systems.

Where your account is terminated by us for illegal use, abuse, security threat, or where immediate action is required by law, Customer Data may be deleted without the retention period in Section 12.2.

Residual copies of Customer Data may persist in system backups or logs for a limited further period, and will be removed in the ordinary course of our retention cycles and in any event within thirty (30) days of the deletion under Section 12.2. Such copies are not accessed during that period except where required by law.

We will confirm deletion in writing on your reasonable written request.

We may retain Customer Data beyond these periods only where and for so long as retention is required by applicable law, and in that case only for the purpose of that legal requirement.

On reasonable written notice, and no more than once in any twelve (12) month period unless a personal data breach has occurred, we will:

1. (a)respond to a reasonable written security and data protection questionnaire; and
2. (b)provide such information within our possession as is reasonably necessary to demonstrate our compliance with this DPA.

We are not currently certified under SOC 2, ISO 27001 or any equivalent framework, and do not hold audit reports of that kind. This is stated openly on our security page.

We do not offer on-site or physical audits of our infrastructure, which is operated by the Sub-processor named in Section 9.2 and is not under our physical control. Where you require assurance in respect of that infrastructure, the relevant certifications are published by that Sub-processor.

Any information disclosed to you under this Section is our confidential information and may be used only for the purpose of assessing our compliance with this DPA.

Each party's liability under or in connection with this DPA is subject to the exclusions and limitations of liability set out in the Agreement, including the aggregate cap on liability contained in it.

The limitations in Section 14.1 do not apply to liability that cannot lawfully be limited or excluded, including liability arising from fraud, gross negligence or wilful misconduct.

You will indemnify us against claims, penalties and losses arising from your failure to comply with Section 5, including your failure to establish a lawful basis for processing Customer Data or to provide required notices to your Data Principals.

This DPA takes effect when you begin using the Services and continues for as long as we process Customer Data on your behalf.

We may update this DPA from time to time, including to reflect changes in law, in our Sub-processors, or in our security measures. Where a change is material, we will give you at least thirty (30) days' notice by email or through the platform before it takes effect.

We will not make changes to this DPA that materially reduce the protections afforded to Customer Data.

If there is any conflict between this DPA and the Agreement in relation to the processing of Customer Data, this DPA prevails. In all other respects the Agreement prevails.

If any provision of this DPA is found to be unenforceable, the remaining provisions continue in full force.

This DPA applies automatically to your use of the Services. No signature is required for it to take effect.

If your organisation requires a countersigned copy for its records, email us at [email protected] with your legal entity name, registered address and the name and designation of your authorised signatory. We will send a copy of this DPA, signed on our behalf, for you to countersign.

The terms of a countersigned copy issued under Section 16.2 will be identical to this published DPA. We do not negotiate variations to this DPA on standard plans. If your requirements go beyond it, contact us to discuss a custom arrangement.

For any matter relating to this DPA, including data protection enquiries, breach notifications and requests under Sections 4.6, 12.5 or 13.1, contact:

We will acknowledge communications sent to this address within forty-eight (48) hours and will respond substantively within thirty (30) days.

This DPA is governed by the laws of India.

The courts at Mumbai, Maharashtra have exclusive jurisdiction over any dispute arising out of this DPA, subject to any dispute resolution provisions in the Agreement.