Data Processing Addendum (DPA)

1. Purpose & Scope

This Data Processing Addendum (“DPA”) supplements the NotifySetu Terms of Service between INFOSKILLS TECHNOLOGY PVT LTD(“NotifySetu”, “Processor”) and Customer (“Controller”). This DPA governs the processing of Personal Data in connection with the provision of NotifySetu notification orchestration services pursuant to European and international data protection laws (including GDPR Art. 28).

2. Processing Instructions

NotifySetu shall process Personal Data solely on documented instructions from Customer, including with respect to transfers of Personal Data to third countries, unless required to do so by applicable law. The nature, duration, and purpose of processing are defined by Customer’s use of the NotifySetu APIs (Email, SMS, WhatsApp Business Platform, Push, Voice).

3. Confidentiality & Personnel

NotifySetu ensures that all personnel authorized to process Personal Data are subject to strict confidentiality agreements and have received appropriate security training regarding data protection and encryption standards.

4. Technical & Organizational Security Measures

Processor implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• AES-256 GCM encryption at rest for customer credentials, provider API keys, and notification records.
• TLS 1.3 encryption in transit for all incoming API dispatches and outgoing webhook deliveries.
• Continuous vulnerability scanning, automated failover, and strict database isolation per tenant.

5. Sub-processors

Customer provides general authorization for NotifySetu to engage the following sub-processors for service execution:

• Meta Platforms, Inc. / Meta Platforms Ireland Ltd— WhatsApp Business Platform cloud messaging
• Amazon Web Services, Inc.— Cloud infrastructure, computing, database hosting, and AWS SES
• Twilio Inc.— Telephony, SMS, and Voice routing
• Paddle.com Market Ltd— Merchant of Record for billing and global payment processing

NotifySetu imposes data protection obligations no less protective than those set out in this DPA on each sub-processor.

6. Data Subject Requests & Breach Assistance

Processor shall provide reasonable assistance to Controller in responding to requests by data subjects exercising their statutory rights under GDPR. In the event of a confirmed Personal Data Breach, Processor shall notify Controller without undue delay and within 72 hours of verification.

7. Deletion & Return of Personal Data

Upon termination of the Agreement or upon Controller’s written request, NotifySetu shall securely delete or return all Personal Data, unless statutory retention laws require continued retention.