Data Processing Agreement

1.1. Roles of the Parties: The parties acknowledge that with respect to all customer personal data uploaded, synced, or inputted by Merchant into the Service ("Customer Personal Data"), the Merchant is the Data Fiduciary under Section 2(i) of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), and RateKaro is the Data Processor under Section 2(k) of the DPDP Act.

1.2. Processing Instructions: RateKaro shall process Customer Personal Data exclusively on behalf of the Merchant and strictly in accordance with the Merchant's documented, automated instructions via the SaaS dashboard, for the sole purpose of delivering review requests, customer feedback surveys, and related messaging campaigns. RateKaro shall never process Customer Personal Data for its own commercial purposes, nor use such data to train, evaluate, or benchmark artificial intelligence or machine learning models.

2.1. Statutory Notice & Consent Warranty: The Merchant represents, warrants, and covenants that prior to uploading any Customer Personal Data into RateKaro:

(a) The Merchant has provided each Data Principal with clear, standalone notice meeting the requirements of Section 5 of the DPDP Act and Rule 3 of the DPDP Rules, 2025;

(b) The Merchant has obtained free, specific, informed, unconditional, and unambiguous consent from each Data Principal under Section 6 of the DPDP Act to receive commercial communications and review requests over WhatsApp, SMS, and email;

(c) The Merchant shall not upload any personal data relating to a child (under 18 years of age) without verifiable parental consent obtained in compliance with Section 9 of the DPDP Act.

2.2. Non-Waivable Accountability: The Merchant expressly acknowledges that under Section 8(1) of the DPDP Act, the Merchant remains legally responsible for compliance with the DPDP Act irrespective of this Agreement or any software automation provided by RateKaro.

3.1. RateKaro shall implement and maintain appropriate technical, physical, and organizational security safeguards to prevent personal data breaches, in full compliance with Section 8(5) of the DPDP Act and Rule 6 of the DPDP Rules, 2025.

3.2. RateKaro's security safeguards shall include:

(a) Encryption of personal data in transit using TLS, and at rest as provided by the database host. ;

(b) Access to the database only through RateKaro's servers, with checks that each merchant sees only its own records, and no direct access from the public internet. ;

(c) Logging of access to personal data (who, what kind of data, how many records, when; not the data itself), with logs retained for at least one (1) year pursuant to Rule 6(1)(e). ;

(d) Regular encrypted backups and a tested way to recover from them, pursuant to Rule 6(1)(d).

4.1. Authorization: Merchant grants RateKaro general written authorization to engage third-party sub-processors to assist in platform hosting, database management, messaging delivery, and AI reply drafting, as set forth in RateKaro's published Sub-Processor List.

4.2. Sub-Processor Obligations: RateKaro shall ensure that each sub-processor is bound by a written contract that imposes data protection obligations no less stringent than those set forth in this DPA.

4.3. Cross-Border Transfers: RateKaro shall ensure that any cross-border transfer of Customer Personal Data complies strictly with Section 16 of the DPDP Act and is not made to any country or territory blacklisted or restricted by the Central Government of India.

5.1. Immediate Notification: In the event RateKaro confirms or reasonably suspects a Personal Data Breach affecting Customer Personal Data under Section 2(u) of the DPDP Act, RateKaro shall notify the Merchant in writing without undue delay and in any event within twenty-four (24) hours of becoming aware.

5.2. Breach Report Assistance: RateKaro's notification shall provide:

(a) A description of the nature, timing, and extent of the incident;

(b) The categories and estimated number of affected Data Principals;

(c) Immediate remedial actions taken or proposed by RateKaro;

(d) Contact details of RateKaro's incident response lead.

5.3. Board Reporting Assistance: RateKaro shall provide reasonable assistance so that the Merchant can meet its duties under Section 8(6) and Rule 7: to inform the Data Protection Board and each affected Data Principal without delay, and to give the Board a detailed report within seventy-two (72) hours.

6.1. Taking into account the nature of the processing, RateKaro shall provide reasonable technical capabilities to enable the Merchant to fulfill its statutory obligations under Chapter III of the DPDP Act and Rule 14, including:

(a) Access to customer records upon request (Section 11);

(b) Correction, completion, or erasure of customer data (Section 12);

(c) Immediate suppression of contacts upon consent withdrawal (Section 6(4)).

6.2. If a customer contacts RateKaro directly seeking to exercise data protection rights, RateKaro shall promptly redirect the customer to the Merchant, while immediately honoring any direct opt-out request ("STOP") from ongoing campaigns.

7.1. Upon the written request of the Merchant, or when the purpose for which a record was uploaded is no longer being served, RateKaro shall erase the Customer Personal Data from live use in accordance with Section 8(7), subject to retaining logs and the related personal data for one year where Rule 6(1)(e) requires it.

7.2. Upon termination of the Merchant's subscription, RateKaro shall delete Customer Personal Data from live use within [period to be set by the lawyer], and backup copies are overwritten within thirty (30) days as they age out, unless law requires retention.

8.1. Merchant Indemnification: The Merchant agrees to indemnify, defend, and hold harmless RateKaro, its directors, officers, employees, and agents from and against any and all losses, [regulatory fines or penalties, to the extent the law permits,] damages, legal expenses, and settlement costs arising out of or related to:

(a) Merchant's failure to obtain lawful, documented consent from customers under Section 6;

(b) Merchant's failure to provide statutory notice under Section 5;

(c) Merchant's upload of personal data of minors in violation of Section 9;

(d) Merchant's breach of this DPA or the DPDP Act.

8.2. Limitation of Liability: To the maximum extent permitted by applicable Indian law, RateKaro's total aggregate liability arising out of or relating to this DPA, whether in contract, tort (including negligence), or otherwise, shall be strictly capped at the total subscription fees actually paid by the Merchant to RateKaro in the twelve (12) months preceding the incident giving rise to liability.