Data Processing Agreement

For Customer Data you upload and process through the platform, you are the Controller (data fiduciary) and ECODrIx is the Processor (data processor). We process such data only on your documented instructions, which include your configuration and use of the Service.

• Subject matter: processing of personal data to provide the ECODrIx platform.
• Duration: for the term of your subscription plus retention periods stated below.
• Nature & purpose: hosting, storage, transmission, enrichment, automation, and messaging as configured by you.
• Categories of data subjects: your contacts, leads, customers, and personnel.
• Types of personal data: contact details, communications, and other data you choose to store.

• Process personal data only on your documented instructions, unless required by law (in which case we notify you where permitted).
• Ensure persons authorised to process data are bound by confidentiality.
• Implement appropriate technical and organisational security measures (see Security page).
• Assist you, taking into account the nature of processing, with data-subject requests and your compliance obligations.
• Make available information necessary to demonstrate compliance.

You authorise us to engage sub-processors to provide the Service. We maintain a current list on our Sub-processors page and impose data-protection terms on them no less protective than this DPA. We will give notice of intended changes so you may object on reasonable grounds.

We maintain measures including encryption in transit and at rest, access controls, network security, logging, and regular review. Details are described on our Security page, which forms part of this DPA.

Where we transfer personal data across borders, we implement lawful transfer mechanisms and contractual safeguards consistent with the DPDP Act and, where applicable, GDPR.

We will notify you without undue delay after becoming aware of a personal data breach affecting your Customer Data, and provide information reasonably available to help you meet your notification obligations. Security contact: [email protected].

On termination, you may export Customer Data for a limited period. After that period, we will delete or anonymise Customer Data except where retention is required by law, and back-ups are purged on our routine cycle.

On reasonable prior written notice and subject to confidentiality, we will provide relevant documentation and respond to reasonable audit requests to demonstrate compliance with this DPA. To request this DPA as a countersigned document, contact [email protected].