Trust Center · Legal
Certyze Data Processing Addendum
Standard form, signed with your Order Form. Questions: legal@thinkdatalabs.com
Standard form version: 19 October 2026. The customer-specific Effective Date is completed with the Order Form.
1. Scope and Incorporation
1.1 This Data Processing Addendum (“DPA”) supplements and is incorporated into the Certyze Master Software-as-a-Service Agreement (“MSA”) between the following parties:
| Details | |
|---|---|
Provider | Thinkdata Labs LLP, LLPIN AAI-9081, GSTIN 06AAMFT4128J2ZW, 176 First Floor Sector-10 Panchkula Haryana 134112 India, legal@thinkdatalabs.com |
Customer | [Customer Legal Name], [Registration/Company Number], [Registered Address], [Contact Email] |
Effective Date | [Effective Date] |
1.2 The Customer is a conformity assessment body (“CAB”) that subscribes to the Certyze platform (the “Service”) under the MSA. This DPA governs the processing of Personal Data by the Provider on behalf of the Customer in connection with the Service.
1.3 In the event of any conflict or inconsistency among the documents listed below, the following order of precedence shall apply, with the higher-ranked instrument prevailing to the extent of the conflict:
The Standard Contractual Clauses (“SCCs”) incorporated under Section 12, or the UK International Data Transfer Addendum, as applicable to a Restricted Transfer;
This DPA;
The MSA (including any Order Form or Statement of Work executed under it).
1.4 Capitalised terms used but not defined in this DPA have the meanings given to them in the MSA. Where this DPA defines a term differently from the MSA, the DPA definition shall govern for purposes of data-protection obligations.
2. Definitions
In this DPA, the following capitalised terms have the meanings set out below. Capitalised terms not defined here have the meanings given in the MSA.
“Applicable Data Protection Law” means all laws and regulations relating to the processing or protection of Personal Data that apply to the processing described in this DPA, including (as applicable) the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”), the UK Data Protection Act 2018 and UK GDPR, the India Digital Personal Data Protection Act 2023 (“DPDP Act”), and any successor or implementing legislation in any relevant jurisdiction.
“CAB” means the Conformity Assessment Body that is the Customer under the MSA.
“Controller” (and, where the DPDP Act applies, “Data Fiduciary”) means the natural or legal person that determines the purposes and means of the processing of Personal Data.
“Customer Data” means all Personal Data and other data that the Customer or its authorised users submit to, store in, or generate through the Service.
“Data Principal” and “Data Subject” mean the identified or identifiable natural person to whom Personal Data relates, as defined under the DPDP Act and the GDPR respectively.
“Personal Data” means any information relating to a Data Subject or Data Principal that constitutes personal data or digital personal data under Applicable Data Protection Law.
“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
“Processor” (and, where the DPDP Act applies, “Data Processor”) means the natural or legal person that processes Personal Data on behalf of the Controller.
“Restricted Transfer” means a transfer of Personal Data from the EEA, the United Kingdom, or Switzerland to a country that does not benefit from an adequacy decision under Applicable Data Protection Law, where such transfer requires appropriate safeguards.
“Service” means the Certyze platform and related services provided by the Provider to the Customer under the MSA.
“Subprocessor” means any third party engaged by the Provider to process Customer Data on behalf of the Customer in connection with the Service.
3. Roles of the Parties and Scope of Processing
3.1 Customer as Controller. The Customer acts as Controller (or Data Fiduciary, where the India DPDP Act applies) with respect to Customer Data processed through the Service. The Customer determines the purposes and means of Processing of Customer Data and issues documented instructions to the Provider in accordance with Section 4.
3.2 Provider as Processor. The Provider acts as Processor (or Data Processor, where the India DPDP Act applies) and shall Process Customer Data solely on behalf of, and in accordance with, the documented instructions of the Customer, subject to the terms of this DPA and the MSA.
3.3 Provider as Independent Controller. The parties acknowledge that the Provider independently controls limited categories of Personal Data for its own legitimate business purposes. These categories are:
contracting and order management data;
billing and payment data;
account security and authentication data;
data required for the Provider’s compliance with Applicable Data Protection Law; and
support-contact data necessary to deliver and maintain the Service.
For such independently controlled data, the Provider shall comply with Applicable Data Protection Law in its capacity as Controller and shall not process that data for purposes incompatible with those listed above.
3.4 Scope of Processing. The subject matter, nature, purpose, and duration of Processing, the categories of Data Subjects, and the types of Personal Data processed through the Certyze platform are described in Annex I (Description of Processing). Annex I forms part of this DPA and shall be updated by the parties as necessary to reflect material changes to the Processing.
4. Customer Instructions and Purpose Limitation
4.1 The Provider shall process Customer Data only on and in accordance with the Customer’s documented instructions. The MSA, this DPA, and any Order Form constitute the Customer’s initial documented instructions. The Customer may issue further written instructions provided they are consistent with the terms of the MSA and this DPA; the Provider is not required to comply with any instruction that conflicts with those terms unless the parties agree to an amendment in writing.
4.2 If the Provider reasonably determines that a Customer instruction infringes Applicable Data Protection Law, the Provider shall promptly inform the Customer and shall be entitled to suspend performance of the relevant instruction until the Customer modifies or confirms it in writing.
4.3 The Provider shall not process Customer Data for any purpose other than delivering the Service as described in the MSA and this DPA, unless required to do so by Applicable Data Protection Law. Where such a legal requirement applies, the Provider shall inform the Customer of that requirement before processing, unless the relevant law prohibits such notification on important grounds of public interest.
4.4 Nothing in this Section 4 restricts the Provider’s right to process the limited categories of Personal Data it independently controls (contracting, billing, account security, legal compliance, and support-contact data) as described in Section 3.
5. Confidentiality and Personnel
5.1 The Provider shall ensure that all personnel authorised to process Customer Data are bound by written confidentiality obligations that survive the termination of their engagement. These obligations shall be no less protective than the confidentiality provisions of this DPA.
5.2 The Provider shall restrict access to Customer Data to those personnel whose access is necessary for the performance of the Service. Personnel shall process Customer Data solely in accordance with the Customer’s documented instructions, except where otherwise required by Applicable Data Protection Law.
5.3 The Provider shall ensure that personnel authorised to process Customer Data receive appropriate training on their data-protection obligations under Applicable Data Protection Law and this DPA. Training shall be provided upon commencement of duties involving Personal Data and at regular intervals thereafter.
5.4 Where Applicable Data Protection Law requires the Provider to process Customer Data other than on the Customer’s instructions, the Provider shall inform the Customer of that legal requirement before processing, unless the relevant law prohibits such notification on important grounds of public interest.
5.5 The obligations in this Section 5 apply equally to any Subprocessor personnel who access Customer Data, and the Provider shall ensure equivalent confidentiality and training requirements are imposed through the flow-down terms required by Section 7.
6. Security Measures
6.1 The Provider shall implement and maintain technical and organisational measures appropriate to the nature, scope, context, and purposes of Processing and the risk to Data Subjects. These measures shall include, at a minimum, the safeguards described in clauses 6.2 through 6.4 and detailed in Annex II.
6.2 Infrastructure and Isolation. The Service is hosted on AWS (Amazon Lightsail and Amazon RDS) in region ap-south-1 (Mumbai, India). Each CAB receives a separate Amazon RDS database instance. Production environments and backups are configured to remain within India unless a Restricted Transfer mechanism applies.
6.3 Technical Controls:
TLS encryption for all data in transit between end users and the Service.
AWS-managed encryption at rest for databases, backups, and storage volumes.
Multi-factor authentication (MFA) mandatory for all user accounts, including administrator accounts.
Daily encrypted incremental backups of the AWS Lightsail infrastructure and database, retained while the Customer remains active in the Certyze environment. Snapshots are also stored in Amazon S3 for backup and recovery.
Role-based access control (RBAC) enforcing least-privilege principles across the platform.
Security event logging sufficient to support incident detection, investigation, and audit.
Secure software development practices, including code review and vulnerability management.
6.4 Data Export. The Customer may export Customer Data in CSV and PDF formats through the Service interface at any time during the term.
6.5 The Provider shall periodically review and, where necessary, update these measures to address evolving risks. Any material reduction in the overall level of security shall require prior written notice to the Customer. The complete description of technical and organisational measures is set out in Annex II.
7. Subprocessors
7.1 Authorised Subprocessors. The Customer provides general written authorisation for the Provider to engage the Subprocessors listed in Annex III to this DPA. The current approved Subprocessors as of the Effective Date are set out in Annex III.
7.2 Flow-Down Obligations. Before permitting any Subprocessor to process Customer Data, the Provider shall enter into a written agreement with that Subprocessor imposing data-protection obligations no less protective than those set out in this DPA, including obligations regarding confidentiality, security, and purpose limitation. The Provider remains fully liable to the Customer for the performance of each Subprocessor’s obligations.
7.3 Notice of Changes. The Provider shall notify the Customer in writing at least thirty (30) days before engaging any new Subprocessor or materially changing the processing performed by an existing Subprocessor. The notice shall identify the Subprocessor, describe the processing, and specify the location(s) of processing.
7.4 Right to Object. The Customer may object to a proposed Subprocessor change on reasonable data-protection grounds by notifying the Provider in writing within fifteen (15) days of receipt of the Provider’s notice. Upon receipt of a timely objection, the Provider shall, at its discretion: (a) take reasonable steps to mitigate the Customer’s concern; (b) offer a commercially reasonable alternative Subprocessor or configuration; or (c) if neither (a) nor (b) resolves the objection, permit the Customer to terminate the affected Service without penalty, which shall constitute the Customer’s sole and final remedy with respect to such objection.
7.5 Emergency Replacement. Where a Subprocessor must be replaced urgently to maintain service continuity or security, the Provider may engage a replacement Subprocessor before the expiry of the notice period, provided the Provider notifies the Customer as soon as practicable and the replacement Subprocessor is bound by obligations equivalent to those in Section 7.2.
8. Data Subject Rights, DPIAs, and Regulator Consultation
8.1 Assistance with Data Subject and Data Principal Rights. The Provider shall, taking into account the nature of the Processing, assist the Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Customer’s obligations to respond to requests from Data Subjects or Data Principals exercising their rights under Applicable Data Protection Law. The Provider shall promptly notify the Customer if it receives any such request directly and shall not respond to the request except on the Customer’s documented instructions, unless required by Applicable Data Protection Law.
8.2 Data-Protection Impact Assessments. Where the Customer is required to carry out a data-protection impact assessment (or equivalent assessment under Applicable Data Protection Law) relating to the Processing performed by the Provider, the Provider shall provide the Customer with such information about the Provider’s Processing activities, technical measures, and organisational measures as is reasonably necessary to enable the Customer to complete the assessment.
8.3 Prior Consultation with Supervisory Authorities. If, following a data-protection impact assessment, the Customer is required to consult a supervisory authority or other competent regulator, the Provider shall cooperate with and assist the Customer in that consultation to the extent the consultation relates to the Processing performed by the Provider.
8.4 Timeliness. The Provider shall maintain internal processes sufficient to enable it to provide the assistance described in Sections 8.1 through 8.3 within reasonable timeframes consistent with the Customer’s obligations under Applicable Data Protection Law.
9. Personal Data Breach Notification and Cooperation
9.1 Notification. Upon becoming aware of a Personal Data Breach affecting Customer Data, the Provider shall notify the Customer without undue delay after becoming aware of the breach. Notification shall be directed to the contact designated by the Customer in the Order Form or, absent such designation, to the Customer’s primary account administrator.
9.2 Content of Notification. The Provider’s notification shall include, to the extent reasonably available at the time:
A description of the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and Personal Data records affected;
The name and contact details of the Provider’s point of contact for further information;
A description of the likely consequences of the breach;
A description of the measures taken or proposed to address the breach, including measures to mitigate its adverse effects.
9.3 Supplemental Information. Where full details are not available at the time of initial notification, the Provider shall provide information in phases without further undue delay as it becomes available.
9.4 Cooperation. The Provider shall cooperate with the Customer in investigating, mitigating, and remediating the Personal Data Breach and shall provide reasonable assistance to enable the Customer to fulfil its obligations to notify supervisory authorities and affected Data Subjects under Applicable Data Protection Law.
9.5 No Admission. Notification of a Personal Data Breach under this Section 9 shall not be construed as an acknowledgement of fault or liability by the Provider.
10. Data Retention, Deletion, and Return
10.1 Retention During Term. The Provider shall process and retain Customer Data for the duration of the Agreement and for a period of exactly three (3) months following the effective date of termination or expiry of the Agreement (the “Post-Termination Period”).
10.2 Return of Data. At any time during the Post-Termination Period, the Customer may request return of its Customer Data in a standard machine-readable format (CSV or PDF export). The Provider shall make such data available for download within a commercially reasonable timeframe following receipt of the request.
10.3 Deletion. Upon expiry of the Post-Termination Period, and provided no return request under Section 10.2 remains outstanding, the Provider shall permanently delete all Customer Data from production systems and encrypted backups, including the Customer’s separate Amazon RDS database instance. The Provider shall confirm deletion in writing upon the Customer’s request.
10.4 Legal Hold Exception. The obligations in Section 10.3 shall not apply to the extent that Applicable Data Protection Law or any other applicable law, regulation, or court or governmental order requires the Provider to retain specific Customer Data. In such cases, the Provider shall (a) notify the Customer of the retention requirement to the extent legally permitted, (b) limit processing of the retained data to the purpose required by law, (c) continue to apply the security measures set out in Section 6 and Annex II, and (d) delete the retained data promptly once the legal obligation expires.
10.5 Customer Cooperation. The Customer shall retrieve any data it requires before the end of the Post-Termination Period. The Provider shall have no liability for Customer Data deleted in accordance with this Section 10.
11. Audit Rights, Government Requests, and Records
11.1 Audit Right. The Provider shall make available to the Customer, on reasonable request and no more than once per twelve-month period, information reasonably necessary to demonstrate compliance with this DPA. The Customer (or an independent third-party auditor appointed by the Customer and bound by confidentiality obligations acceptable to the Provider) may conduct an audit of the Provider’s processing activities, subject to at least thirty (30) days’ prior written notice, during normal business hours, and in a manner that does not unreasonably disrupt the Provider’s operations. The Customer shall bear its own costs of any such audit.
11.2 Records of Processing Activities. The Provider shall maintain records of processing activities carried out on behalf of the Customer as required by Applicable Data Protection Law, including Article 30(2) of the GDPR where applicable, and shall make such records available to the Customer or a competent supervisory authority upon request.
11.3 Government and Law-Enforcement Requests. If the Provider receives a request from any government authority or law-enforcement body for access to Customer Data, the Provider shall: (a) promptly notify the Customer of the request to the extent legally permitted; (b) not disclose Customer Data unless compelled by Applicable Data Protection Law or a binding legal order; (c) challenge the request where there are reasonable grounds to consider it unlawful; and (d) provide the minimum amount of data necessary to comply with a valid and binding order. Where notification to the Customer is prohibited by law, the Provider shall use reasonable efforts to obtain a waiver of that prohibition.
12. International Data Transfers
12.1 EU/EEA Restricted Transfers. Where Customer Data originating under the GDPR is transferred from the European Economic Area to the Provider in India (or to any other country lacking an adequacy decision), the Parties incorporate by reference the European Commission Standard Contractual Clauses adopted by Implementing Decision (EU) 2021/914 (“SCCs”), Module Two (controller-to-processor), as follows:
Clause 7 (Docking Clause): included, permitting additional parties to accede.
Clause 9 (Subprocessors): Option 2 (general written authorisation) applies; the Provider shall give the Customer at least 30 days’ prior written notice of any intended Subprocessor change.
Clause 11 (Redress): the optional language is excluded.
Clause 17 (Governing Law): the law of Ireland.
Clause 18 (Forum): the courts of Ireland.
Annex I (Parties and Processing Description), Annex II (Technical and Organisational Measures), and Annex III (Subprocessor List) of this DPA populate the corresponding SCC annexes.
12.2 UK Restricted Transfers. For transfers governed by the UK GDPR, the Parties incorporate by reference the ICO International Data Transfer Addendum to the EU SCCs (“UK Addendum”). The tables of the UK Addendum are deemed populated by this DPA and the applicable Order Form. The exporter may terminate the UK Addendum per Section 19 if a revised Approved Addendum would materially affect the transfer.
12.3 Precedence. In the event of conflict between this DPA and the SCCs or the UK Addendum, the SCCs or UK Addendum (as applicable) shall prevail with respect to Restricted Transfers.
12.4 US and Middle East Transfers. Where Customer is established in the United States or the Middle East, the Provider shall apply the same processor safeguards set out in this DPA to comply with locally Applicable Data Protection Law. This Section does not constitute a universal compliance guarantee for every jurisdiction.
12.5 EU/UK Representative Obligations. Nothing in this Section 12 removes any requirement for either Party to appoint a representative under Article 27 GDPR or the equivalent provision of the UK GDPR. Each Party shall independently assess and fulfil any such obligation before directing operations at Data Subjects in the EU or UK.
13. Customer Responsibilities, Sensitive Data, and Liability
13.1 Lawfulness of Instructions. The Customer is solely responsible for (a) determining the lawful basis for its Processing of Personal Data, (b) ensuring that all Processing instructions given to the Provider comply with Applicable Data Protection Law, and (c) fulfilling any transparency, notice, or consent obligations owed to Data Subjects or Data Principals in connection with Customer Data.
13.2 Special-Category and Sensitive Personal Data. The Service does not intentionally require the collection or Processing of special-category data (as defined in Article 9 GDPR or equivalent provisions of Applicable Data Protection Law) or sensitive Personal Data. Before uploading any such data to the Service, the Customer must (a) conduct its own assessment of the legal basis and risks, (b) provide the Provider with specific documented instructions, and (c) confirm that adequate supplementary safeguards are in place. The Provider accepts no additional liability for special-category or sensitive Personal Data uploaded without such prior instruction and assessment.
13.3 Customer Indemnity. The Customer shall indemnify and hold the Provider harmless against claims, losses, and expenses arising from (a) Processing carried out in accordance with the Customer’s instructions that infringes Applicable Data Protection Law, or (b) the Customer’s failure to meet its obligations under this Section 13.
13.4 Limitation of Liability. Any liability arising under or in connection with this DPA (including its Annexes, the SCCs, and the UK Addendum) is subject to the limitations and exclusions of liability set out in the MSA. Nothing in this DPA creates liability obligations that exceed those agreed in the MSA.
14. General Provisions
14.1 Governing Law and Jurisdiction. Except where the Standard Contractual Clauses or the UK Addendum specify a different forum, this DPA and any dispute arising out of or in connection with it shall be governed by and construed in accordance with the laws applicable to the MSA, and the parties submit to the jurisdiction specified in the MSA.
14.2 Notices. All notices under this DPA shall be in writing and delivered to the addresses specified in the MSA. Notices to the Provider relating to data protection shall be copied to legal@thinkdatalabs.com. Notices are effective upon confirmed receipt.
14.3 Amendments and Waivers. No amendment to this DPA shall be effective unless made in writing and signed by authorised representatives of both parties. No waiver of any right or remedy under this DPA shall be effective unless given in writing, and no single or partial exercise of any right shall preclude further exercise of that or any other right.
14.4 Severability. If any provision of this DPA is held invalid, illegal, or unenforceable by a court of competent jurisdiction, the remaining provisions shall continue in full force and effect. The parties shall negotiate in good faith a replacement provision that achieves, to the extent possible, the original commercial and legal intent.
14.5 Entire Agreement. This DPA, together with the MSA, the Standard Contractual Clauses (where applicable), and the UK Addendum (where applicable), constitutes the entire agreement between the parties regarding the processing of Personal Data in connection with the Service and supersedes all prior or contemporaneous representations, understandings, or agreements on that subject matter.
14.6 Precedence. In the event of any conflict between this DPA and the MSA, this DPA shall prevail with respect to the processing of Personal Data. Where the Standard Contractual Clauses or the UK Addendum apply to a Restricted Transfer, those instruments shall prevail over both this DPA and the MSA to the extent of any inconsistency, as further set out in Section 12.
15. Signature Blocks and Annexes
IN WITNESS WHEREOF, the Parties have caused this Data Processing Addendum to be executed by their duly authorised representatives as of the Effective Date.
| Provider: Thinkdata Labs LLP | Customer: [Customer Legal Name] | |
|---|---|---|
Signature | ________________________ | ________________________ |
Name | ________________________ | [Contact Name] |
Title | ________________________ | [Title] |
Date | ________________________ | [Date] |
LLPIN / Reg. No. | AAI-9081 | [Customer Registration Number] |
Address | 176 First Floor, Sector-10, Panchkula, Haryana 134112, India | [Customer Address] |
legal@thinkdatalabs.com | [Customer Email] |
The following Annexes form an integral part of this DPA and are incorporated by reference:
Annex I: Description of Processing, including the subject matter and duration of Processing, the nature and purpose of Processing, the categories of Data Subjects, and the categories of Personal Data processed through the Service.
Annex II: Technical and Organisational Security Measures, setting out the security controls described in Section 6 and applied by the Provider to protect Customer Data.
Annex III: List of Approved Subprocessors, identifying each Subprocessor, its location, and the processing activities it performs, as referenced in Section 7.
Annex I: Description of Processing
This Annex describes the Processing of Customer Data under this DPA. Where the Standard Contractual Clauses or the UK Addendum apply under Section 12, this Annex also completes Annex I of the Standard Contractual Clauses and the corresponding tables of the UK Addendum.
A. List of Parties
| Data exporter (Controller) | Data importer (Processor) | |
|---|---|---|
Name and address | The Customer identified in Section 1.1 and the Order Form. | Thinkdata Labs LLP, LLPIN AAI-9081, 176 First Floor, Sector-10, Panchkula, Haryana 134112, India. |
Contact person | As designated by the Customer in the Order Form. | Legal and data protection contact, legal@thinkdatalabs.com. |
Activities relevant to the transfer | Use of the Certyze platform to manage the Customer’s conformity assessment and certification activities. | Provision, hosting, maintenance and support of the Certyze platform. |
Role | Controller (Data Fiduciary where the DPDP Act applies). | Processor (Data Processor where the DPDP Act applies). |
Signature and date | As set out in Section 15. | As set out in Section 15. |
B. Description of Processing and Transfer
| Item | Description |
|---|---|
Subject matter | Provision of the Certyze certification-lifecycle platform to the Customer under the MSA. |
Duration | The term of the MSA and the three-month Post-Termination Period in Section 10.1. Customer Data is then deleted under Section 10.3, subject to Section 10.4. |
Nature of Processing | Hosting and storage; recording, organisation, structuring and retrieval; display to the Customer’s authorised users; generation of documents such as audit reports and certificates; export at the Customer’s request; backup and restoration; sending system notifications by email; technical support at the Customer’s request; and deletion. |
Purposes | To enable the Customer to run its conformity assessment activities, including applications and contract review, audit programmes and audit time, auditor competence and impartiality, audits, non-conformities, certification decisions and certificates; and to maintain, support and secure the Service. |
Categories of Data Subjects | (a) The Customer’s administrators, personnel and other authorised users; (b) the Customer’s franchisees, representatives and agents; (c) auditors and technical experts, including those whose records the Customer holds without a login; (d) personnel of organisations that have applied for, or hold, certification from the Customer; and (e) other individuals named in records the Customer stores, such as complaints and appeals. |
Categories of Personal Data | Identity: name, photograph, signature, references to government-issued identifiers. Role: job title, organisation, user role on the platform. Contact: email address, telephone number, postal address. Certification records: applications and supporting documents, audit plans and reports, findings, evidence files, non-conformities and corrective actions, certificate numbers, scope, dates and status. Competence and impartiality: qualifications, training records, competence evaluations, conflict-of-interest declarations. Scheduling: audit dates, availability and assignments. Usage records: login times, IP addresses, browser and device identifiers, and security events relating to users of the Service. |
Special-category or sensitive data | None is required by the Service. If the Customer uploads such data, Section 13.2 applies. The safeguards in Annex II apply to all Customer Data. |
Frequency of transfer | Continuous, for the duration of the Service. |
Retention | As set out under Duration. Backups are retained while the Customer remains active in the Certyze environment and deleted at the end of the Post-Termination Period. |
Transfers to Subprocessors | As described in Annex III, for the duration of the Service. |
C. Competent Supervisory Authority
For the purposes of Clause 13 of the Standard Contractual Clauses, the competent supervisory authority is:
(a) where the Customer is established in an EU Member State, the supervisory authority of that Member State;
(b) where the Customer is not established in the EU, falls within Article 3(2) GDPR and has appointed a representative under Article 27(1) GDPR, the supervisory authority of the Member State in which that representative is established; and
(c) where the Customer is not established in the EU, falls within Article 3(2) GDPR and has not appointed a representative, the supervisory authority of one of the Member States in which the Data Subjects whose Personal Data is transferred are located, as specified in the Order Form.
For transfers governed by the UK GDPR, the competent authority is the Information Commissioner’s Office.
Annex II: Technical and Organisational Measures
The Provider applies the following measures to Customer Data, as required by Section 6. Where the Standard Contractual Clauses apply, this Annex completes Annex II of the Standard Contractual Clauses.
| Area | Measures |
|---|---|
Hosting and data location | The Service is hosted on Amazon Web Services in the Asia Pacific (Mumbai) region, ap-south-1. The application runs on Amazon Lightsail and Customer Data is stored in Amazon RDS. Production data and backups are configured to remain in India. |
Separation of customers | Each Customer has its own separate Amazon RDS database, so that one Customer’s data is separated from every other Customer’s data at the storage layer. |
Encryption | TLS encryption for all data in transit between users and the Service. AWS-managed encryption at rest for databases, backups and storage volumes. |
User authentication | Multi-factor authentication (MFA) is mandatory for all user accounts, including administrator accounts. Users must keep their credentials confidential under the Platform User Terms. |
Access control | Role-based access control applying least-privilege principles to the Customer’s users and to Provider administrators. Each user’s role determines the data and functions available to them. The Customer manages its own users and removes access for departing personnel. |
Provider personnel | Access to Customer Data is limited to authorised personnel on a need-to-know basis, and every access is logged. Personnel are bound by written confidentiality obligations that survive their engagement and receive data protection training when they start and at regular intervals. |
Logging and monitoring | Security events, including authentication events and permission changes, are logged to support the detection and investigation of incidents. |
Backup and resilience | Daily encrypted incremental backups of the AWS Lightsail infrastructure and database, kept in India and retained while the Customer remains active in the Certyze environment. Snapshots are also stored in Amazon S3 for backup and recovery. |
Secure development | Secure development practices, including code review and vulnerability management, are applied to the application. |
Incident response | Documented procedures for identifying, investigating and responding to security incidents. The Customer is notified of a Personal Data Breach without undue delay after the Provider becomes aware of it, as set out in Section 9. |
Data portability and deletion | The Customer can export Customer Data in CSV and PDF formats at any time. At the end of the Post-Termination Period, the Customer’s database and all backups are deleted, and deletion is confirmed in writing on request. |
Subprocessors | Each Subprocessor is bound by a written agreement with obligations no less protective than this DPA, and changes are notified at least 30 days in advance under Section 7. |
Assistance to the Customer | Assistance with Data Subject requests, data protection impact assessments and regulator consultations under Section 8, and audit information under Section 11. |
Review | Measures are reviewed periodically and updated to address evolving risks. Any material reduction in the overall level of security requires prior written notice to the Customer. |
Certifications | The Provider does not currently hold ISO/IEC 27001 certification or a SOC 2 report. Information about these measures is available to the Customer on request under Section 11.1. |
Annex III: Approved Subprocessors
The Customer authorises the Provider to engage the following Subprocessors to process Customer Data under Section 7. Where the Standard Contractual Clauses apply, this Annex completes Annex III of the Standard Contractual Clauses.
| Subprocessor | Service provided | Customer Data processed | Location | Safeguards |
|---|---|---|---|---|
Amazon Web Services India Private Limited and applicable AWS affiliates | Hosting of the application (Amazon Lightsail), DNS, Amazon RDS databases, storage and backups | All Customer Data | ap-south-1 (Mumbai, India). AWS support and service telemetry may be processed globally. | AWS data processing addendum. Customer Data and backups configured to remain in India. |
Sendinblue SAS (trading as Brevo) | Transactional email for notifications the Service sends on the Customer’s behalf | Recipient names and email addresses, and notification content such as audit dates, audit assignments and auditor names | Mainly France and Belgium; other EU and US processing possible | Brevo data processing agreement; Standard Contractual Clauses where applicable. |
Google India Private Limited and relevant Google group entities | Google Workspace business email used for support | Customer Data only where the Customer sends it to the Provider by email | Global infrastructure, including the US and the EU | Google Workspace data processing terms; Standard Contractual Clauses. |
WhatsApp LLC | WhatsApp messaging used for support | Customer Data only where the Customer sends it to the Provider by WhatsApp, for example error details or screenshots | Global infrastructure, including the US | WhatsApp Business terms; messages are end-to-end encrypted. |
Razorpay processes billing and payment data that the Provider controls as an independent controller under Section 3.3. It does not process Customer Data and is therefore not listed here.
The current list is also published at certyze.com/legal/subprocessors. Changes follow the notice and objection process in Section 7.