Data Processing Addendum

Draft, for review by a lawyer. Meets GDPR Art. 28(3) and DPDP s.8(2) for the personal data customers' websites collect. The reviewer should attach or incorporate the EU Standard Contractual Clauses (Modules 2 and 3) and the UK Addendum, and confirm the incorporation-by-reference approach.

Effective: [date of publication] · Version: 1

This addendum forms part of the Terms of Use between you (the "Customer") and Thothica Private Limited ("Thothica"). It applies whenever Thothica processes personal data on the Customer's behalf through unrigid. It is accepted with the Terms; no separate signature is needed. [Reviewer: offer a countersigned copy on request.]

1. Roles

For personal data that the Customer's websites collect or hold (visitors' form submissions and other data the Customer puts into its sites; together "Customer Personal Data"), the Customer is the controller / Data Fiduciary and Thothica is the processor / Data Processor. The Customer is solely responsible for having a lawful basis, giving its visitors a privacy notice, honouring their rights, and for everything it does with Customer Personal Data outside unrigid (including any data it exports, downloads, shares or sells). Thothica is not responsible for the Customer's compliance with data protection law, and the Customer's indemnity in the Terms (section 16) covers claims and fines arising from it.

2. Details of processing

Thothica Analytics [Thothica Analytics: approved by Adnan 4 Nov; feature not yet built]. The Customer, as controller, decides whether Thothica Analytics runs on its websites and can switch visit counts and details off in Settings › Analytics. The visitor-consent step for details is administered by the platform's consent banner on the Customer's behalf. [Reviewer: lawful basis. Visit counts rely on the Customer's legitimate interest (GDPR Art. 6(1)(f)), with data reduced to non-personal aggregates; ePrivacy Art. 5(3) is not engaged because nothing is stored on or read from the device. Under DPDP our position is that no personal data is retained; confirm whether DPDP's consent model reaches the transient processing of the IP address and browser description. If it does, the fallback is "details only", with everything after consent. Details rely on consent (GDPR Art. 6(1)(a), ePrivacy 5(3), DPDP s.6).]

3. Instructions

Thothica processes Customer Personal Data only on the Customer's documented instructions: these Terms, the settings the Customer chooses in unrigid (such as each form's retention period and notification recipients) and any further written instructions we agree. If the law requires other processing, Thothica tells the Customer first unless the law forbids it. Thothica tells the Customer if it believes an instruction breaks the GDPR or DPDP.

4. Confidentiality

Thothica ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality. Staff see a Customer's site only when the Customer grants support access or when needed to keep the service safe or follow the law, and each viewing is recorded.

5. Security

Thothica keeps technical and organisational measures appropriate to the risk (GDPR Art. 32; DPDP s.8(5) and Rule 6), including: encryption in transit; per-site databases; keyed hashing of network identifiers (no raw IP addresses are stored with submissions); role-based access with staff actions recorded; spam protection; logs kept for at least one year; backups kept 90 days; and regular testing of restores.

6. Sub-processors

The Customer authorises the sub-processors listed on How unrigid handles data. Thothica binds each to data protection terms at least as protective as this addendum and remains responsible for them. Thothica gives at least 30 days' notice (on that page and by email to owners) before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds; if we cannot resolve it, the Customer may cancel the affected credits and receive a pro-rata refund of prepaid fees.

7. Helping the Customer

Thothica helps the Customer, taking into account the nature of the processing, to:

• answer data subjects' requests: the Customer can find, export (JSON and CSV) and delete submissions and content itself in unrigid; Thothica passes on any request it receives directly, without answering it, unless the Customer asks;
• meet its security, breach notification, impact assessment and prior consultation duties (GDPR Arts. 32 to 36).

8. Personal data breaches

Thothica notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting Customer Personal Data, with what it knows: the nature of the breach, the categories and approximate numbers of people and records, likely consequences, and measures taken or proposed. It updates the Customer as it learns more. [The 48 hours leaves the Customer time for GDPR's 72-hour notice to its regulator.] DPDP places the duty to tell the Board and affected people on the Data Fiduciary; Thothica will help the Customer do so.

9. Deletion at the end

When a website is deleted, or the Terms end, Thothica deletes Customer Personal Data as set out on How unrigid handles data: the website goes offline at once; its data is deleted within 30 days (48 hours after a refund request); backups expire within 90 days. Before then the Customer can export everything in JSON and CSV. Thothica keeps nothing longer unless the law requires it.

10. Audits and information

Thothica makes available the information needed to show compliance with this addendum and allows audits by the Customer or an auditor it appoints, on 30 days' written notice, at most once a year (more if a regulator requires or after a breach), during business hours, under confidentiality, and at the Customer's cost. Thothica may answer first with written responses and existing reports.

11. International transfers

Thothica is in India and its sub-processors process data in the locations listed on the data-practices page. Where Customer Personal Data subject to the GDPR (or UK or Swiss law) is transferred to Thothica or onward to a country without an adequacy decision, the parties agree to the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914): Module 2 (controller to processor) between the Customer and Thothica, and Module 3 (processor to processor) where applicable, with the UK Addendum for UK data; they are incorporated by reference. [Reviewer: fill the SCC annexes and choices: Clause 7 docking, Clause 9 option 2 (general authorisation, 30 days), Clause 11 no independent dispute body, Clause 17 governing law (Ireland suggested), Clause 18 courts.] Transfers outside India follow any restriction the Government of India notifies under DPDP s.16.

12. Liability and precedence

Liability under this addendum is subject to the limits in the Terms, except where the law forbids. If this addendum conflicts with the Terms on data protection, this addendum wins; if the SCCs conflict with either, the SCCs win.