Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Organisation Terms between Scripteco Technologies Private Limited ("Processor", "Askofy") and the Customer ("Controller"). It applies whenever Askofy processes personal data on the Customer's behalf.

It is designed to meet:

• the Digital Personal Data Protection Act, 2023 and its Rules (India), where the Customer is the Data Fiduciary and Askofy a Data Processor
• Article 28 of the EU and UK GDPR, where the Customer is the controller and Askofy a processor
• US state privacy laws such as the CCPA/CPRA, where the Customer is the business and Askofy a service provider

Words such as "personal data", "processing" and "personal data breach" have the meaning given in the law that applies.

1. Scope

• Subject matter: providing the Askofy platform for awareness campaigns, quizzes, certificate levels and certificates.
• Duration: the term of the Organisation Terms, plus the deletion period in section 10.
• Data subjects: the Customer's employees, contractors, patients, visitors, students, caregivers and guests who take its campaigns, and its admins.
• Personal data: names, work or personal contact details, employee code, department, designation, location, occupation or stream, age group, gender, city, campaign answers, levels, scores, certificate codes and activity dates. No special-category or sensitive data is intended. The Customer must not configure campaigns to collect it.
• Purpose: delivering campaigns, scoring, certificates, emails, reminders, dashboards and exports, as the Customer instructs.

2. Instructions

Askofy processes this data only on the Customer's documented instructions, unless the law requires otherwise. The instructions are the Organisation Terms, campaign settings and the Customer's actions in the dashboard. We will tell the Customer if we believe an instruction breaks the law.

As a service provider under US state laws, Askofy will not:

• sell or share the data
• keep, use or disclose it outside the direct business relationship with the Customer
• combine it with data from other sources, except as those laws allow

3. Askofy's own purposes

Askofy may also, as an independent controller (Data Fiduciary):

• create anonymised and aggregated data that no longer identifies anyone, and use it for research and to improve campaigns, as the Research Data Policy sets out. Askofy will not attempt to re-identify it.
• keep certificate verification records, and process data to secure the service, prevent fraud and meet legal duties
• contact participants who separately opted in to Askofy's own updates

4. Confidentiality and staff

Only authorised staff who need access may process personal data, under a duty of confidentiality. Access to contact details is masked by default, and every reveal, export or deletion is logged with a reason.

5. Security

Askofy keeps appropriate technical and organisational measures, as required by DPDP law and Article 32 GDPR, including:

• encryption in transit and at rest
• row-level access control separating each organisation's data
• secure admin login (one-time email links or hashed passwords) and least-privilege access
• audit logs of staff access to personal data
• an email queue that keeps message copies only until they are sent, then deletes them on schedule
• automatic deletion of data on the schedule in the Privacy Policy
• optional server-side scoring for tamper-proof certificates
• backups, monitoring for unusual activity, and dependency updates

See Security.

6. Sub-processors

The Customer gives general authorisation for the sub-processors on the Sub-processors list. Askofy binds each to data-protection terms at least as protective as this DPA, and remains responsible for them.

We will give at least 15 days' notice, by email or on that page, before adding or replacing one. The Customer may object on reasonable data-protection grounds. If we cannot address the objection, the Customer may end the affected subscription and receive a pro-rata refund.

7. Helping the Customer

Askofy will:

• promptly pass on any request received directly from a data subject, and help the Customer respond to requests for access, correction, erasure, restriction, objection, portability, nomination and grievances, mainly through dashboard tools such as export and delete
• give the Customer the information it reasonably needs for data protection impact assessments and consultations with authorities
• provide what the Customer reasonably needs to show it complies with the applicable law

8. Personal data breach

Askofy will notify the Customer without undue delay, and in any case within 24 hours of becoming aware of a personal data breach affecting Customer data. This gives the Customer time to meet its own deadlines, such as 72 hours under GDPR and DPDP Rules.

We will provide what we know, including:

• the nature and likely impact of the breach
• the data and people affected
• the steps taken or planned

We will update the Customer as we learn more, and cooperate with notices to affected people and authorities. Askofy will also report to CERT-In within the time it requires.

9. International transfers

Data may be processed outside the country where it was collected, by Askofy in India and by the sub-processors listed. Transfers follow DPDP law and never go to a country the Government of India restricts.

For personal data from the EU, EEA, UK or Switzerland, the parties agree to the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), which are incorporated by reference:

• Module 2 (controller to processor), or Module 3 where the Customer is itself a processor
• clause 7 (docking) included; clause 9 option 2 (general authorisation, as in section 6)
• clause 11 optional wording not used
• clause 17: the law of Ireland; clause 18: the courts of Ireland
• the annexes are completed by this DPA, with the Sub-processors list and section 5 as the technical and organisational measures

For the UK, the UK International Data Transfer Addendum applies; for Switzerland, the necessary adaptations.

10. Deletion and return

• During the term, the Customer can export its data at any time.
• After the term ends, Askofy will delete or anonymise the Customer's personal data within 90 days. Backups expire on a rolling basis.
• The exceptions are data Askofy must keep by law, and certificate verification records kept as the Certificate Policy says.
• On request, Askofy will confirm deletion in writing.

11. Audits

Once a year, or after a personal data breach, the Customer may ask for:

• a written description of our safeguards, and
• answers to a reasonable security questionnaire.

On-site audits need 30 days' notice, must be at the Customer's cost, and are subject to confidentiality and our providers' rules.

12. Liability and precedence

Liability under this DPA is subject to the limits in the Organisation Terms, except where the law does not allow it. If this DPA conflicts with the Organisation Terms on data protection, this DPA prevails. If it conflicts with the Standard Contractual Clauses, the Clauses prevail.