This Data Processing Addendum ("DPA") forms part of the agreement between Easy Procure Technologies Pvt. Ltd. ("Easy Procure", "Processor") and the customer ("Customer", "Data Fiduciary") and governs the processing of personal data by Easy Procure on the Customer's behalf.
Roles of the parties
For personal data processed through the platform on the Customer's instructions, the Customer acts as the Data Fiduciary and Easy Procure acts as a Data Processor under India's Digital Personal Data Protection Act, 2023.
Scope and purpose of processing
Easy Procure processes personal data only:
- To provide the platform and related services
- In accordance with the Customer's documented instructions
- As required to comply with applicable law
The subject matter is the operation of supply chain and GST compliance workflows. The categories of data subjects and personal data are those the Customer chooses to process through the platform.
Sub-processors
Easy Procure engages vetted sub-processors (for example, hosting, email delivery, analytics, and licensed GSPs) to support the service. We impose data protection obligations on sub-processors consistent with this DPA, and we remain responsible for their performance. A current list is available on request, and we will give notice of material changes.
Security measures
Easy Procure implements appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, audit logging and an event-sourced data model that supports traceability. Further detail is on our Security page.
Data subject requests
Easy Procure will, to the extent the Customer cannot do so through the platform itself, provide reasonable assistance to help the Customer respond to requests from data principals to exercise their rights.
Personal data breach
Easy Procure will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data, and will provide information reasonably required to support the Customer's own notification obligations.
International transfers
Where personal data is transferred outside India, Easy Procure will ensure such transfers comply with applicable law and that appropriate safeguards are in place.
Return and deletion
Upon termination of the services, Easy Procure will, at the Customer's choice, return or delete personal data, except where retention is required by law.
Audits
Easy Procure will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for audits consistent with the underlying agreement.
Contact
To execute a signed copy of this DPA or with any questions, contact admineasyprocure@gmail.com.