This page sets out the standard Data Processing Agreement ("DPA") that applies when VDHOSTS INTERNET PRIVATE LIMITED ("VD Hosts", "Processor") processes personal data on behalf of a client ("Client") under a Service Agreement. It forms part of the Service Agreement where the Service Agreement refers to it, or where the parties sign it. A signed copy can be requested from contact@vdhosts.com.
1. Roles
The Client is the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (and the controller or "business" under other laws). VD Hosts is the Data Processor (processor or "service provider") and processes personal data only on the Client's documented instructions, which include the Service Agreement and this DPA.
2. Scope of processing
The subject matter, nature, purpose and duration of processing, the categories of personal data and the categories of data principals are described in the Service Agreement or statement of work. VD Hosts will not process personal data for its own purposes, sell it, or combine it with data from other sources except as instructed.
3. Processor obligations
- Confidentiality: personnel with access are bound by confidentiality obligations and receive security training.
- Security: VD Hosts implements reasonable security safeguards appropriate to the risk, including access control with multi-factor authentication, encryption in transit, logging, backups and vulnerability management, consistent with the IT Act 2000 / SPDI Rules and good industry practice.
- Sub-processors: VD Hosts may engage sub-processors bound by written terms at least as protective as this DPA. A list is available on request, and the Client is notified of material changes with an opportunity to object on reasonable grounds.
- Assistance: VD Hosts assists the Client, taking into account the nature of processing, with data principal requests, security, breach notification and impact assessments.
- Breach notification: VD Hosts notifies the Client without undue delay after becoming aware of a personal data breach affecting Client data, and in any case in time for the Client to meet its obligations to the Data Protection Board of India, CERT-In (within six hours where the CERT-In Directions apply) and other regulators.
- Deletion or return: at the end of the services, VD Hosts deletes or returns Client personal data as the Client chooses, unless retention is required by law.
- Audit: VD Hosts makes available information reasonably necessary to demonstrate compliance, and allows audits on reasonable notice, at the Client's cost, subject to confidentiality and security of other clients.
4. International transfers
Personal data is transferred outside India only as permitted under the DPDP Act and any restrictions notified under it. For personal data from the EEA or UK, the parties rely on standard contractual clauses or another valid transfer mechanism.
5. US state privacy laws
Where the CCPA or similar state laws apply, VD Hosts acts as a "service provider" or "processor", will not sell or share the personal information, will not retain, use or disclose it outside the direct business relationship, and will comply with the applicable obligations and provide the same level of privacy protection.
6. Liability and precedence
Liability under this DPA is subject to the limitations in the Service Agreement, except where the law does not allow limitation. If this DPA conflicts with the Service Agreement on data protection, this DPA prevails.