Data Processing Agreement

This Data Processing Agreement (“DPA”) establishes a legally binding relationship between Strandify Solutions, acting as the “Data Processor,” and the entity agreeing to these terms, acting as the “Data Controller.”This Agreement governs the Processor’s handling of Personal Data in connection with the payment solutions services provided.

Roles and Responsibilities

Data Controller:

  • Defines the purposes and lawful grounds for processing Personal Data.
  • Ensures all processing activities comply with applicable Data Protection Laws.

Data Processor:

  • Processes Personal Data strictly according to the Controller’s documented instructions.
  • Uses Personal Data exclusively to deliver payment solutions services.

Scope of Data Processing

The Processor will process Personal Data only for the following purposes:

  • Initiating, authorizing, and settling payment transactions.
  • Conducting KYC verification and preventing fraud.
  • Authenticating customers, including via two-factor authentication (2FA).
  • Preparing transaction reports and performing reconciliations.
  • Ensuring compliance with RBI, NPCI, and other applicable payment network regulations.

Security Measures

The Processor commits to implementing appropriate technical and organizational safeguards, including:

  • Encryption of Personal Data at rest and in transit.
  • Multi-factor authentication for system access.
  • Secure key management protocols.
  • Routine penetration testing and vulnerability assessments.

Additionally, the Processor shall:

  • Enforce confidentiality obligations for all personnel.
  • Provide staff training on data protection and security best practices.

Support for Data Subject Rights

The Processor will assist the Controller in facilitating Data Subject rights under applicable law, including:

  • Right of access
  • Right to rectification
  • Right to erasure
  • Right to data portability
  • Right to restrict or object to processing

Subprocessors

  • The Processor will not engage any Subprocessor without the prior written consent of the Controller.
  • Any authorized Subprocessor must enter into agreements ensuring data protection safeguards at least equivalent to those in this DPA.

Data Breach Notification

In the event of a Personal Data breach, the Processor will notify the Controller within 24 hours of detection, providing:

  • Nature of the breach
  • Categories and approximate number of affected Data Subjects
  • Actions taken to contain and mitigate the breach
  • Measures planned to prevent recurrence

Audits and Compliance

The Controller may conduct audits with reasonable prior notice to verify adherence to this DPA.

Data Retention and Disposal

  • Personal Data will be retained only as long as required for payment processing and legal compliance, including RBI-mandated retention periods.
  • Upon service termination, the Processor will securely erase or return all Personal Data unless retention is legally required.

Regulatory and Legal Updates

The Processor shall promptly inform the Controller of any legal or regulatory changes that may affect the ability to process Personal Data in compliance with this DPA.

Liability and Indemnification

  • Each Party is responsible for damages arising from its own breach of this Agreement.
  • The Processor shall indemnify the Controller against any penalties, claims, or losses resulting from non-compliance with data protection obligations.

Governing Law and Jurisdiction

  • This DPA is governed by Indian law.
  • All disputes arising under this Agreement fall under the exclusive jurisdiction of Indian courts.

Amendments

Any modifications to this Agreement must be made in writing and signed by both Parties.

Confirmation

By entering into this DPA, both Parties confirm that they have read, understood, andaccepted all the terms and conditions outlined in this Agreement.