Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Zaptium Technologies LLP, a limited liability partnership incorporated in India (LLPIN ACZ-6920), with its registered office at P.No. 60, Manglam City Ext, Hathoj, Jaipur, Rajasthan 302012, India (GSTIN 08AAEFZ5141R1ZG; PAN AAEFZ5141R) ("Zaptium", "Processor") and the business subscribing to the Zaptium service ("Controller"). It sets out the terms on which Zaptium processes personal data on the Controller's behalf when the Controller uses Zaptium to run Instagram comment and direct-message automations, including lead capture.

This DPA is entered into to satisfy Section 8(2) of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), which permits a Data Fiduciary to engage a Data Processor only under a valid contract. Where this DPA conflicts with the Terms & Conditions, this DPA prevails in respect of the processing of personal data.

1. Scope of this agreement

This DPA applies to all personal data that Zaptium processes on the Controller's behalf in the course of delivering the Zaptium service, including: personal data submitted by members of the public through Instagram automations configured by the Controller; the consent records generated by those automations; the message content processed to detect triggers and deliver replies; and personal data held in the Zaptium CRM in connection with those leads.

This DPA does not apply to personal data that Zaptium processes as a Data Fiduciary in its own right, including the Controller's own account, billing and support data. That processing is governed by Zaptium's Privacy Policy.

2. Definitions

Terms used in this DPA carry the meanings given to them in the DPDP Act. For the avoidance of doubt, and to assist readers familiar with other privacy frameworks:

• Controller means the Data Fiduciary under the DPDP Act — the party that determines the purpose and means of processing.
• Processor means the Data Processor under the DPDP Act — the party that processes personal data on the Data Fiduciary's behalf.
• Data Principal means the individual to whom the personal data relates. In the context of this service, the member of the public who interacts with the Controller's Instagram account.
• Board means the Data Protection Board of India.
• Lead data means the personal data submitted by a Data Principal in response to the questions the Controller has configured.
• Notice snapshot means the frozen, hashed copy of the consent notice as displayed to a specific Data Principal at a specific time.

3. Roles & responsibilities

The Controller determines the purpose and means of processing personal data collected through its Instagram automations. Zaptium acts solely as Processor and processes that data only on the Controller's documented instructions, which are given through the Controller's configuration of the service.

3.1 The Controller is responsible for

• Determining and accurately stating the purpose for which lead data is collected. The purpose the Controller configures is displayed verbatim to Data Principals.
• Determining which questions are asked and ensuring each is necessary for that purpose.
• Providing and maintaining its own privacy notice at a working URL, and ensuring that notice satisfies Rule 3 of the DPDP Rules, including the means by which a Data Principal may withdraw consent, exercise rights, and complain to the Board.
• Determining the retention period applicable to lead data.
• Using lead data only for the purpose for which the Data Principal gave consent, including after the data has been exported from Zaptium.
• Publishing the contact details of the person able to answer questions about its processing, as required by Rule 9.
• Publishing its grievance redressal mechanism and the period within which it will respond, as required by Rule 14.
• Its own obligations in respect of personal data breaches, including intimation to affected Data Principals and reporting to the Board.
• Responding to any request from a Data Principal that reaches the Controller directly.

3.2 Zaptium is responsible for

• Processing lead data only in accordance with the Controller's configuration and this DPA.
• Generating and displaying the consent notice from the Controller's configuration, so that the notice shown to a Data Principal always corresponds to the purpose and fields the Controller has configured.
• Recording consent only upon an explicit affirmative action by the Data Principal.
• Preserving consent evidence, including the notice snapshot.
• Collecting and storing only the fields the Controller has configured.
• Applying the security measures described in section 6.
• Providing a facility through which a Data Principal may view and delete their submitted data.
• Enforcing the Controller's configured retention period.
• Assisting the Controller as described in section 9.

3.3 Zaptium is not a Consent Manager

Zaptium is not registered as a Consent Manager under Rule 4 of the DPDP Rules and does not act, or represent itself as acting, in that capacity. Zaptium's consent-recording functionality is provided as part of the service to the Controller and does not constitute a Consent Manager service to Data Principals.

4. Processing details

4.1 Subject matter and duration

The subject matter of the processing is the capture, storage and management of lead data submitted through the Controller's Instagram automations. Processing continues for the duration of the Controller's subscription and, in respect of any individual lead, until the earlier of the expiry of the configured retention period, a deletion request from the Data Principal, or termination of this DPA.

4.2 Nature and purpose of processing

Display of the Controller's consent notice; recording of the Data Principal's consent action; collection of the Controller's configured fields from the Data Principal's replies, including automated extraction of field values; storage of lead data in the Zaptium CRM; provision of a data-management facility to the Data Principal; automated erasure at the end of the retention period; and maintenance of consent and processing records.

4.3 Categories of personal data

The categories of personal data are determined by the Controller's configuration and therefore vary. In all cases the processing includes the Data Principal's Instagram-scoped user identifier, an age declaration, and the language in which the notice was displayed. In addition, Zaptium processes the values of the fields configured by the Controller, which commonly include name, mobile number and email address.

The service may not be configured to collect the following categories, and Zaptium rejects values falling within them where they are detected in a Data Principal's reply: payment card details; Aadhaar numbers; other government-issued identity numbers; bank account or other financial account details; health or medical information; biometric or genetic data; or data revealing caste, religion, or sexual orientation.

Detection of these categories is automated, pattern-based, and provided on a best-efforts basis. It is not, and is not represented to be, exhaustive. Zaptium identifies these values by matching recognised formats and, where applicable, verifying checksums. A value expressed in an unusual or unanticipated format — for example written in words rather than digits, spaced or punctuated unusually, split across several messages, or in a format Zaptium does not yet recognise — may not be detected. Where a value is not detected it will be handled like any other free-text content, which may include being stored as a field value and being transmitted to the sub-processor identified in section 8 for automated extraction.

The Controller therefore must not configure the service to solicit these categories, whether directly or by asking a question that invites them, and remains responsible for the categories of personal data its configuration causes to be collected. Zaptium's detection is a safeguard against inadvertent submission, not a substitute for the Controller's own obligation to collect only what is necessary for the stated purpose.

4.4 Categories of Data Principals

Members of the public who interact with the Controller's Instagram account and who have declared themselves to be aged 18 or over.

4.5 Instructions

The Controller's configuration of an automation within the Zaptium service constitutes its documented instruction for the purposes of this DPA. Zaptium will not process lead data for any other purpose, and in particular will not use lead data for its own analytics, benchmarking, product development, aggregate reporting, or for training or fine-tuning any machine learning model.

If Zaptium considers an instruction from the Controller to be inconsistent with applicable law, Zaptium will inform the Controller without undue delay and may suspend performance of that instruction.

5. Zaptium's processing obligations

• Confidentiality. Zaptium will keep lead data confidential and will not disclose it to any third party except as permitted by this DPA or required by law.
• Requests from public authorities. Where a public authority demands lead data, Zaptium requires valid written legal process and verifies it independently, refuses or formally challenges a request that is not validly issued or that exceeds the authority's powers, discloses only the records compelled, and notifies the Controller unless prohibited by law. Because the Controller is the Data Fiduciary for lead data, Zaptium directs the authority to the Controller wherever the data can be obtained from them directly. Zaptium keeps a record of every such request and of its response, including the requests it refuses.
• Personnel. Zaptium will ensure that its personnel who may access lead data are bound by written confidentiality obligations, are granted access only where necessary for their role, and receive data-protection training on joining and at least annually thereafter.
• Access limitation. Zaptium personnel will access lead data only where necessary to provide, secure, support or maintain the service, or where required by law. Such access is logged.
• No secondary use. As set out in section 4.5, Zaptium will not use lead data for its own purposes.
• Accuracy. Zaptium provides mechanisms by which a Data Principal's submitted values are confirmed at the point of capture and validated against the configured field types, but does not verify the truthfulness of any value supplied.

6. Security measures

Zaptium applies the following technical and organisational measures, aligned to Rule 6(1) of the DPDP Rules. Zaptium may update these measures provided the overall level of protection is not reduced.

6.1 Data security measures — Rule 6(1)(a)

• Lead field values are encrypted at the application layer with AES-256-GCM, using a key held separately from the application database.
• Storage volumes, database instances and backups are encrypted at rest.
• Personal data is transmitted over TLS.
• Lead field values are masked in list views within the Zaptium CRM and revealed only on explicit action, which is logged.
• Where personal data is submitted to an automated extraction service, values that Zaptium detects are replaced with virtual tokens before submission, and detokenisation occurs locally. Detection is automated, pattern-based and applied on a best-efforts basis — a value in a format Zaptium does not recognise may be transmitted to that service in its original form. See section 4.3.

6.2 Access control — Rule 6(1)(b)

• Role-based access control, with each Controller's data logically isolated from that of every other Controller.
• Administrative access to Zaptium's internal tooling is restricted to Zaptium personnel authenticating through Zaptium's corporate identity provider on a Zaptium-controlled domain, subject to that provider's authentication policy.
• Least-privilege provisioning, with access removed on role change or departure.

6.3 Visibility and monitoring — Rule 6(1)(c)

• Processing and access events are logged, including consent grant and decline, field capture, CRM record view and edit, data export, deletion request and completion, and retention erasure.
• Logs record the event type, actor, reference identifiers, timestamp, and the IP address and browser of each request, and do not contain lead field values or message content.
• Logs are reviewed and monitored for indications of unauthorised access.

6.4 Continuity — Rule 6(1)(d)

Databases are backed up, and backups are encrypted at rest and retained on the rotation described in section 14.3. Files in object storage are not separately backed up; they rely on the storage provider's built-in redundancy.

6.5 Log retention — Rule 6(1)(e)

Zaptium retains processing and access logs for a minimum of one year for the purposes of detection, investigation and remediation.

6.6 Onward obligations — Rule 6(1)(f) and (g)

Zaptium imposes obligations on its sub-processors that are no less protective than those in this section, and maintains organisational measures including an information security policy and periodic review.

6.7 Data minimisation by design

• Only the fields configured by the Controller are stored as lead data. Other personal data in a Data Principal's reply is not extracted into lead records.
• Automated-extraction prompts and their responses are not retained after processing. Message content is stored so the Controller can see its conversations and so automations can follow them, and is deleted within 30 days of the Instagram account being disconnected or the Controller's workspace closing.
• Values falling within the excluded categories listed in section 4.3 are rejected where detected, and are then neither stored nor logged. Detection is best-efforts, as described in that section.

7. Consent records & evidence

For each Data Principal, Zaptium records: the age declaration; the exact notice displayed, stored as an immutable snapshot with a cryptographic content hash; the purpose as displayed; the fields consented to; the language of display; the timestamp; and the affirmative action taken.

Consent records are append-only. Where the Controller subsequently amends its configuration or privacy notice, existing consent records continue to reference the notice actually displayed to that Data Principal and are not altered.

Consent is recorded only on an explicit affirmative action by the Data Principal. Opening the Controller's privacy notice is not treated as consent, and no consent is recorded from a Data Principal's free-text reply.

Consent records and the associated notice snapshots are retained for three years after erasure of the related lead data, as evidence that consent was obtained and subsequently withdrawn or acted upon.

Zaptium will make consent records available to the Controller, and will provide them to the Controller on request for the purpose of responding to a Data Principal or to the Board.

8. Sub-processors

The Controller authorises Zaptium to engage the sub-processors listed below. Zaptium remains responsible for the performance of its sub-processors' obligations.

Google processes personal data submitted through Zaptium's paid API access under Google's applicable data processing terms, including the Google Cloud Data Processing Addendum where the service is accessed through Google Cloud, and does not use that data to train or improve its models. Zaptium may move between Google's access paths for this service without further notice under this section, as both are disclosed above and the recipient of the personal data is unchanged.

Zaptium will notify the Controller at least 30 days before adding or replacing a sub-processor. The Controller may object on reasonable data protection grounds within that period, in which case the parties will discuss the objection in good faith. If the objection cannot be resolved within 30 days of it being raised, the Controller may terminate the affected part of the service without penalty and receive a pro-rata refund of any fees paid in advance for the terminated part.

9. Data principal rights

Zaptium provides the following functionality to support the Controller's obligations under Chapter III of the DPDP Act:

• Access. Each Data Principal receives a link to a Zaptium-hosted page displaying the data they submitted, the purpose, the consent reference and the notice they were shown.
• Erasure. The Data Principal may delete their submitted data from that page. Deletion is applied across Zaptium's systems as described in section 14.
• Withdrawal of consent. In the current version of the service, withdrawal is effected together with erasure.
• Correction. The current version of the service does not offer field-level correction. A Data Principal may delete their submission and resubmit, or contact the Controller directly.
• Grievance and complaint. The page directs the Data Principal to the Controller's contact address and states that they may complain to the Board.

Zaptium acts on a deletion request received through this facility on the Controller's standing instruction. Where a request reaches Zaptium by any other route, Zaptium will refer it to the Controller without undue delay and will assist the Controller in responding. Zaptium will not otherwise respond to a Data Principal on the Controller's behalf.

Zaptium will respond to a request for assistance from the Controller within 7 days, or sooner where the Controller's own statutory deadline requires it and the Controller says so in the request.

Zaptium cannot delete the underlying Instagram conversation, which remains subject to Meta's own retention. This limitation is disclosed to Data Principals.

10. Children's data

The service is designed not to process the personal data of children. Before any notice is displayed, each Data Principal is asked to declare whether they are aged 18 or over. Where a Data Principal declares that they are under 18, no notice is displayed, no consent is recorded, and no configured field is collected. Zaptium does not offer a verifiable parental consent mechanism, and the service must not be configured or used in a manner intended to collect personal data from children.

The Controller must not use lead data captured through the service for any advertising or behavioural monitoring directed at children.

11. Personal data breach

Zaptium will notify the Controller of any personal data breach affecting the Controller's lead data without undue delay, and in any event within 24 hours of becoming aware of it. This period is set so that the Controller retains sufficient time to meet its own obligation under Rule 7 to report to the Board within 72 hours of becoming aware of the breach.

The notification will include, to the extent then known: the nature and extent of the breach; the categories and approximate number of Data Principals and records affected; the likely consequences; the measures taken or proposed; and a contact point for further information. Zaptium will provide further information as it becomes available.

Zaptium will cooperate with the Controller in investigating and remediating the breach and in preparing any intimation to affected Data Principals or report to the Board. Zaptium will not notify the Board or any Data Principal in respect of the Controller's data without the Controller's instruction, unless required to do so by law.

12. Data export by the Controller

The Controller may export lead data from the Zaptium CRM. Where it does so:

• Zaptium records the export, including the user who performed it, the time, and the records included.
• Zaptium shows a warning at the point of export that the data may be used only for the purpose each Data Principal consented to, and that use for any other purpose may breach the DPDP Act.
• Exports exclude records in respect of which consent has been withdrawn or erasure has been completed.

The Controller remains solely responsible for exported copies, including for using them only for the consented purpose, securing them, and deleting them when a Data Principal exercises erasure or when the retention period ends. Zaptium's erasure obligations under section 14 do not extend to copies held outside the Zaptium service.

13. International transfers

Lead data, message content, consent records and backups are stored in India (ap-south-1, Mumbai), with one exception: a lead CSV export is generated into Cloudflare's object storage, which does not offer storage fixed to India, and is deleted within a day of being generated. Every request to the service passes through Cloudflare's globally distributed network, which may handle it outside India on its way to Zaptium's servers in India.

The automated extraction, classification and answering functions described in section 4.2 may be processed outside India. Google commits to a machine-learning processing location only for certain regions and certain models; for the models and endpoints Zaptium uses, no commitment is given that inference occurs within India, and this remains the case whether the service is accessed through the Gemini API or through Google Cloud. Lead field values that Zaptium detects are replaced with opaque tokens before submission; detection is best-efforts as described in section 4.3, so an undetected value may be transmitted in its original form. Message content submitted for classification and answering is not tokenised at all, and may contain personal data supplied by the Data Principal in free text.

Publicly published bio-page content is served from a globally distributed content delivery network and may be cached outside India. Such content is public by design.

Zaptium makes these transfers in accordance with Section 16 of the DPDP Act and Rule 15 of the DPDP Rules, and will comply with any restriction the Central Government notifies in respect of transfers to a particular country or territory. Zaptium will notify the Controller before making any change to where lead data is processed, in accordance with section 8.

Zaptium personnel access lead data only from within India.

14. Retention & erasure

14.1 Retention period

Lead data is retained for the period configured by the Controller, measured from the basis the Controller selects. Zaptium erases lead data automatically at the end of that period and records the erasure. The retention period is displayed to the Data Principal in the consent notice.

14.2 Scope of erasure

Erasure, whether on expiry of the retention period or on a Data Principal's request, is applied to: the captured field values; notes, comments and activity records entered against the lead in the Zaptium CRM; tags and attributes; attachments; and derived search indexes and cached views.

The following are deliberately retained: consent records and notice snapshots as evidence, for the period stated in section 7; processing and access logs, which contain no lead field values; a minimal record that an erasure occurred; and export records.

14.3 Backups

Erasure is applied to live systems immediately. Backups are retained on a rolling 35-day cycle, after which they are destroyed; erased data therefore persists in backups for no more than 35 days and is not restored into live systems.

14.4 On termination

When the Controller's workspace is closed — because its account is deleted, or on termination under the Terms & Conditions — Zaptium erases the lead data within 30 days, save for the records identified in section 14.2 as deliberately retained. The Controller can export its lead data at any time while its workspace is active; Zaptium does not return lead data after the workspace has closed. A change of plan, including a paid plan lapsing to the free plan, is not a termination.

15. Records & audit

Zaptium maintains records of its processing sufficient to demonstrate compliance with this DPA, including consent records, processing logs and export logs.

Zaptium will make available to the Controller, on reasonable written request and no more than once in any twelve-month period, information reasonably necessary to demonstrate compliance with this DPA, including a description of its technical and organisational measures and any then-current third-party security assessment. The Controller will treat that information as confidential.

Where the information provided is not sufficient to demonstrate compliance, or where an audit is required by the Board or by applicable law, the Controller may request an audit by an independent third-party auditor who is not a competitor of Zaptium. Such an audit will be conducted on at least 30 days' written notice, during business hours, no more than once in any twelve-month period except where required by the Board, subject to confidentiality undertakings, and in a manner that does not interfere with Zaptium's operations or compromise the confidentiality of other customers' data. The Controller bears the cost of the audit unless it reveals a material breach of this DPA by Zaptium.

16. Term & termination

This DPA takes effect on the date the Controller first accepts it or begins using the service, whichever is earlier, and remains in effect for as long as Zaptium processes personal data on the Controller's behalf. Sections concerning consent evidence, log retention and confidentiality survive termination for as long as the relevant records are retained.

Zaptium may suspend or terminate the processing of lead data, or the affected part of the service, where the Controller's use of the service is, or Zaptium reasonably believes it to be, unlawful — including where the Controller configures the service to collect personal data from children, uses lead data for a purpose the Data Principal did not consent to, fails to maintain a working privacy notice, or instructs Zaptium to process data in a manner inconsistent with the DPDP Act. Zaptium will give the Controller notice and, where the matter is capable of being remedied, a reasonable opportunity to remedy it before suspending, except where immediate suspension is necessary to prevent ongoing unlawful processing or to comply with law.

Commercial terms, including limitation of liability, indemnities and governing law, are set out in the Terms & Conditions and are not addressed in this DPA. The limitation of liability in those Terms applies to claims arising under this DPA.

17. Contact

Requests for assistance under section 9, and any matter concerning a Data Principal, should be sent to privacy@zaptium.in.

Questions about the terms of this DPA, notices under section 8, and audit requests under section 15 should be sent to legal@zaptium.in.

Zaptium Technologies LLP (LLPIN ACZ-6920)
P.No. 60, Manglam City Ext, Hathoj, Jaipur, Rajasthan 302012, India