Data Processing Agreement (Draft)

How customer data is processed on a Retailer's behalf, summarized for review.

Draft for legal review. Which party is the Data Fiduciary and which is the Data Processor for a given category of data, under the Digital Personal Data Protection Act, 2023 and its rules, depends on the actual facts of who determines the purpose and means of processing - this draft does not make that determination for you. Have this reviewed by a qualified Indian data-protection lawyer before relying on it, and revisit it once the DPDP Act Rules commence in full and their requirements are confirmed.

1. Roles

The Retailer and EMI Guard will identify, based on their actual activities, which of them is the Data Fiduciary and which (if applicable) is acting as a Data Processor for each category of customer data processed through the platform.

2. Permitted processing purposes

Customer data may only be processed for the purposes disclosed in the Privacy Policy and Customer Consent Policy - EMI sale management, payment tracking, authorized device management, reminders, support and legal compliance.

3. Data access restrictions

Access to a Retailer's customer data is restricted to that Retailer's own account and to EMI Guard personnel who need it to operate or support the platform.

4. Security obligations

Both parties will apply reasonable security safeguards appropriate to the data processed, as described in the Information Security Policy.

5. Sub-processors and hosting arrangements

Any hosting or infrastructure sub-processor engaged by EMI Guard is bound by confidentiality and data-protection obligations at least as protective as this Agreement.

6. Breach notification and cooperation

Each party will notify the other without undue delay on becoming aware of a data breach affecting the other's customers, and will cooperate on investigation, containment and any legally required notifications.

7. Retention and deletion

Data is retained and deleted in line with the Data Retention Policy, unless the parties agree otherwise in writing for a specific requirement.

8. Customer rights requests

A request from a customer to access, correct or erase their data is routed to the Retailer in the first instance (as the party with the direct customer relationship), with EMI Guard providing the technical means to fulfil it.

9. Data export and termination arrangements

On termination of the Retailer's subscription, EMI Guard will make the Retailer's own customer and sale data available for export for a reasonable period before deletion, as described in the Retailer Service Agreement.