Data Processing Agreement

Version: 1.0

Parties:

Customer (Controller): The organization registering for Indusflo
Processor: [Your legal entity name]

This DPA forms part of the Terms of Service and applies when Customer processes personal data through Indusflo.

1. Subject matter

Processor provides multitenant industry management software. Customer determines purposes and means of processing personal data entered into the system.

2. Duration

From acceptance until deletion of Customer’s tenant data per the offboarding policy (6-month archive unless restored).

3. Nature and purpose of processing

Hosting, storage, backup, display, export, email notifications, and support of Customer’s operational and workforce data.

4. Types of personal data

Identification data, contact data, employment and attendance data, and other data Customer uploads.

5. Categories of data subjects

Customer’s employees, contractors, customers, and suppliers as entered by Customer.

6. Processor obligations

Processor shall:

1. Process only on documented instructions

2. Ensure confidentiality of personnel

3. Implement appropriate technical and organizational measures

4. Assist with data subject requests where feasible

5. Notify Customer without undue delay of personal data breaches

6. Delete or return data after termination

7. Make available information necessary to demonstrate compliance

8. Use subprocessors only with safeguards

7. EU/UK annex (when applicable)

Standard Contractual Clauses (Module 2 or 3 as appropriate) between Customer and Processor
Subprocessor notification with 30-day objection window where required
DPIA assistance on reasonable request for Enterprise plans

8. US notice

We do not sell personal information. Subprocessors are listed on request.

9. Security measures (summary)

Dedicated database per tenant
HTTPS, hashed passwords, audit logs
Role-based access
Daily backups

10. International transfers

Transfers outside the EEA/UK use SCCs or other lawful mechanisms described in this DPA.

11. Audit

Customer may request a summary security questionnaire annually.

12. Liability

Limited as in the Terms of Service. Nothing limits liability where it cannot be limited by law.

13. Governing law

Laws of the United Republic of Tanzania (operator domicile), unless mandatory local consumer law requires otherwise.

14. Acceptance

Acceptance via checkbox at registration constitutes agreement to this DPA version 1.0.