Data processing agreement
This Data Processing Agreement ("DPA") is part of the Terms and conditions between Threat Expert Cyber Solutions, Bhamashah Techno Hub, Malviya Nagar, Jaipur, Rajasthan 302017, India ("ExpertComply", "we") and the organisation that uses ExpertComply ("Customer", "you"). It applies whenever we process personal data on your behalf inside your GRC or VAPT workspace. It meets the requirements of section 8(2) of India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and article 28 of the GDPR. You accept it when you accept the Terms. If you need a signed copy, write to [email protected]. Our Data Protection Officer is Niranjan Dadhich, reachable at the same address.
1. Roles
For personal data in your workspace ("Customer Personal Data"), you are the Data Fiduciary (DPDP Act) and controller (GDPR); we are your Data Processor and processor. You are responsible for having a lawful basis, giving notice to the people concerned and the accuracy of what you enter.
2. What we process
| Subject matter | Hosting and running the ExpertComply GRC and VAPT service for you |
|---|---|
| Duration | The term of your subscription, plus the read-only and deletion periods in section 8 |
| Nature and purpose | Storing, organising, displaying, analysing (including scanning targets you verify), backing up, exporting and deleting data, to provide and support the Service |
| People concerned | Your employees, contractors, auditors and others you name in the workspace (for example risk owners or policy approvers); people whose data appears in evidence files you upload |
| Types of data | Names, work contact details, job roles, notes and comments, evidence files and whatever else you choose to upload; for VAPT, scan targets and findings. You should not upload sensitive data unless your work requires it. |
3. Our duties
- Process Customer Personal Data only on your documented instructions (the Terms, this DPA and how you use the Service), unless the law requires otherwise; we will tell you if we think an instruction breaks the law.
- Make sure everyone who can access it is bound by confidentiality.
- Keep the security measures in Annex 2, and improve them over time without lowering protection.
- Help you answer requests from people using their rights, through the export and deletion tools in the Service and by forwarding requests we receive about your workspace.
- Help you with security, breach notification, impact assessments and consultations with authorities, taking into account the information we have.
- Give you the information needed to show we meet this DPA, and allow audits as in section 9.
- Never sell Customer Personal Data or use it for our own purposes, including to train AI models.
4. Sub-processors
You authorise the sub-processors in Annex 1. We bind each one to data protection terms at least as protective as this DPA and remain responsible for them. We will tell account owners by email at least 30 days before adding or replacing a sub-processor that handles Customer Personal Data. You may object on reasonable data protection grounds within that time; if we cannot address the objection, you may end the affected subscription and get a pro-rata refund of prepaid fees.
5. Support access
Our support staff cannot see your workspace unless an account owner approves a time-limited request in the app. Emergency ("break-glass") access is limited to 4 hours, needs a security administrator, and is shown to you straight away. All access is logged.
6. Personal data breaches
We will tell you without undue delay, and no later than 48 hours after we become aware of a breach affecting Customer Personal Data, so that you can meet your own deadlines (72 hours under the DPDP rules and the GDPR). We will give you what we know: what happened, when, the data and people involved, likely consequences, what we have done and a contact point, and keep you updated. Telling you is not an admission of fault.
7. International transfers
Customer Personal Data is stored on our servers and may be processed by the sub-processors in Annex 1 in other countries. We will follow any restriction the Government of India places under section 16 of the DPDP Act. Where the GDPR or UK GDPR applies and data is transferred to a country without an adequacy decision, the European Commission's Standard Contractual Clauses (Decision 2021/914, Module 2 controller to processor, and Module 3 processor to processor for onward transfers) and the UK International Data Transfer Addendum apply and are incorporated by reference, with you as data exporter and us as data importer. For those clauses: clause 7 (docking) applies; clause 9 option 2 (general authorisation, 30 days' notice) applies; clause 11 optional language does not apply; clause 17 and 18 choose the law and courts of Ireland; Annex I and II are sections 2 to 4 and Annex 2 of this DPA.
8. Return and deletion
You can export your workspace at any time while your account is active or read-only. When a subscription ends, the workspace is read-only for 60 days and then deleted 180 days later; account owners are warned 30 and 7 days before. An account owner can also delete the whole company from Your account › Privacy and your data; it is erased after a 7-day window in which it can be cancelled. Backups are overwritten within 14 days. We keep invoices and audit logs only as long as the law requires.
9. Audits
On request we will answer reasonable security questionnaires and share relevant summaries of our controls. If that is not enough to show compliance, or an authority requires it, you may audit us once a year, at your cost, with 30 days' notice, during business hours, under confidentiality, and without access to other customers' data.
10. Other terms
Liability under this DPA is subject to the limits in the Terms, except where the law does not allow it. If this DPA and the Terms conflict on data protection, this DPA wins; if the Standard Contractual Clauses apply and conflict with either, the Clauses win. This DPA ends when we have deleted all Customer Personal Data.
Annex 1: Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Hostinger | Server hosting and storage | Hostinger data centre |
| Cloudflare, Inc. | Network security, HTTPS, attack protection | Global |
| Our email provider | Sending service emails | India or abroad |
| Anthropic, PBC | AI model for Advisor answers, only for text users send to the Advisor | United States |
| Meta Platforms (WhatsApp Business Platform) | WhatsApp messages, only for users who turn them on | Global |
Razorpay processes payment data as an independent payment provider, not as our sub-processor for workspace data.
Annex 2: Security measures
- Encryption in transit: HTTPS everywhere, with HSTS; Cloudflare in front with strict certificate checking.
- Access control: role-based access for customers (GRC admin, editor, viewer; VAPT roles) and staff (separate owner, operations, security, billing roles); no single all-powerful account.
- Authentication: passwords of at least 10 characters stored with scrypt; two-step sign-in available to everyone and required for admin staff; short admin sessions; optional admin IP allow-list; sign-in rate limits; new-device alerts.
- Separation: GRC and VAPT keep separate data stores; each customer's workspace and evidence files are kept apart.
- Support access: only with customer approval, time-limited and logged.
- Logging: append-only, hash-chained audit logs of customer, staff and pricing actions; access logs kept at least one year.
- Resilience: daily backups kept 14 days; atomic writes; a documented breach response process.
- Application security: Content Security Policy, anti-framing and other security headers, CSRF protection, input limits, no third-party scripts except Razorpay's checkout and one PDF library served by Cloudflare.
- People: confidentiality duties for staff; access only where needed.