Data Processing Addendum (DPA) — DetailFlow

Between: the Customer identified in the DetailFlow subscription ("Studio", Data Fiduciary) And: [LEGAL ENTITY NAME] ("DetailFlow", Data Processor)

This DPA forms part of the DetailFlow Terms of Service and governs DetailFlow's processing of personal data on behalf of the Studio under the Digital Personal Data Protection Act, 2023 ("DPDP Act").

1. Roles

1.1. The Studio is the Data Fiduciary in respect of personal data of its end customers, staff, and contractors entered into the Service.

1.2. DetailFlow is a Data Processor acting only on the Studio's documented instructions, which are contained in this DPA, the Terms of Service, the Privacy Policy, and lawful use of the product configuration.

2. Subject Matter and Duration

2.1. Subject matter: processing of personal data in the course of providing the Service.

2.2. Duration: the term of the DetailFlow subscription plus the retention periods described in the Privacy Policy.

3. Nature and Purpose of Processing

Storing, transmitting, backing up, indexing, and displaying customer records, job history, photos, staff assignments, and payment flags to enable studio workflow management.

4. Types of Personal Data

Name, phone number, vehicle registration and details, service notes, photographs of vehicles, staff assignments, invoice metadata. The Studio must not enter sensitive personal data (financial account numbers, health data, biometrics, government IDs beyond what is strictly needed, etc.) into the Service.

5. Categories of Data Principals

Studio end customers, studio staff, studio contractors.

6. DetailFlow's Obligations

DetailFlow will:

• (a) process personal data only on the Studio's documented instructions and as required by law;
• (b) apply appropriate technical and organisational security measures (see the Privacy Policy);
• (c) ensure personnel with access are under confidentiality;
• (d) assist the Studio, at the Studio's reasonable request and cost, to respond to Data Principal requests under Sections 11–14 of the DPDP Act;
• (e) notify the Studio without undue delay after becoming aware of a personal data breach;
• (f) delete or return personal data at the end of the subscription, subject to retention permitted or required by law;
• (g) make available information reasonably necessary to demonstrate compliance with this DPA.

7. Sub-Processors

7.1. The Studio authorises DetailFlow to engage sub-processors listed at [SUB-PROCESSOR PAGE URL], including but not limited to Supabase, Vercel, Razorpay, and Meta/WhatsApp.

7.2. DetailFlow will impose data protection obligations on sub-processors substantially equivalent to those in this DPA.

7.3. DetailFlow will give at least 15 days' notice of new or replacement sub-processors. If the Studio reasonably objects on data protection grounds, the Studio may terminate the affected part of the Service and receive a pro-rata refund for the unused paid term.

8. Cross-Border Transfers

Personal data may be processed in jurisdictions outside India permitted under the DPDP Act. DetailFlow will implement contractual safeguards with sub-processors and act consistently with any restrictions notified by the Central Government.

9. Studio's Obligations

The Studio warrants that it has:

• (a) obtained lawful consent from end customers and staff before entering their data;
• (b) provided any notices required by the DPDP Act;
• (c) instructions and configuration that lawful;
• (d) authority to enter into this DPA on behalf of any affiliated entities whose data it uploads.

The Studio will not upload data it has no lawful basis to process.

10. Security Incidents

DetailFlow will notify the Studio without undue delay of any confirmed personal data breach affecting the Studio's data, providing available details to allow the Studio to meet its own notification obligations to the Data Protection Board and affected Data Principals.

11. Audits

Once per year, on 30 days' written notice, the Studio (or its independent auditor bound by confidentiality) may review DetailFlow's compliance with this DPA on a documentary basis. On-site audits are limited to cases where required by regulators and are at the Studio's cost.

12. Liability

Liability under this DPA is subject to the limitation of liability in the Terms of Service.

13. Termination and Return

Within 30 days of the end of the subscription, DetailFlow will delete Customer Data, except where retention is required by law or short-term backup rotation. Written confirmation of deletion is available on request.

14. Governing Law

This DPA is governed by the laws of India and is subject to the dispute resolution clause in the Terms of Service.

[This document is a skeleton for legal review.]