Data Processing Addendum

This Data Processing Addendum (DPA) forms part of the Terms of Service between CoreOctal (Processor, we) and the Customer (Data Fiduciary in the sense of the Digital Personal Data Protection Act, 2023). It applies whenever the Customer uses Tile Stage to process personal data of its own staff, customers, prospects or other persons (Customer Personal Data).

1. Roles

The Customer decides why and how Customer Personal Data is processed and is the data fiduciary for it. We process it only to provide the service as the Terms and this DPA describe and are the Customer's data processor. For the account data of the Customer's users and for security records we are the data fiduciary (see the Privacy Policy).

2. Scope of processing

Subject matter: hosting, storing, rendering and displaying Customer Personal Data entered into the service (names, contact details and project details typed into brochures and profiles; names and e-mails of invited users). Duration: the term of the agreement plus the deletion period. Nature: storage, display, generation of PDFs, backups. Categories of persons: the Customer's staff, customers, prospects, contacts. No special categories are intended.

3. Our obligations

We process Customer Personal Data only on the Customer's documented instructions (the use of the service is the instruction), keep it confidential, apply the security measures in section 5, assist the Customer in answering data-principal requests and in meeting its obligations under the DPDP Act, keep records of processing, notify the Customer without undue delay and in any case within 72 hours after becoming aware of a personal data breach affecting Customer Personal Data (with what is known about its nature, likely consequences and the measures taken), and delete or return the data as section 7 provides.

4. Sub-processors

The Customer authorises the categories of sub-processor described in the Privacy Policy (cloud hosting, content delivery and security, payments, e-mail delivery); the current list is available on request at —. We notify Customers of a new sub-processor at least 30 days before it processes Customer Personal Data; a Customer with a reasonable objection may terminate the affected service with a pro-rata refund. Each sub-processor is bound by written terms no less protective than this DPA.

5. Security

Encrypted connections; passwords never stored in readable form; two-factor authentication; encryption at rest for secrets; operator access limited to the role's needs and logged; monitoring and protection against copying and automated use; regular backups; timely security updates; the operations console separated from the customer-facing service. We review these measures periodically.

6. Audits

Once in any 12 months, on 30 days' notice, the Customer may ask for written evidence of our compliance with this DPA (policies, configurations, the records relating to its data). An on-site audit may be agreed where a regulator requires it, at the Customer's cost and without access to other Customers' data.

7. Return and deletion

For 30 days after termination the Customer may export its content and brochures. We then delete Customer Personal Data within 90 days, except what the law requires us to keep and backups that expire on their own schedule. On request we confirm the deletion in writing.

8. Transfers

Customer Personal Data is stored in India. Where a sub-processor operates outside India, the transfer complies with the DPDP Act and the Government of India's notifications.

9. Liability and precedence

Liability under this DPA is governed by the limitation in the Terms. Where this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails. Questions: —.