Data Processing Addendum

This Data Processing Addendum (the "DPA") forms part of, and is incorporated by reference into, the Terms of Service and any Engagement, proposal, or statement of work entered into between you ("Controller") and Sufyaan Studio ("Processor" or "the Studio"). It sets out the parties' respective obligations in respect of the Processing of Personal Data under the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR, the India Digital Personal Data Protection Act, 2023 ("DPDP"), the California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA"), and any other applicable data-protection law (the "Data Protection Law").

In the event of any conflict between this DPA and the Terms, this DPA shall prevail with respect to the Processing of Personal Data.

Capitalised terms not defined here have the meaning given in the GDPR. The following definitions apply:

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" has the meaning given in Article 4(2) GDPR, including any operation performed on Personal Data.
• "Data Subject" means an identified or identifiable natural person to whom Personal Data relates.
• "Sub-processor" means any natural or legal person engaged by the Processor to Process Personal Data on behalf of the Controller.
• "SCCs" means the Standard Contractual Clauses adopted by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, including the UK International Data Transfer Addendum where applicable.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data.

Subject matter: the Processing of Personal Data as required to deliver the Services described in the underlying Engagement.

Duration: the term of the Engagement plus a reasonable handover and deletion period not exceeding 90 days after termination, unless otherwise required by law.

Nature: the Studio typically Processes Personal Data in the following ways: (a) receiving and storing brief / contact form submissions, (b) hosting and operating websites and applications on behalf of the Controller, (c) providing analytics, SEO, and performance services, (d) maintaining communications, and (e) issuing and storing invoices.

Purpose: Processing is performed solely for the purposes set out in the Engagement and as further documented in this DPA. The Studio shall not Process Personal Data for any other purpose, including its own purposes, and shall not sell, rent, or trade Personal Data.

Categories of Data Subjects: typically include the Controller's end-users, prospects, customers, employees, contractors, and any other individuals whose Personal Data is contained in materials provided to the Studio in the course of the Engagement.

Categories of Personal Data: typically include identity and contact data (name, email, phone, address), professional data (role, company), technical data (IP address, device, browser, usage), and content provided by the Data Subject (form submissions, comments, files). Special categories of data (Art. 9 GDPR) are Processed only with the Controller's documented instruction and on a project-by-project basis.

The Studio shall:

1. Process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country or international organisation, unless required to do so by Union or Member State law to which the Studio is subject.
2. Ensure that persons authorised to Process Personal Data are committed to confidentiality or are under an appropriate statutory obligation of confidentiality.
3. Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as set out in Section 8 (TOMs).
4. Engage Sub-processors only with the prior specific or general written authorisation of the Controller, and inform the Controller of any intended changes concerning the addition or replacement of Sub-processors, giving the Controller the opportunity to object.
5. Taking into account the nature of the Processing, assist the Controller by appropriate technical and organisational measures, insofar as possible, in the fulfilment of the Controller's obligation to respond to requests for exercising the Data Subject's rights (Chapter III GDPR).
6. Assist the Controller in ensuring compliance with Articles 32 to 36 GDPR (security, breach notification, DPIA, prior consultation), taking into account the nature of the Processing and the information available to the Studio.
7. At the choice of the Controller, delete or return all Personal Data to the Controller after the end of the provision of services relating to Processing, and delete existing copies unless Union or Member State law requires storage.
8. Make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.
9. Notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach, providing the Controller with sufficient information to allow the Controller to meet its obligations under Articles 33 and 34 GDPR.

The Controller warrants and undertakes that:

• It has a valid legal basis under Article 6 GDPR (and Article 9 where special-category data is involved) for the Processing instructions it issues to the Studio.
• It has provided all required privacy notices to Data Subjects and obtained any necessary consents.
• The Personal Data provided to the Studio has been collected lawfully, fairly, and in a transparent manner.
• Its instructions to the Studio comply with applicable Data Protection Law.

The Controller provides a general authorisation for the Studio to engage the Sub-processors listed below. The Studio will notify the Controller in writing at least 30 days in advance of any intended addition or replacement of a Sub-processor, and the Controller may object on reasonable grounds related to data protection. The current Sub-processor list is also maintained and published at #sub-processor-list on this page.

The Studio enters into a written contract with each Sub-processor that imposes data-protection terms no less protective than those set out in this DPA. The Studio remains fully liable to the Controller for the performance of the Sub-processor's obligations.

Where Personal Data is transferred outside the European Economic Area, the United Kingdom, or India to a country not covered by an adequacy decision, the parties shall rely on the EU Standard Contractual Clauses (Decision 2021/914), the UK International Data Transfer Addendum, or other lawful safeguards, and the Studio shall conduct a transfer impact assessment.

The Module Two (Controller-to-Processor) clauses apply to transfers from a Controller in the EEA to the Studio as Processor. The Module Three (Processor-to-Processor) clauses apply to onward transfers from the Studio to its Sub-processors.

For transfers from the UK, the UK Addendum to the SCCs applies. For transfers from India, the parties shall rely on any cross-border transfer rules issued by the Central Government under Section 16 of the DPDP Act and the contractual safeguards above.

The Studio maintains the following TOMs, which are reviewed and updated at least annually:

The Controller may audit the Studio's compliance with this DPA no more than once per calendar year, on at least 30 days' prior written notice, during normal business hours, and in a manner that does not unreasonably interfere with the Studio's operations. The Studio may satisfy audit requests by providing a current SOC 2 Type II report, ISO 27001 certification, or equivalent independent third-party assessment. The Controller shall bear its own audit costs unless the audit reveals material non-compliance, in which case the Studio shall reimburse reasonable audit costs.

The Studio shall, taking into account the nature of the Processing, assist the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling the Controller's obligation to respond to requests for exercising Data Subject rights under Chapter III GDPR (access, rectification, erasure, restriction, portability, objection, automated decision-making). If the Studio receives a request directly from a Data Subject relating to the Controller's Personal Data, the Studio shall forward the request to the Controller without undue delay and shall not respond directly.

On termination of the Engagement, the Studio shall, at the Controller's written choice, return all Personal Data to the Controller or delete it, and delete any existing copies, unless Union, Member State, UK, Indian, or other applicable law requires storage. The Studio will confirm deletion in writing within 30 days. A reasonable extension may be agreed in writing for ongoing warranty, audit, or legal-hold purposes, not exceeding 12 months in total.

The parties' liability under this DPA is subject to the limitation of liability set out in the Terms, except that the parties' aggregate liability for fines issued by a competent supervisory authority and payable by either party shall be determined in accordance with the GDPR and any applicable local law. Nothing in this clause limits either party's liability for damages incurred by a Data Subject under Article 82 GDPR.

In the event of any conflict between this DPA, the Terms, and any executed proposal, the following order of precedence applies with respect to the Processing of Personal Data: (1) the executed proposal or statement of work, (2) this DPA, and (3) the Terms of Service. For matters not addressed in this DPA, the SCCs (where applicable) and the Terms shall apply.

This DPA is deemed accepted by both parties upon execution of an Engagement that incorporates it by reference, and may be countersigned (in counterpart or via electronic signature) at the Controller's request. Standard signature blocks:

For any data-protection question, request, or notification under this DPA, contact:

Sufyaan Studio — Data Protection
Email: dev.sufyaan@gmail.com
Subject line: "Data protection"