Data Processing Addendum (DPA)

1. Roles

For the personal data of call recipients, leads and contacts that you upload, connect or generate through the platform ("Customer Data"), you are the Data Fiduciary and Clicks Bazaar Pvt. Ltd. ("DigitalCallers") is the Data Processor. We process Customer Data only to provide the service described in the Terms and only on your documented instructions, which include your configuration of agents, scripts, campaigns, calling hours, integrations and retention settings in the dashboard.

For your own account data (your team's names, logins, billing details) we are the Data Fiduciary, as described in the Privacy Policy.

2. Nature and purpose of processing

3. Your obligations as Data Fiduciary

• You have a lawful basis (consent or a legitimate use permitted by the DPDP Act) for calling each person and for recording the call, and you give the notices the law requires, including in the script where applicable.
• You honour do-not-call preferences and TRAI's regulations for commercial communication; the platform's DND scrubbing and calling-hour windows assist you but do not replace your obligation.
• You respond to data subjects' requests about their data; we assist as set out in clause 7.
• You share Customer Data with us only through the platform's connectors (Google Sheets shared privately with our service account, Meta lead forms, CRM webhooks, CSV upload) and never by making a sheet or file public.

4. Our obligations as Data Processor

• Process Customer Data only on your instructions and only for providing the service; never sell it, never use it for advertising, never use it to train our own models.
• Keep it confidential; staff with access are bound by confidentiality and limited to what their role needs.
• Implement the security measures in clause 5.
• Engage sub-processors only under clause 6.
• Tell you without undue delay, and in any case within 72 hours of becoming aware, if a personal data breach affects your Customer Data, with what we know about its nature, scope and the steps taken; we will cooperate with your notification to the Data Protection Board of India and to affected individuals.
• Delete or return Customer Data at the end of the agreement under clause 8.
• Make available the information reasonably needed to demonstrate compliance with this DPA, and allow an audit under clause 9.

5. Security measures

• Hosting in India. Recordings, transcripts, leads and account data are stored on servers in India (Bengaluru region).
• Encryption in transit. TLS for the website, dashboard, API, webhooks and connector traffic; signed webhooks so your systems can verify origin.
• Redaction. Phone numbers, email addresses, Aadhaar and PAN patterns are removed from stored transcripts before they are saved.
• Separation. Customer Data is partitioned per account; agents hold a locked fact set per project so one customer's or project's data never surfaces in another's calls.
• Access control. Role-based access in the dashboard, an activity log of every change with the actor recorded, administrative access limited to named staff, and service-account credentials stored outside the application code.
• Retention controls. Per-account retention for recordings (default 90 days, configurable down to 7 days), per-recording deletion, and automatic purge after the retention period.
• Safe deletion. Soft-delete with a recovery window before permanent purge, so accidental deletions can be reversed and deliberate ones are final.
• Backups. Backups of the platform database are taken regularly (including before every deployment), retained for a limited period and covered by the same access rules.

6. Sub-processors

You authorise the sub-processors below, each engaged under terms that restrict them to providing their service. We will give account owners at least 15 days' notice by email before adding or replacing a sub-processor; if you object on reasonable data-protection grounds and we cannot resolve it, you may end the affected service without penalty.

Messaging providers you connect for WhatsApp or SMS follow-ups (for example a WhatsApp Business Solution Provider) are contracted by you directly and are your processors, not ours.

7. Assistance with data subject requests

If a call recipient contacts us, we will tell them which business called them where we can identify it and forward the request to you within 3 working days. On your request we will locate, export, correct or delete a person's records, recordings and transcripts within 7 working days, and add their number to your account's suppression list so they are not called again.

8. Return and deletion

You can export leads, outcomes, recordings and transcripts from the dashboard at any time during the agreement and for 30 days after it ends. After that period, or earlier on your written instruction, we delete Customer Data from live systems, and it falls out of backups on their normal cycle. We retain only what Indian law requires us to keep (for example invoice records), and nothing that identifies your call recipients.

9. Audit

Once a year, on 30 days' notice and at your cost, you (or an independent auditor bound by confidentiality) may review our processing of your Customer Data by written questionnaire, and by a remote or on-site inspection where a questionnaire is insufficient, during business hours and without disrupting the service. We will also provide the results of any third-party security assessment we hold.

10. Liability and precedence

The liability limits in the Terms of Service apply to this DPA. If this DPA conflicts with the Terms, the DPA prevails for matters of personal data protection.

11. Contact for data protection matters

Clicks Bazaar Pvt. Ltd., Gurugram, Haryana, India · support@digitalcallers.com (subject line: "DPA / data protection").