Data Processing Agreement (DPA)

1Legal Roles & Purpose

This Data Processing Agreement ("DPA") governs data processing operations performed by Aveda Technologies on behalf of enterprise customers utilizing HRMS, CRM, and SaaS automation platforms.

The Customer acts as Data Fiduciary (Data Controller) determining processing purposes. Aveda Technologies acts as Data Processor (Data Processor) executing services under customer instructions.

2Scope of Processing

Aveda Technologies processes personal and business data solely to deliver the contracted SaaS features, maintain system integrity, prevent fraud, provide technical support, and ensure security.

3Technical & Organizational Security Safeguards

We maintain appropriate security controls including:

• Role-Based Access Control (RBAC) and Multi-Factor Authentication
• Data encryption in transit (TLS 1.3) and at rest (AES-256)
• Continuous security monitoring, vulnerability scanning, and audit logging
• Automated database backups and disaster recovery protocols

4Sub-Processor Management

Aveda Technologies engages vetted sub-processors for cloud hosting (AWS/Google Cloud), payment aggregation (Razorpay), and communication channels (WhatsApp API). Sub-processors are bound by strict data protection terms.

5Security Incident Notification & Response

In the event of a confirmed security breach impacting customer personal data, Aveda Technologies will notify affected customers without undue delay and take swift remedial action as required by Indian law.

6Termination & Data Return / Deletion

Upon contract expiration or account termination, customer data will be deleted or returned in accordance with contractual terms and statutory retention requirements.