Data Processing
Agreement.

Last updated: 28 September 2026. This DPA forms part of our Terms of Service and applies whenever we process personal data on behalf of our clients.

1. 01

   Scope and Parties

   This Data Processing Agreement ("DPA") is entered into between Nerdtech Softwares LLP, a limited liability partnership registered in India ("NerdTech", "Processor", "we" or "us"), and the client that has entered into an Agreement with us ("Client" or "Controller"). It forms part of our Terms of Service and each Agreement (as defined in the Terms of Service).

   This DPA applies whenever NerdTech processes Client Personal Data on behalf of the Client in the course of providing the Services, including designing, developing, testing, migrating, hosting, maintaining and supporting software. If this DPA conflicts with the Terms of Service or an Agreement on a data protection matter, this DPA prevails.

2. 02

   Definitions

   "Applicable Data Protection Law" means all data protection and privacy laws that apply to the processing of Client Personal Data, including, where applicable, the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA").

   "Client Personal Data" means any personal data that NerdTech processes on behalf of the Client under an Agreement. "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Client Personal Data. "Sub-processor" means any third party engaged by NerdTech to process Client Personal Data.

   The terms "controller", "processor", "data subject" and "processing" have the meanings given in the GDPR, and include the equivalent terms "data fiduciary" and "data processor" under the DPDP Act and "business" and "service provider" under the CCPA.

3. 03

   Roles and Processing Instructions

   The Client is the controller of Client Personal Data and NerdTech is its processor. The Client is responsible for ensuring that it has a lawful basis for the processing and has given any notices and obtained any consents required under Applicable Data Protection Law.

   NerdTech will process Client Personal Data only on the Client's documented instructions, which consist of the Agreement, this DPA and any further written instructions from the Client, unless required to do otherwise by law, in which case we will inform the Client before processing unless the law prohibits it. We will promptly inform the Client if, in our opinion, an instruction infringes Applicable Data Protection Law.

   Where the CCPA applies, NerdTech acts as a service provider and will not sell or share Client Personal Data, retain, use or disclose it for any purpose other than performing the Services, or combine it with personal data we receive from other sources, except as permitted by the CCPA.

4. 04

   Details of Processing

   Subject matter and duration: the performance of the Services, for the term of the Agreement and until Client Personal Data is returned or deleted under Section 12.

   Nature and purpose: software design, development, testing, data migration, hosting, maintenance, technical support and related services described in the Agreement.

   Categories of data subjects: as determined by the Client, and may include the Client's employees, contractors, customers, end users, students, parents and patients.

   Categories of personal data: as determined by the Client, and may include contact details, account and login data, transaction data, usage and device data, and any other personal data contained in the Client's systems. Special categories of personal data (such as health data) will be processed only if the Client has told us in writing and both parties have agreed any additional safeguards required.

5. 05

   Confidentiality of Personnel

   NerdTech will ensure that everyone it authorises to process Client Personal Data is bound by written confidentiality obligations or a statutory duty of confidentiality, and receives appropriate data protection training. Access is limited to personnel who need it to perform the Services.

6. 06

   Security Measures

   NerdTech will implement and maintain appropriate technical and organisational measures to protect Client Personal Data, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing and the risks to data subjects.

   These measures include: (a) encryption of data in transit using TLS, and encryption at rest for environments we host; (b) access control based on least privilege, individual accounts, multi-factor authentication and prompt revocation of access; (c) separation of development, testing and production environments, and use of anonymised, masked or synthetic data for development and testing wherever feasible, with production personal data used outside production only with the Client's written authorisation; (d) secure development practices, including code review and dependency vulnerability scanning; (e) logging and monitoring of access to production systems; (f) regular backups for environments we host; and (g) security requirements for staff devices.

7. 07

   Sub-processors

   The Client gives NerdTech general authorisation to engage Sub-processors, such as cloud hosting, email and infrastructure providers. A current list of Sub-processors for the Client's project is available on request.

   We will notify the Client at least 14 days before adding or replacing a Sub-processor. The Client may object on reasonable data protection grounds within that period, in which case the parties will discuss the objection in good faith; if they cannot resolve it, the Client may terminate the affected Services.

   We will impose data protection obligations on each Sub-processor that are no less protective than those in this DPA, and we remain liable to the Client for the performance of each Sub-processor's obligations.

8. 08

   International Data Transfers

   NerdTech is based in India, and Client Personal Data may be processed in India and in the countries where our Sub-processors operate. Where Client Personal Data is transferred from the European Economic Area, the United Kingdom or Switzerland to a country that has not been recognised as providing an adequate level of protection, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor) or Module Three (processor to processor) as applicable, are incorporated into this DPA by reference, together with the UK International Data Transfer Addendum and any amendments required under Swiss law.

   For the Standard Contractual Clauses: the optional docking clause (Clause 7) applies; Option 2 (general authorisation) of Clause 9 applies with the notice period in Section 7; the optional language in Clause 11 does not apply; and the governing law and forum under Clauses 17 and 18 are those of Ireland. A signed copy of the Standard Contractual Clauses is available on request.

9. 09

   Assistance to the Client

   Taking into account the nature of the processing, NerdTech will provide reasonable assistance to the Client in responding to requests from data subjects to exercise their rights, and will promptly, and in any event within 5 business days, forward to the Client any such request we receive directly, without responding to it except as instructed.

   We will also provide reasonable assistance with the Client's data protection impact assessments, prior consultations with supervisory authorities, and security obligations, to the extent they relate to our processing. Assistance beyond what is reasonably required may be charged at our standard rates.

10. 10

    Personal Data Breaches

    NerdTech will notify the Client without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Client Personal Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it, and we will provide further information as it becomes available.

    We will take reasonable steps to contain and remediate the breach and cooperate with the Client so that it can meet its own notification obligations to supervisory authorities and data subjects. Notification of a breach is not an acknowledgement of fault or liability.

11. 11

    Audits

    NerdTech will make available to the Client the information reasonably necessary to demonstrate compliance with this DPA. The Client may, no more than once in any 12-month period (or more often if required by a supervisory authority or following a Personal Data Breach), audit our compliance with this DPA on at least 30 days' written notice, during normal business hours, at the Client's cost, subject to reasonable confidentiality and security requirements. We may satisfy an audit request by providing independent assessment reports or detailed written responses where these are sufficient.

12. 12

    Return and Deletion of Data

    When the Services end, NerdTech will, at the Client's choice, return Client Personal Data in a commonly used format or delete it, within 30 days, and delete existing copies, unless retention is required by law. Any data retained for legal reasons will remain protected by this DPA and will be processed only for the purpose requiring its retention.

13. 13

    Liability and Governing Law

    Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service or the Agreement, except where Applicable Data Protection Law or the Standard Contractual Clauses provide otherwise.

    This DPA is governed by the law and dispute resolution provisions of the Terms of Service or the Agreement, except that the Standard Contractual Clauses are governed by the law specified in them.

14. 14

    Contact

    Privacy and data protection contact: Sachin Pandit, Nerdtech Softwares LLP, India. Email: contact@nerdtech.in. Phone: +91 9405649047.