Data Processing Agreement

1 Parties & Definitions

• "Controller" / "Data Fiduciary" — the Customer (organisation or individual) who has accepted our Terms of Service and uses WhizzMeet to process personal data.
• "Processor" / "Data Processor" — WhizzAct Private Limited, the entity processing personal data on behalf of the Controller.
• "Data Subjects" / "Data Principals" — individuals whose personal data is processed through WhizzMeet (e.g., meeting participants, employees).
• "Personal Data" — any information relating to an identified or identifiable natural person processed via WhizzMeet.
• "Processing" — any operation performed on personal data (collection, storage, transmission, deletion, etc.).
• "Sub-Processor" — a third party engaged by WhizzAct to process personal data in connection with the Service.
• "Security Incident" — any unauthorised access to, disclosure of, or loss of personal data.

2 Scope of Processing

3 WhizzAct's Obligations as Processor

WhizzAct Private Limited shall:

• Process personal data only on documented instructions from the Customer, unless required to do so by applicable law.
• Ensure that all personnel authorised to process personal data are bound by appropriate confidentiality obligations.
• Implement appropriate technical and organisational security measures (see Section 7).
• Not engage Sub-Processors without prior notification to the Customer (see Section 5).
• Assist the Customer in fulfilling data subject / principal rights requests (see Section 8).
• Assist the Customer in meeting obligations under GDPR Articles 32–36 (security, DPIA, breach notification) and equivalent DPDPA provisions.
• Delete or return all personal data upon termination of the service (see Section 11).
• Make available all information necessary to demonstrate compliance with this DPA and cooperate with audits (see Section 10).
• Notify the Customer if, in WhizzAct's opinion, any instruction infringes applicable data protection law.

4 Customer's Obligations as Controller

The Customer shall:

• Ensure all personal data provided to WhizzMeet is lawfully collected and transferred.
• Have a valid legal basis for processing each category of personal data.
• Provide clear and transparent notices to data subjects / principals about their data being processed through WhizzMeet.
• Handle data subject / principal rights requests and forward relevant requests to WhizzAct where WhizzAct's assistance is required.
• Ensure that the use of recording features complies with applicable consent and notification requirements in the jurisdictions of all participants.

5 Sub-Processors

The Customer grants WhizzAct a general authorisation to engage Sub-Processors. Current approved Sub-Processors are:

WhizzAct will notify Customers of any intended changes (additions or replacements) to Sub-Processors at least 14 days in advance via email or dashboard notification. Customers may object to changes within this period; failure to object constitutes acceptance.

6 International Data Transfers

• Personal data is primarily stored and processed in India.
• For transfers to EEA/UK users or involving EEA/UK personal data, WhizzAct relies on EU Standard Contractual Clauses (2021) or GDPR adequacy decisions.
• For transfers outside India under DPDPA 2023, WhizzAct complies with Section 16 and any rules notified by the Central Government.
• All Sub-Processors are subject to equivalent transfer safeguards.

7 Security Measures

WhizzAct implements and maintains the following technical and organisational measures:

Technical Measures

• TLS 1.2+ encryption for all data in transit; DTLS for WebRTC media.
• AES-256 encryption for data at rest and database backups.
• Firewall and network perimeter security; DDoS mitigation.
• Multi-factor authentication for all administrative access.
• Automated vulnerability scanning and patch management.
• Segregated data environments between Workspaces.

Organisational Measures

• Role-based access control; principle of least privilege.
• Employee data protection training (annual minimum).
• Non-disclosure agreements for all staff with data access.
• Incident response and breach management procedures.
• Periodic penetration testing and security audits.
• ISO 27001-aligned information security management.

8 Data Subject / Principal Rights

WhizzAct shall assist Customers in responding to data subject requests (GDPR Articles 15–22; DPDPA Sections 11–14) by:

• Providing account data exports in JSON or CSV format upon request.
• Facilitating deletion of personal data from our systems within 30 days of a verified request.
• Correcting inaccurate data upon receipt of a documented correction request from the Customer.

Customers must submit data subject assistance requests to privacy@whizzact.com with sufficient information to identify the data subject and the nature of the request.

9 Data Breach Notification

• WhizzAct will notify the Customer of a confirmed personal data breach without undue delay and within 72 hours of becoming aware of it (GDPR Art. 33; DPDPA breach notification obligations).
• Notification will include: nature of the breach; categories and approximate number of data subjects affected; likely consequences; measures taken or proposed.
• The Customer is responsible for any onward notifications to supervisory authorities and data subjects as required by applicable law.
• WhizzAct will provide reasonable cooperation and assistance in managing and investigating the breach.

10 Audit Rights

• WhizzAct shall make available information reasonably necessary to demonstrate compliance with this DPA upon written request.
• Customers may conduct audits or inspections (or appoint a third-party auditor) no more than once per year with 30 days' prior written notice, during business hours, subject to a confidentiality agreement.
• WhizzAct may satisfy audit obligations by providing current third-party security certifications (ISO 27001, SOC 2 Type II, penetration test reports) in lieu of on-site inspection.

11 Termination & Return of Data

• Upon termination of the service, WhizzAct will provide a data export in JSON/CSV format within 30 days upon written request.
• After the export window, all personal data will be securely deleted from active systems within 90 days, except where retention is required by law.
• Anonymised / aggregated data not attributable to individuals is not subject to deletion obligations.
• WhizzAct will provide a written confirmation of deletion upon request.

12 Liability

Each party's liability under this DPA is subject to the limitations set out in the Terms of Service. Where both parties are liable for a data breach, liability shall be apportioned according to their respective degree of fault. Neither party excludes liability to data subjects as required by applicable law.

13 Governing Law

This DPA is governed by the laws of India. For EEA/UK customers, GDPR provisions prevail to the extent of any conflict. Disputes shall be resolved per the dispute resolution process in the Terms of Service.