Data Processing Agreement

Terms not defined here have the meaning given in the Terms of Service or in Applicable Data Protection Law.

This DPA forms part of the Terms of Service (or your Master Services Agreement, if you have one) and applies whenever Fininvo processes personal data on your behalf in providing the services. You act as the controller (or, where you process on behalf of another controller, as a processor) and Fininvo acts as your processor (or sub-processor). For our own limited processing, such as billing, account administration and security telemetry, we act as an independent controller as described in the Privacy Policy.

This DPA applies automatically to all customers, without signature, whenever you use the services to process personal data. A countersigned copy is available (Section 17).

This DPA applies for as long as Fininvo processes personal data on your behalf: for the subscription term plus the post-termination export and deletion window in Section 14. Obligations that by their nature survive (confidentiality, deletion, audit records) survive termination.

The subject matter, duration, nature and purpose of processing, the categories of data subjects and the categories of personal data are set out in Annex I, which forms part of this DPA and completes the corresponding annexes of the SCCs.

We process personal data only on your documented instructions, including with regard to international transfers, unless required otherwise by law to which we are subject; in that case we inform you of the legal requirement before processing, unless the law prohibits it on important grounds of public interest. The parties agree that the Terms of Service, this DPA, your configuration of the services and your use of their features constitute your complete documented instructions. Additional instructions require written agreement. We will inform you if, in our opinion, an instruction infringes Applicable Data Protection Law.

• Access to personal data is limited to personnel who need it to deliver the services.
• All such personnel are bound by written confidentiality obligations or an appropriate statutory duty of confidentiality that survives the end of their engagement.
• Personnel complete data protection and security training, and access is revoked promptly on role change or exit.

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, we implement and maintain the technical and organisational measures set out in Annex II. We may update those measures from time to time, provided the update does not materially reduce the overall protection of personal data.

You provide general written authorisation for Fininvo to engage sub-processors. The current list, including entity, purpose, location and safeguards, is published at fininvo.com/subprocessors (Annex III).

• Each sub-processor is bound by a written agreement imposing data protection obligations no less protective than this DPA.
• We remain fully liable to you for the performance of each sub-processor's obligations.
• Where a sub-processor is outside the originating jurisdiction, we put a lawful transfer mechanism in place (Section 12).

The services include controls that let you retrieve, correct, delete, export and restrict personal data, and you are primarily responsible for responding to data subject requests using those controls. If a data subject contacts us directly about data we process on your behalf, we do not respond substantively; we redirect the request to you and notify you promptly. Taking into account the nature of processing, we assist you by appropriate technical and organisational measures, insofar as possible, in fulfilling your obligation to respond to requests to exercise data subject rights.

Taking into account the nature of processing and the information available to us, we assist you in ensuring compliance with your obligations regarding security of processing, breach notification, data protection impact assessments and prior consultations with supervisory authorities. Assistance beyond the information and tools we already make available (this DPA, the Security page, audit reports and questionnaire responses) may be charged at reasonable rates where the effort is material and specific to your organisation.

We notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting personal data we process on your behalf. To the extent known at the time and as information becomes available, the notice includes:

• The nature of the breach, including, where possible, the categories and approximate number of data subjects and records concerned.
• The name and contact details of our security contact (security@fininvo.com).
• The likely consequences of the breach.
• The measures taken or proposed to address the breach and mitigate its effects.

We cooperate with you and take reasonable steps as directed by you to assist in the investigation, mitigation and remediation. Our notice is not an admission of fault or liability. You are responsible for notifying your supervisory authority and data subjects where required; we assist as described in Section 10.

Where personal data protected by the GDPR, UK GDPR or Swiss FADP is transferred to a country without an adequacy decision, the parties enter into the SCCs, which are incorporated into this DPA by reference and completed as follows:

• Module Two (controller to processor) applies where you are a controller; Module Three (processor to processor) applies where you are a processor.
• Clause 7 (docking) is included. Clause 9 Option 2 (general authorisation, 30 day notice) applies. Clause 11 optional redress language is not included.
• Clause 17: the SCCs are governed by the law of Ireland. Clause 18: courts of Ireland.
• Annexes I and II of the SCCs are completed by Annexes I and II of this DPA; Annex III by the sub-processor list.
• For UK transfers, the UK Addendum applies with the parties' details as in Annex I. For Swiss transfers, the SCCs are read to include the FADP as required by the Swiss authority.

Transfers of personal data of data principals located in India are made only to countries or territories not restricted by the Central Government under section 16 of the DPDP Act.

We make available to you all information reasonably necessary to demonstrate compliance with this DPA, including summaries of penetration tests, security questionnaire responses and, when available, third-party certification reports (under NDA). Where those materials are not sufficient to meet a legal requirement, you (or an independent auditor bound by confidentiality who is not our competitor) may audit our compliance, subject to: at least 30 days written notice; at most once in any 12 month period, unless a supervisory authority requires more or a material breach has occurred; business hours; no access to other customers' data; and reimbursement of our reasonable costs where the audit exceeds two business days.

During the subscription and for 30 days after termination, you may export Customer Data using the services' export tools. After that window, we delete the personal data we process on your behalf from active systems within 60 days, and from backups as those backups expire in the ordinary rotation cycle (at most 90 further days), except where law requires continued retention, in which case we isolate and protect the data and process it only for that purpose. On written request we confirm deletion.

• Where the DPDP Act applies, you are the Data Fiduciary and Fininvo is your Data Processor engaged under a valid contract, as required by section 8(2) of the DPDP Act.
• We process personal data only for the purposes of providing the services, implement reasonable security safeguards, and notify you of personal data breaches so you can meet your obligations to the Data Protection Board of India and affected data principals within required timelines.
• On termination we delete personal data as described in Section 14, enabling you to meet your erasure obligations.
• Our Grievance Officer is reachable at grievance@fininvo.com.

Each party's liability arising out of or related to this DPA (including the SCCs) is subject to the exclusions and limitations of liability in the Terms of Service or your MSA, except where Applicable Data Protection Law does not permit such limitation for the liability in question.

A. List of parties

Data exporter: the customer identified in the account or Order Form (controller, or processor under Module Three). Data importer: Prashbi Global Services Pvt. Ltd. (CIN: U52100KA2020PTC133490), Tholons Tower, 346 HIG, 17th Cross Rd, Dollars Colony, R.M.V. 2nd Stage, Bengaluru, Karnataka 560094, India (processor). Contact: dpo@fininvo.com.

B. Categories of data subjects

• Your employees, contractors, directors and other personnel (ERP, HRMS, Payroll).
• Your customers, vendors, business contacts and their personnel (ERP, CRM).
• Job candidates and applicants you source or who apply to your postings (Recruit).
• Other individuals whose data your users submit to the services.

C. Categories of personal data

• Identity and contact: name, email, phone, address, photograph, government identifiers you record (such as PAN or tax IDs).
• Employment: role, department, employment dates, attendance, leave, performance, documents.
• Financial and payroll: salary and compensation, bank account details, tax declarations, reimbursements, transactions.
• Recruitment: resume, work history, education, application status, interview notes.
• Technical: access logs, device and usage data tied to user accounts.

D. Sensitive data

The services are not designed to require special category data. Depending on your configuration and local law you may submit data such as health information (leave records), biometric attendance events, or statutory identifiers. Such data receives the full protections of Annex II; you are responsible for the lawfulness of collecting it.

E. Nature, purpose, frequency, duration

Hosting, storage, computation, transmission, display, backup and deletion of Customer Data as needed to provide the ERP, HRMS, Payroll, Jobs and Recruit services and related support. Processing is continuous for the subscription term plus the export and deletion window in Section 14. Retention follows Section 14.

Further detail is published on the Security page; enterprise customers may request our security packet under NDA.

The authorised sub-processors, including legal entity, purpose, location of processing and safeguards, are listed at fininvo.com/subprocessors. That page is incorporated into this DPA as Annex III and is kept current under the notice process in Section 8.