This Data Processing Agreement forms part of and is incorporated into the AV Services Retainer Agreement. It governs the processing of personal data by AV Services in the course of providing Linux server management services. Governed by the Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025.
1. Parties
AV Services, proprietorship of Arun Valecha, Shop No 1 Shreenath Residency, Jaydeep Nagar, Bhandup East, Mumbai 400042, Maharashtra, India (GSTIN: 27ACAPV2614B1Z0) acts as Data Processor. The retainer client named in the Retainer Agreement acts as Data Fiduciary.
2. Scope and Purpose
AV Services processes personal data solely to perform Linux server management services under the Retainer Agreement. No processing occurs outside this purpose.
3. Categories of Personal Data
Server logs, system user account names, email addresses of system users, and any personal data incidentally present on managed servers. AV Services does not collect, store, or process end-customer data of the client independently.
4. Processor Obligations
- 4.1 Process personal data only on documented instructions from the client.
- 4.2 Ensure all personnel with access to personal data are bound by confidentiality.
- 4.3 Implement reasonable technical safeguards: encrypted remote access (SSH key-only), role-based access controls, monthly security patching, and access log retention.
- 4.4 Notify the client of any confirmed personal data breach within 24 hours of discovery. The client is responsible for notifying the Data Protection Board of India within the timeframes required under DPDP Rules 2025.
- 4.5 Not engage sub-processors without prior written consent from the client. Current sub-processors: none. Backup engineers (Krishna, Sanjay) operate under confidentiality obligations as part of the AV Services retainer team.
- 4.6 On termination of the Retainer Agreement, delete or return all personal data as instructed by the client within 30 days.
- 4.7 Provide reasonable assistance to the client for data principal rights requests (access, correction, erasure) within 7 business days of receiving the request.
5. Client Obligations
- 5.1 Provide a lawful basis for processing before sharing personal data with AV Services.
- 5.2 Notify AV Services promptly of any data principal rights requests that require processor action.
6. Audit Rights
The client may request a written compliance summary from AV Services once per calendar year at no charge. On-site audits require 15 business days notice and are subject to a reasonable fee.
7. Liability
Each party is liable for DPDP Act violations caused by its own actions. AV Services total liability under this agreement is capped at 3 months retainer fees, consistent with the Retainer Agreement.
8. Governing Law
This agreement is governed by the laws of India. Disputes are subject to the jurisdiction of courts in Mumbai, Maharashtra.
9. Effectiveness
This agreement takes effect on the date the Retainer Agreement is signed and remains in force for the duration of the retainer engagement.
10. Adaptation to Regulatory Changes
The DPDP Rules 2025 are subject to ongoing notification and amendment by the Government of India. Both parties agree that this agreement shall be interpreted to comply with the DPDP Act 2023 and all Rules, notifications, and guidelines issued thereunder, as amended from time to time. Where any provision of this agreement becomes inconsistent with a subsequently notified Rule or guideline, the parties agree to amend this agreement within 60 days of the relevant notification taking effect. AV Services will notify the client of any material regulatory change that affects data processing obligations under this agreement within 30 days of becoming aware of it.
Questions? Email arun@avservices.in or call +91 92205 60056.