Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the agreement between ORIS Intelligence Pvt Ltd ("Processor") and the Customer ("Controller") and applies whenever the Processor processes personal data on behalf of the Controller using the ThynkAudit platform. It is intended to support the Controller's compliance with the Digital Personal Data Protection Act, 2023 ("DPDP Act").
1. Definitions
Capitalised terms not defined here have the meanings given in the DPDP Act. "Sub-processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.
2. Scope and roles
- The Controller is the data fiduciary; the Processor is a data processor
- The Processor processes Personal Data only on documented Controller instructions
- Processing is for the sole purpose of providing the ThynkAudit Service
3. Categories of data processed
- Identifiers: PAN, GSTIN, CIN, LLPIN, Aadhaar (where uploaded by Controller)
- Contact details: names, addresses, emails, phone numbers of directors, KMPs, partners
- Financial records: ledgers, vouchers, working papers, bank statements
- Authentication metadata: login timestamps, IP addresses
4. Data residency
All Personal Data is stored in India (AWS Mumbai, ap-south-1). The Processor will not transfer Personal Data outside India without prior written Controller consent, and only to the extent permitted under the DPDP Act and any future cross-border transfer rules notified thereunder.
5. Security obligations
The Processor implements reasonable security safeguards proportionate to the nature, scope, context, and purpose of processing, including:
- TLS 1.2+ encryption in transit; AES-256-GCM at rest for secrets
- Tenant- and engagement-level access isolation; role-based PII redaction
- Working paper immutability after sign-off (SHA-256 integrity hashing)
- Annual third-party VAPT (vulnerability assessment and penetration testing)
- Documented incident response plan
6. Sub-processors
The Processor maintains a current list of Sub-processors at /legal/sub-processors (when published). The Controller is notified of changes at least 30 days before any new Sub-processor begins processing. The Controller may object on reasonable grounds within 14 days.
7. Personal data breach notification
The Processor will notify the Controller and the Data Protection Board of India without undue delay (and in any event within 72 hours) of becoming aware of a Personal Data breach affecting the Controller's data. The notification will include: nature of the breach, categories and approximate number of affected data principals, contact for further information, likely consequences, and remediation steps.
8. Data principal rights
The Processor will assist the Controller in responding to requests from data principals for access, correction, erasure, or grievance redressal, by providing tooling within the platform for export and deletion of identifiable data, subject to statutory retention obligations on audit working papers.
9. Audits
On reasonable written notice, the Controller may audit (or appoint an independent auditor to audit) the Processor's compliance with this DPA, no more than once per 12-month period unless triggered by a breach. The Processor will provide annual SOC 2 / ISO 27001 reports in lieu where available.
10. Termination and return / deletion
Upon termination, the Processor will, at the Controller's choice, return or permanently delete Personal Data within a 90-day grace period, except where retention is required by law. The Processor will certify deletion in writing on request.
11. Liability and indemnity
Liability under this DPA is subject to the limitations set out in the Master Services Agreement / Terms of Service. Each party indemnifies the other against losses arising from the indemnifying party's breach of its obligations under the DPDP Act in respect of the Personal Data covered by this DPA.
12. Order of precedence
In case of conflict between this DPA and any other agreement between the parties, this DPA prevails for matters concerning Personal Data processing.