Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of a written agreement only where an order form or statement of work expressly incorporates it, or both parties sign it. It applies when Root Digit processes Personal Data on Customer’s behalf to provide the Services.

Customer is the Controller or Data Fiduciary and Root Digit is the Processor, Data Processor, or service provider or contractor under U.S. state privacy law, except where applicable law assigns a different role for a specific activity. This includes customer records held in Root Digit software-as-a-service products such as RootDigit CRM. Capitalised terms not defined here have the meaning in the main agreement.

“Applicable Data Protection Law” means privacy and data-protection law that applies to the relevant processing, including India’s Digital Personal Data Protection Act, 2023 and rules in force and the Information Technology Act, 2000 and rules made under it; Regulation (EU) 2016/679 (GDPR); the UK GDPR and Data Protection Act 2018; the Swiss Federal Act on Data Protection; U.S. state privacy laws, including the California Consumer Privacy Act as amended; and any other law that mandatorily applies to the processing or regime the parties agree.

“Personal Data”, “Process”, “Controller”, “Processor”, “Data Principal”, “Data Subject”, “Personal Data Breach” and “Sub-processor” carry the meanings given by applicable law. “Customer Data” is data submitted to or generated for Customer through the Services.

Root Digit will process Personal Data only to provide and secure the Services, comply with Customer’s documented lawful instructions, and meet law. The agreement, configuration choices, support requests and written instructions together form Customer’s instructions.

• Customer determines the purpose, lawful basis, data scope, notices, permissions and retention instructions.
• Root Digit will inform Customer if an instruction appears to violate Applicable Data Protection Law and may pause the affected processing while the parties resolve it.
• Personnel authorised to process Personal Data are bound by confidentiality and receive access appropriate to their role.

Where Root Digit is a service provider or contractor under the California Consumer Privacy Act or a comparable U.S. state law, Root Digit will:

• not sell or share Customer personal information;
• not retain, use or disclose it for any purpose other than the business purposes specified in the agreement, or outside the direct business relationship with Customer;
• not combine it with personal information from other sources, except as the law permits;
• comply with applicable obligations, provide the level of privacy protection the law requires, and notify Customer if it can no longer meet them.

Customer may take reasonable and appropriate steps to stop and remediate unauthorised use of personal information. Root Digit certifies that it understands and will comply with these restrictions.

Root Digit will maintain measures appropriate to the nature, scope, context and risk of the processing. The exact controls may evolve as threats and Services change, without materially reducing overall protection during a committed term.

Customer grants general authorisation for Root Digit to use Sub-processors needed to provide the Services. Root Digit will maintain a current list for the relevant Service and make it available on request or through the client portal where supported.

Root Digit will impose data-protection obligations appropriate to the processing and remains responsible for a Sub-processor’s performance to the extent required by the agreement and law. Where required, Root Digit will give advance notice of a material new Sub-processor and allow Customer to object on reasonable data-protection grounds. The parties will work in good faith on an alternative; if none is reasonably available, either party may terminate only the affected Service.

Root Digit will not transfer Personal Data across borders contrary to Applicable Data Protection Law. Where a transfer mechanism is required, the parties will use an approved contractual mechanism, consent or other lawful basis and implement supplementary safeguards appropriate to identified risk.

For transfers of Personal Data from the EEA, UK or Switzerland to a country without an adequacy decision, including to Root Digit in India, the parties agree to the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 (Module Two or Module Three, as applicable), the UK International Data Transfer Addendum and the Swiss adaptations, which are incorporated by reference when this DPA is executed. The DPA governs the optional clauses and annex details to the extent the clauses permit.

For personal data governed by Indian law, Root Digit will follow transfer restrictions notified by the Government of India. Customer will identify localisation or sector-specific restrictions before processing begins.

After confirming a Personal Data Breach affecting Customer Data, Root Digit will notify Customer without undue delay and provide available information reasonably needed for Customer’s assessment and notices: nature of the breach, affected data and people, likely consequences, containment, remediation and a contact point.

Notice is not an admission of fault. Root Digit will take reasonable steps to contain, investigate and remediate the breach and will not notify affected individuals or regulators on Customer’s behalf unless required by law or authorised in writing. Root Digit will separately make any report it is itself required to make, such as a cyber-security incident report to CERT-In under Indian law.

Taking account of the nature of processing and information available, Root Digit will reasonably assist Customer with verified requests from Data Subjects or Data Principals, security obligations, breach notifications, data-protection impact assessments and regulator consultations required by applicable law.

Root Digit will not respond directly to a request concerning Customer-controlled data unless Customer authorises it or law requires it. Customer is responsible for deciding the request and providing instructions.

During the term, Customer may export data using available functionality or agreed assistance. On termination and written request, Root Digit will return or delete Customer Personal Data within the contractually stated period, unless law requires retention. Data in protected backups will remain isolated from ordinary use and be deleted through the normal backup lifecycle.

Root Digit will provide information reasonably necessary to demonstrate compliance, such as security descriptions, relevant reports or written responses. If that material is insufficient and law requires an audit right, Customer may conduct one audit per year on reasonable notice through an independent qualified auditor bound by confidentiality.

Audits must avoid access to other customers’ data and unreasonable operational disruption. Customer bears its audit costs unless the audit identifies material non-compliance by Root Digit, in which case Root Digit will remediate and bear reasonable directly related re-audit costs.

This DPA prevails over the main agreement only for conflicting data-protection terms. Liability under this DPA is subject to the agreement’s liability framework unless Applicable Data Protection Law prohibits that limitation.

DPA notices and requests should use the legal enquiry route. The request should identify the customer, agreement and relevant Service. Execution copies and Service-specific annexes may be requested through the same route.