Definitions
Controller — the customer determining the purpose of personal-data processing
Processor — Sendvise, processing data on behalf of the Controller
Personal Data — any information relating to an identified or identifiable person
Sub-processor — a third party Sendvise engages to assist with processing
Roles
You are the Controller of customer data you upload to Sendvise. We are the Processor and process this data only on your documented instructions.
Subject matter & duration
Subject matter: messaging, automation, support, and analytics on personal data of your end-users via the Sendvise platform. Duration: for the term of your subscription plus 90 days for retention.
Sub-processors
We engage the following sub-processors: AWS / India region (hosting), Resend (transactional email), Razorpay / PayU (payments). You hereby authorize their use. We notify you of changes 14 days in advance.
Data transfer
Personal data is stored on India-resident servers. International transfers, if any, occur only under contractual safeguards (Standard Contractual Clauses or equivalent).
Security measures
ISO 27001-aligned security controls
Encryption in transit (TLS 1.2+) and at rest (AES-256)
Role-based access control with audit logs
Annual third-party security review
Documented incident response plan
Audits
Once per year, on 30 days' notice, you may audit our compliance with this DPA. We will respond to written security questionnaires within 14 days.
Breach notification
We notify you of a personal-data breach without undue delay (and at most within 72 hours of becoming aware), with all information reasonably required to assess and notify your end-users.
This is a starter document. For production use, have your Indian counsel review for DPDP Act 2023, IT Rules 2021, and your sector's specific obligations.