Data Processing Addendum (DPA)

Effective: [Date the website goes live]

This addendum forms part of the Terms of Service between NSDBytes ("Processor") and the Client ("Controller" / "Data Fiduciary") whenever ZeroDelay processes personal data of the Client's End Users.

1. Scope. Processor processes End User personal data (names, roles, phone numbers, Telegram IDs, messages, voice notes, query logs) only to provide ZeroDelay, and only on the Client's documented instructions, which are these terms and the Client's configuration of roles, scopes and questions.
2. Client duties. The Client ensures it has a lawful basis and has given any required notice to End Users, and sets access appropriately.
3. Confidentiality. Everyone at the Processor with access is bound by confidentiality.
4. Security. Processor maintains the measures on the Security page, including per-client encryption keys, role-based access, credentials in a vault and an audit log.
5. Sub-processors. The Client authorises the sub-processors on the Sub-processors page. Processor gives 30 days' notice of new ones; the Client may object and, if unresolved, terminate the affected service with a pro-rata refund. Processor flows these obligations down to sub-processors and remains responsible for them.
6. Data principal requests. Processor helps the Client respond to access, correction, erasure and grievance requests.
7. Breaches. Processor notifies the Client without undue delay, and in any case within 24 hours, of becoming aware of a personal data breach, with the information the Client needs to meet its own reporting duties.
8. Deployment and transfers. By default, ZeroDelay is hosted by Processor on cloud servers in India. At the Client's request and cost, Processor deploys a dedicated ZeroDelay in the Client's own cloud account in the Client's chosen country. After a dedicated deployment goes live, Processor does not monitor or access it; the Client reports issues, and gives Processor fresh access credentials when it wants Processor to investigate, which the Client may withdraw at any time. The AI provider is chosen per project and named in the order; it processes data in the Client's region where it offers that, and otherwise in its own region. Messaging channels (such as WhatsApp via Meta, or Telegram) operate on their providers' infrastructure as described in the deployment record. Any other transfer follows applicable law, including restrictions notified under the DPDP Act and, for EU/UK data, the standard contractual clauses.
9. Deletion. On termination, Processor deletes End User personal data within 30 days, unless the law requires retention, and confirms deletion on request.
10. Audit. Processor makes available the information reasonably needed to show compliance, and allows audits by the Client or its auditor once a year with 30 days' notice, at the Client's cost.
11. US service-provider terms. Where US state privacy laws apply, Processor acts as a "service provider" or "processor": it will not sell or share Client personal information, will not retain, use or disclose it outside the direct business relationship or for any purpose other than the services, will not combine it with data from other sources except as the law permits, will comply with applicable law and notify the Client if it can no longer do so, and grants the Client the right to take reasonable steps to stop unauthorised use.
12. Canada. For personal information subject to PIPEDA, provincial law or Quebec's Law 25, Processor provides protection comparable to the Client's, uses the information only for the mandated purposes, keeps a register of confidentiality incidents, and supplies the information the Client needs for any privacy impact assessment of a transfer outside Quebec or Canada.
13. No biometrics. Processor does not create voiceprints or identify individuals from voice recordings.
14. Responsibilities. A deployment record, signed with each order, lists where ZeroDelay is hosted (Processor's servers or the Client's cloud account), the cloud account owner, region, AI and speech providers (which the Client contracts directly or through its cloud account), messaging channels, key ownership, backups and who does what in an incident and at exit.
15. Business data. Data in the Client's connected systems is read on demand and not stored by Processor, except references, encrypted drafts (cleared 30 days after approval or rejection), a daily-refreshed list of customer and item names used to recognise names, and the query log.