When a project needs data-processing terms
This page describes terms to settle when we handle personal data for a client. It is not an automatically signed data-processing agreement, permission to upload client data or a promise that every provider meets every requirement.
Before processing begins, the parties must identify their roles, purposes, duration, data types, people affected, locations, retention and contacts. A separate signed agreement should record the terms needed for that project and the law that applies.
Instructions and responsibilities
We process client data on documented lawful instructions, except where law requires otherwise. Where permitted, we tell the client about a legal requirement that affects those instructions. We may question, decline or pause an instruction that appears unlawful.
Staff access must be limited to their work and covered by appropriate confidentiality duties. Client data is not used by default for sale, unrelated marketing or general AI model training. The client must have authority for the data and its instructions. Each party retains its own legal duties.
Client assurances and restricted data
The client must establish the lawful basis, provide required notices, obtain necessary permissions and confirm that its instructions and disclosures are lawful. It must identify regulated, sensitive or children’s data before transfer, not after it has entered a workflow.
We may reject an instruction, restrict access or suspend affected processing while a legal or security concern is resolved. This is not permission to retain client data for unrelated use. Responsibility, assistance charges and allocation of third-party claims must be agreed in the project contract and cannot displace either party’s independent legal duties.
Do not send production credentials or personal datasets through an ordinary enquiry. Agree authorised users, secure transfer, least-privilege access and a deletion plan before any import.
Other providers and international transfers
The agreement must address approved providers that process data for the project, their functions and locations, and any required notice or objection process. Relevant protections must extend to those providers. Material changes need the process agreed with the client.
Before using an AI tool, review what data it receives, retention, training settings, human review and connected systems. Do not place secrets or sensitive datasets into an unapproved prompt. India-only storage, zero retention, isolated infrastructure or certifications must not be assumed; any such requirement needs verification and written agreement.
Where international transfer rules apply, the parties must put the required safeguards in place before the transfer. This public page does not automatically execute EU standard contractual clauses, a UK transfer agreement or another legal mechanism.
Security, incidents and requests
Agree security controls appropriate to the data and risk, along with access, incident contacts and evidence needs. The agreement should set out cooperation on rights requests, impact assessments, investigations and notices where applicable.
Statutory duties and reporting deadlines take priority. A contract cannot excuse an independent legal duty or extend a shorter legal deadline. Incident information should be shared through a suitable secure route and limited to what is needed.
Ending the processing and reviewing compliance
The agreement must say whether data is returned or deleted at the end, what law requires to be retained and how backup expiry is handled. Keep access restricted during any permitted retention. Provide appropriate confirmation of the agreed action.
Any documentation or audit process should be proportionate and protect security, confidential information and other clients' data. The signed project terms and mandatory law govern the actual processing; this page does not certify compliance.
Contract limits and dispute handling
This page is a statement of the matters to agree, not an executed data-processing addendum. The signed addendum must identify its relationship to the service agreement, liability terms and any required international-transfer clauses. Mandatory provisions in a transfer mechanism must not be contradicted by a general contract cap.
The Website terms state the Jaipur contractual forum. A signed processing agreement must address its own governing terms consistently, subject to mandatory regulatory powers and individual rights.