Data Processing Agreement

1.1This Data Processing Agreement ("DPA") is between Novara Systems Private Limited, CIN U62099KA2026PTC221734, registered office at 2F, J-Block, Phase-2, Kogilu Main Road, Yelahanka, Bangalore North, Bengaluru 560064, Karnataka, operating the Unfolde service at unfolde.in ("Unfolde"), and the customer named in the order form or account ("Brand").

1.2It applies whenever Unfolde processes personal data on the Brand's behalf while providing the Unfolde service under the Terms of Service (the "Agreement").

1.3If this DPA conflicts with the Agreement on the processing of personal data, this DPA prevails. Otherwise the Agreement governs.

Terms used here carry their meaning under the DPDP Act.

• Personal Data: any data about an individual who is identifiable by or in relation to that data.
• Brand Personal Data: Personal Data that Unfolde processes on the Brand's behalf, described in Annex 1.
• Data Fiduciary: the person who alone or with others determines the purpose and means of processing.
• Data Processor: a person who processes Personal Data on behalf of a Data Fiduciary.
• Data Principal: the individual to whom the Personal Data relates, for example a customer of the Brand's store.
• Personal Data Breach: any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to Personal Data, that compromises its confidentiality, integrity or availability.
• Sub-processor: a third party Unfolde engages to process Brand Personal Data.
• Connected Platform: a third-party platform the Brand connects to Unfolde and has its own agreement with, such as Meta, Instagram or Shopify.

3.1For Brand Personal Data, the Brand is the Data Fiduciary and Unfolde is the Data Processor.

3.2For the account data of the Brand's own users of Unfolde (names, email addresses, phone numbers, company name, login and billing records), Unfolde is a Data Fiduciary in its own right. That data is governed by Unfolde's Privacy Policy, not this DPA.

3.3Connected Platforms are not Sub-processors. The Brand chooses them and is responsible for its own agreements with them. Unfolde exchanges data with a Connected Platform only on the Brand's instruction, given by connecting it and using the service.

3.4The Brand is responsible for having a lawful basis under the DPDP Act, including notice and consent where required, for the Brand Personal Data it makes available to Unfolde.

4.1Unfolde processes Brand Personal Data only to provide the service and only on the Brand's documented instructions. The Agreement, this DPA and the Brand's use and configuration of the service are those instructions.

4.2Unfolde does not sell Brand Personal Data, use it for advertising to the Brand's customers on its own account, or combine it with another customer's Personal Data.

4.3Unfolde may compute aggregate, de-identified statistics across brands to improve the service. These contain no Personal Data and identify no Brand.

4.4Unfolde will tell the Brand if, in its view, an instruction breaks the DPDP Act, and may suspend that processing until the Brand confirms or changes it.

4.5Unfolde may disclose Brand Personal Data where Indian law requires it. It will tell the Brand first unless the law forbids that.

Unfolde gives access to Brand Personal Data only to personnel who need it to provide the service. Each is bound by a written duty of confidentiality that survives the end of their engagement.

6.1Unfolde maintains the reasonable security safeguards in Annex 2 to prevent a Personal Data Breach, appropriate to the nature of the data and the risk.

6.2Unfolde may update Annex 2, provided the overall level of protection does not fall.

7.1The Brand authorises the Sub-processors in Annex 3.

7.2Unfolde will give the Brand at least 30 days' notice, by email to the account owner and on unfolde.in, before adding or replacing a Sub-processor. The Brand may object on reasonable data-protection grounds within that period. If the parties cannot resolve it, the Brand may terminate the affected service and receive a pro-rata refund of prepaid fees.

7.3Unfolde binds each Sub-processor by written contract to data-protection obligations no less protective than this DPA, and remains responsible to the Brand for each Sub-processor's performance.

8.1Unfolde will notify the Brand without undue delay, and in any event within 48 hours of becoming aware of a Personal Data Breach affecting Brand Personal Data.

8.2The notice will state, as far as then known: what happened and when; the categories and approximate number of Data Principals and records affected; the likely consequences; the steps taken or proposed to contain it and reduce harm; and a contact person. Unfolde will supply further detail as it becomes available.

8.3Unfolde will give the Brand the information and help it reasonably needs to inform the Data Protection Board of India and affected Data Principals within the time the DPDP Rules require.

8.4Unfolde will not inform the Board or Data Principals about a breach of Brand Personal Data on the Brand's behalf without the Brand's agreement, unless the law requires it.

8.5A notice under this clause is not an admission of fault.

9.1Unfolde will help the Brand respond to Data Principals exercising their rights under the DPDP Act: information about processing, correction, completion, updating, erasure, grievance redressal and nomination.

9.2If a Data Principal contacts Unfolde directly about Brand Personal Data, Unfolde will pass the request to the Brand within 5 business days and will not answer it substantively itself unless the Brand asks.

9.3For stores connected through Shopify, Unfolde handles Shopify's mandatory privacy requests automatically:

• customers/data_request: Unfolde compiles the order records it holds for the requested orders and emails them to the store owner, so the Brand can answer the customer. Repeat deliveries of the same request are sent once.
• customers/redact: Unfolde stores no customer name, email, phone or address on order records, and redacts these from any unmatched order event it keeps, so a customer redaction request requires no further deletion; Unfolde acknowledges it and records that it was received.
• shop/redact: Unfolde deletes the store's data after the store uninstalls the app.

Unfolde acknowledges each request to Shopify and completes it within the 30 days Shopify requires.

9.4When the Brand asks Unfolde to erase Brand Personal Data, or deletes its account, Unfolde deletes or anonymises that data across its stores within 30 days. Exceptions are only what clause 10.3 allows.

10.1Unfolde keeps Brand Personal Data only as long as the service needs it, on the retention periods in Annex 1. Expiry is enforced automatically in the database, not by manual process.

10.2Within 30 days after the Agreement ends, Unfolde will delete Brand Personal Data. If the Brand asks before the Agreement ends, Unfolde will first export it in a machine-readable format (JSON). The export covers the account owner's profile and preferences, the Brand's order records, creative records, campaign list, consent records and the account's own audit events. Creative files are identified by their storage references and supplied on request. Detailed campaign metrics, creative transcripts and analysis, and the before and after values of audit events are supplied on request. Where an export is too large to return whole, it says so and names the sections it cut.

10.3Unfolde may keep data only where Indian law requires it (for example, its own tax and billing records for 72 months under the CGST Act), and only for that purpose and period.

10.4Database backups (point-in-time recovery) are retained for 35 days and then expire. Until then they are protected under this DPA and not restored for use.

11.1Unfolde hosts the service on Amazon Web Services in the United States (us-east-1, N. Virginia). Some Sub-processors in Annex 3 also process outside India.

11.2Section 16 of the DPDP Act permits transfer outside India except to countries the Central Government restricts by notification. Unfolde will not transfer Brand Personal Data to a restricted country. If a country it uses becomes restricted, it will move or stop that processing within the period the notification allows.

12.1On request, Unfolde will give the Brand the information reasonably needed to show compliance with this DPA, including written answers to a reasonable security questionnaire once a year.

12.2If those answers are insufficient, or a regulator requires it, the Brand may audit Unfolde's compliance once in any 12 months. The audit is on 30 days' notice, during business hours, at the Brand's cost, by an auditor bound by confidentiality, and limited to systems that process Brand Personal Data.

13.1Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement.

13.2This DPA lasts as long as Unfolde processes Brand Personal Data. Clauses 8, 9, 10 and 12 survive until that processing has fully stopped.

13.3This DPA is governed by the laws of India. The courts at Bengaluru, Karnataka have exclusive jurisdiction.

13.4The Brand accepts this DPA by accepting the Terms of Service. A countersigned copy is available on request. Signed for Novara Systems Private Limited by Harshit Chandra, Director.

13.5Notices and contact. Breach notices, Data Principal requests, objections to Sub-processors and audit requests go to Unfolde's Grievance Officer, Harshit Chandra, at hello@unfolde.in, or by post to the registered office in clause 1.1. Unfolde sends notices to the Brand's account owner email.