Data Processing Agreement

1. Parties

This Data Processing Agreement ("DPA") is entered into between:

• Data Controller: The customer ("you" or "Controller") who has agreed to the Ooty Terms of Service and uses the Ooty platform.
• Data Processor: Ooty ("we," "our," or "Processor"), which processes personal data on behalf of the Controller in connection with providing the Service.

This DPA forms part of and is subject to the Terms of Service (the "Agreement"). In the event of any conflict between this DPA and the Agreement, this DPA shall prevail with respect to data processing matters.

2. Definitions

For the purposes of this DPA, the following terms shall have the meanings set out below. Terms not defined herein shall have the meanings given to them in the Agreement or in applicable data protection legislation.

• Personal Data: Any information relating to an identified or identifiable natural person ("Data Subject") that is processed by the Processor on behalf of the Controller in connection with the Service.
• Processing: Any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment, combination, restriction, erasure, or destruction.
• Sub-Processor: Any third party engaged by the Processor to process Personal Data on behalf of the Controller.
• Data Subject: An identified or identifiable natural person whose Personal Data is processed under this DPA.
• Data Protection Laws: The UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU General Data Protection Regulation (EU GDPR), and any other applicable data protection or privacy legislation.

3. Scope and Purpose of Processing

The Processor shall process Personal Data only for the purpose of providing the Service to the Controller, as described in the Agreement. This includes server-side processing of requests, session management, licence validation, authentication, and any other processing necessary to deliver the functionality of the Ooty platform.

The Processor shall not process Personal Data for any purpose other than as set out in this DPA or as otherwise instructed in writing by the Controller, unless required to do so by applicable law. In such a case, the Processor shall inform the Controller of that legal requirement before processing, unless prohibited from doing so on important grounds of public interest.

4. Details of Processing

4.1 Categories of Personal Data

• Account information (email address, name)
• OAuth tokens (encrypted at rest and in transit)
• Session metadata (session identifiers, timestamps)
• Licence and device information (hardware identifiers, platform type)
• Usage statistics (anonymised feature usage, error reports)

4.2 Categories of Data Subjects

• Users of the Service (individual and agency plan holders)
• Team members invited by agency plan administrators

4.3 Processing Activities

• User authentication and account management
• Licence validation and device activation
• API request processing and session management
• Rate limiting and abuse prevention
• Transactional email delivery (account verification, security alerts, billing updates)

4.4 Duration of Processing

Processing shall continue for the duration of the Agreement. Upon termination, the provisions of Section 9 (Data Deletion) shall apply.

5. Sub-Processors

The Controller authorises the Processor to engage Sub-Processors to assist in providing the Service, subject to the conditions set out in this section. A current list of Sub-Processors is maintained at our Sub-Processors page.

The Processor shall:

• Notify the Controller by email at least 30 days before adding or replacing any Sub-Processor.
• Provide the Controller with an opportunity to object to the appointment of a new Sub-Processor within 30 days of notification.
• Impose data protection obligations on each Sub-Processor that are no less protective than those set out in this DPA.
• Remain fully liable to the Controller for the performance of each Sub-Processor's obligations.

If the Controller reasonably objects to a new Sub-Processor, the parties shall discuss the objection in good faith. If the parties are unable to reach a resolution, the Controller may terminate the affected Service by providing written notice.

6. Data Security

The Processor shall implement and maintain appropriate technical and organisational measures to protect Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, or damage. These measures include:

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of data at rest, including OAuth tokens and sensitive credentials
• Row-level security policies ensuring users can only access their own data
• Role-based access controls for internal systems
• Regular security audits of the codebase and infrastructure
• Automatic expiry of session metadata (within 30 minutes)
• Network-level restrictions on database access

The Processor shall regularly assess the effectiveness of these measures and update them as necessary to maintain an appropriate level of security, taking into account the state of the art, the costs of implementation, the nature of the processing, and the risks to the rights and freedoms of Data Subjects.

7. Personal Data Breach Notification

The Processor shall notify the Controller without undue delay, and in any event within 72 hours of becoming aware of a Personal Data breach, in accordance with Article 33 of the UK GDPR (and, where applicable, the EU GDPR). Notification shall be sent to the Controller's registered email address.

The notification shall include, to the extent available:

• A description of the nature of the breach, including the categories and approximate number of Data Subjects and records affected
• The name and contact details of the Processor's data protection contact
• A description of the likely consequences of the breach
• A description of the measures taken or proposed to address the breach, including measures to mitigate its adverse effects

The Processor shall cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation, and remediation of any Personal Data breach.

8. Data Subject Rights

The Processor shall assist the Controller in fulfilling its obligations to respond to requests from Data Subjects exercising their rights under Data Protection Laws, including the rights of:

• Access to Personal Data
• Rectification of inaccurate data
• Erasure ("right to be forgotten")
• Data portability
• Restriction of processing
• Objection to processing

If the Processor receives a request directly from a Data Subject, it shall notify the Controller without undue delay and shall not respond to the request directly unless authorised to do so by the Controller or required by applicable law.

The Service provides self-service functionality for certain Data Subject rights, including the ability to access, export, correct, and delete Personal Data through the user dashboard. The Processor shall maintain these features throughout the term of the Agreement.

9. Data Deletion

Upon termination of the Agreement, the Processor shall delete all Personal Data processed on behalf of the Controller within 30 days, unless applicable law requires continued storage.

The Controller may request immediate deletion of Personal Data at any time through:

• The account deletion feature in the user dashboard
• A written request to Click to reveal email

Upon deletion, the Processor shall confirm in writing that all Personal Data has been deleted, except where retention is required by applicable law. Any retained data shall continue to be protected in accordance with this DPA.

10. Audit Rights

The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA and applicable Data Protection Laws.

The Controller, or an independent auditor appointed by the Controller, may conduct audits of the Processor's data processing activities, subject to the following conditions:

• The Controller shall provide at least 30 days' written notice of any audit request.
• Audits shall be conducted during normal business hours and shall not unreasonably interfere with the Processor's operations.
• The Controller shall bear the costs of any audit, unless the audit reveals a material breach of this DPA by the Processor.
• The frequency of audits shall be limited to once per calendar year, unless a Personal Data breach or regulatory investigation necessitates an additional audit.

11. International Data Transfers

The Processor shall not transfer Personal Data to a country outside the United Kingdom or the European Economic Area unless appropriate safeguards are in place, as required by Data Protection Laws. Such safeguards may include:

• Standard Contractual Clauses (SCCs) approved by the European Commission or the UK Information Commissioner's Office
• An adequacy decision by the relevant authority
• The EU-US Data Privacy Framework, where applicable

Details of the locations where Sub-Processors process Personal Data are available on our Sub-Processors page.

12. Term and Termination

This DPA shall become effective on the date the Controller accepts the Agreement and shall remain in effect for the duration of the Agreement.

This DPA shall survive termination of the Agreement until all Personal Data processed under this DPA has been deleted or returned in accordance with Section 9.

Either party may terminate this DPA if the other party materially breaches its obligations under this DPA and fails to remedy such breach within 30 days of receiving written notice.

13. Confidentiality

The Processor shall ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

14. Governing Law

This DPA shall be governed by and construed in accordance with the laws of England and Wales. The courts of England and Wales shall have exclusive jurisdiction to settle any dispute arising out of or in connection with this DPA, subject to any mandatory consumer jurisdiction provisions under applicable law.

15. Contact

For questions or requests relating to this DPA:

• Email: Click to reveal email
• Website: ooty.io