Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Aaida Technology Solutions, Bengaluru, India (“Aaida”), and the organisation that uses the Aaida BRSR Platform (the “Customer”). It applies to the Customer’s data in the Platform during a trial, a pilot and a paid subscription alike.

An Organisation Administrator accepts this DPA in the Platform on the Customer’s behalf, and by accepting confirms that they are authorised to bind the Customer.

1. Who does what

The Customer decides what data goes into the Platform and why; it is the Data Fiduciary (controller) under the Digital Personal Data Protection Act, 2023. Aaida processes that data only on the Customer’s behalf, to provide and support the Platform; it is the Data Processor.

2. What data

The Customer’s BRSR disclosure data and supporting documents, its Authorised Users’ names, work email addresses, roles and sign-in records, and the contact details of value-chain partners it invites. The Customer will not enter sensitive personal data, such as health or financial details of individuals, into the Platform.

3. How Aaida uses it

Only to run the Platform for the Customer and to support its users, on the Customer’s instructions given through the Platform or in writing. Aaida does not sell the data, does not use it to train AI models, and shares it only with the service providers in section 9.

4. Where it is kept

The database, files, application servers and supporting services, including email, run in India (Mumbai). Encrypted off-site backup copies are kept for 180 days. Error reports and AI-assisted features are processed outside India:

• error reports, processed in Germany, with personal details removed where technically feasible;
• AI-assisted features, such as reading an uploaded document, processed in the United States when an Authorised User chooses to use them.

Network traffic passes through a global network-security service in transit only.

5. How it is protected

Each customer’s data is held in its own separate area of the database. Data is encrypted in transit and at rest. Two-factor sign-in is available and can be made mandatory for the Customer’s users. Submissions, approvals and administrative actions are recorded in an audit trail that cannot be edited. Any access by Aaida for support is recorded. Backups are taken every night.

6. Confidentiality

Aaida keeps the Customer’s data confidential. Only Aaida’s authorised personnel can access it, under a duty of confidentiality, and only to provide or support the Platform.

7. Requests from individuals

If a person asks Aaida to access, correct or erase personal data that Aaida holds for the Customer, Aaida passes the request to the Customer and helps it respond.

8. If something goes wrong

If Aaida becomes aware of a breach affecting the Customer’s data, it will tell the Customer within 72 hours, with what is known at the time, and keep the Customer updated.

9. Service providers

Aaida gives the Customer’s IT or security team the names of these providers on request. Each is bound by data-protection terms, and Aaida will tell the Customer at least 30 days before adding or replacing one.

10. At the end

When the Customer stops using the Platform, Aaida will, on the Customer’s request, provide an export of its data, and will delete the data from the live Platform within 30 days of the Customer’s instruction. Backup copies expire automatically within 180 days and are used only for disaster recovery.

11. Law

This DPA is governed by the laws of India, and the courts at Bengaluru, Karnataka have jurisdiction, as in the Terms of Service.