Data Processing Agreement (Partner)

1. ROLES. You are the data controller; Bizmitra is your data processor for personal data processed on your behalf through the service.

2. SCOPE & INSTRUCTIONS. We process personal data only on your documented instructions and as needed to provide the service.

3. CONFIDENTIALITY. Personnel with access to personal data are bound by confidentiality.

4. SECURITY. We maintain technical and organisational measures appropriate to the risk (see our Trust & Security page and security schedule).

5. SUB-PROCESSORS. You authorise the sub-processors listed publicly at /subprocessors; we keep the list current and provide a mechanism to object to changes.

6. DATA-SUBJECT REQUESTS. We assist you in responding to data-subject requests through the platform's request tools.

7. PERSONAL-DATA BREACH. We notify you without undue delay after becoming aware of a personal-data breach affecting your data. [COUNSEL: notification timing/detail.]

8. INTERNATIONAL TRANSFERS. [COUNSEL: transfer mechanism — adequacy / SCCs.]

9. RETURN & DELETION. On termination we return or delete personal data per your choice, subject to retention required by law.

10. AUDIT. We make available information necessary to demonstrate compliance and allow for audits per [COUNSEL: audit terms].

11. LIABILITY. [COUNSEL: liability allocation between the parties.]