Data Processing Agreement

1. Roles and instructions

The Client decides why and how Client Data is processed and is responsible for its lawful basis, including consent to be contacted. VixScale processes Client Data only to provide VixSync as the Client configures and uses it, and on the Client’s documented instructions — the Client’s settings and actions in VixSync are those instructions. VixScale tells the Client if it believes an instruction breaks the law.

2. What VixScale will not do

• Sell Client Data, or use it for advertising or profiling.
• Use one Client’s data to train AI or to answer for another Client.
• Disclose it, except to the sub-processors described below or where the law requires — and then, where allowed, after telling the Client.

3. Confidentiality and staff access

Only VixScale staff who need it to run or support VixSync can access Client Data, under confidentiality obligations. Setup access, which the owner can switch off, reaches only the assistant’s knowledge base and settings, not Client Data. Staff see Client Data only after the workspace owner approves a request, for the time and level approved; the only exception is an emergency (an active security incident, abuse, or a lawful order), which is time-limited and reported to the owner immediately. Every visit is recorded in the Client’s audit log.

4. Security

VixScale keeps reasonable security safeguards, as the DPDP Act requires, including those described on our Security page: encryption in transit and at rest, encrypted credentials, per-workspace isolation, role-based access, two-step sign-in, rate limiting, audit logs, and automatic deletion on the schedule in our Privacy Policy.

5. Sub-processors

The Client authorises VixScale to use service providers (for hosting, messaging, email, AI and payments) to run VixSync. VixScale binds each to data-protection terms no weaker than this DPA, remains responsible for them, and gives at least 15 days’ notice of any new one, during which the Client may object.

6. Location and transfers

Client Data is stored in India. Some sub-processors (such as AI and messaging services) may process data outside India for the request in progress; VixScale transfers data only to countries not restricted by the Government of India under the DPDP Act.

7. Breaches

If VixScale becomes aware of a breach affecting Client Data, it tells the Client without undue delay and in any case within 48 hours, with what is known about its nature, the data and people affected, and the steps taken — so the Client can notify the Data Protection Board of India and the people affected. VixScale reports to CERT-In as Indian law requires and cooperates with the Client’s response.

8. Helping the Client with requests

VixSync lets the Client find, correct, export and delete a contact’s data, and handles opt-outs automatically. Where that is not enough, VixScale helps the Client answer requests from the people whose data it is, and passes on any request it receives directly.

9. Return and deletion

The Client can export its data at any time. When the Client closes its workspace, VixScale permanently deletes Client Data within 30 days, except records the law requires us to keep (such as invoices).

10. Audits

On reasonable request, no more than once a year, VixScale answers the Client’s written security questionnaire and provides the information needed to show it complies with this DPA.

Contact

Data-protection questions: our Grievance Officer at connect@vixscale.com, VixScale Technologies, 3rd Floor, Innov8 Orchid Centre, Golf Course Road, Sector 53, South City, Gurugram 122002.