Data Processing Addendum

1. Incorporation and order of precedence

This DPA is incorporated by reference into the ChatYug Terms of Service. If there is a conflict between this DPA and the Terms regarding the processing of Customer personal data where SICIPL acts as Processor, this DPA prevails for that subject matter. Capitalised terms not defined here have the meaning in the Terms or the Privacy Policy.

2. Roles of the parties

• Customer is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and, where GDPR or UK GDPR applies, the Controller for personal data of the Customer’s end users, contacts, and other individuals whose data the Customer uploads to or processes through ChatYug.
• SICIPL (operating ChatYug) is the Data Processor under the DPDP Act and, where GDPR or UK GDPR applies, the Processor, for that Customer personal data.
• For account, billing, website, and similar first-party data about the Customer’s own users of ChatYug, SICIPL acts as Data Fiduciary / Controller as described in the Privacy Policy — that processing is outside the scope of this DPA.

SICIPL processes Customer personal data only on documented instructions of the Customer, including instructions given through the ChatYug dashboard, APIs, MCP tools, chatbot/commerce configuration, and webhooks the Customer enables.

3. Documented instructions

The Customer instructs SICIPL to process personal data solely to:

• Provide, operate, and support the ChatYug service (messaging, templates, campaigns/broadcasts, chatbot flows, CRM/contacts, commerce/catalogs/orders, media handling, webhooks, External API, and MCP/programmatic access as enabled by the Customer’s plan);
• Transmit data to Meta / WhatsApp Cloud API as required for features the Customer enables;
• Comply with applicable law and binding Meta / WhatsApp platform requirements.

SICIPL will inform the Customer if, in its opinion, an instruction infringes the DPDP Act or other applicable data-protection law (unless prohibited by law from doing so).

4. Processor obligations

SICIPL shall:

• Process personal data only on the Customer’s documented instructions, unless required otherwise by applicable Indian or other binding law (in which case SICIPL will inform the Customer before processing, unless legally prohibited);
• Ensure that persons authorised to process personal data are bound by confidentiality;
• Implement the technical and organisational measures in Annex 2;
• Engage sub-processors only as permitted in Section 6 and Annex 3;
• Assist the Customer, taking into account the nature of processing, with data-principal / data-subject requests, breach notification, and data-protection impact assessments where reasonably required;
• At the end of the service, delete or return personal data as set out in Section 10;
• Make available information reasonably necessary to demonstrate compliance with this DPA.

5. Security measures

SICIPL implements reasonable security practices and procedures consistent with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and industry practice, as summarised in Annex 2. The Customer remains responsible for securing its credentials, API/MCP tokens, team access, and end-user consent records.

6. Sub-processors

The Customer authorises SICIPL to engage the sub-processors listed in Annex 3 (as updated from time to time) to process personal data as needed to provide the service. SICIPL will impose data-protection obligations on sub-processors that are no less protective in substance than those in this DPA, to the extent applicable to the sub-processing.

SICIPL will give the Customer reasonable notice of intended addition or replacement of a material sub-processor (for example by email, dashboard notice, or an updated Annex 3). If the Customer objects on reasonable data-protection grounds, the parties will discuss in good faith; if unresolved, the Customer may terminate the affected service in accordance with the Terms.

Meta Platforms, Inc. / WhatsApp Cloud API is a core sub-processor. Message delivery, template handling, quality ratings, and related WhatsApp features depend on Meta and are outside SICIPL’s sole control.

7. Personal data breach

If SICIPL becomes aware of a personal data breach affecting Customer personal data it processes as Processor, SICIPL will:

• Notify the Customer without undue delay after becoming aware, with available details of the nature of the breach, categories of data affected (where known), and measures taken or proposed;
• Take reasonable steps to contain and remediate the incident;
• Assist the Customer, as reasonably required, with notifications to the Data Protection Board of India, affected Data Principals, and (where GDPR applies) supervisory authorities within applicable timelines, including the GDPR 72-hour framework for Controller notifications where the Customer is Controller.

The Customer is responsible for determining whether notification to authorities or individuals is required under law applicable to the Customer.

8. Assistance with rights and DPIAs

Taking into account the nature of processing and information available to SICIPL, SICIPL will assist the Customer by appropriate technical and organisational measures, insofar as possible, to fulfil the Customer’s obligations to respond to Data Principal / data-subject requests and to carry out data-protection impact assessments or prior consultations where required by law. End users should ordinarily contact the Customer (the business they messaged) first; see also our End-User Data Handling Policy.

9. International transfers

ChatYug is self-hosted by SICIPL on its own cloud infrastructure located in India. Email is sent from SICIPL’s own mail servers. ChatYug is an official product of sicitechnologies.com. No third-party hosting or email provider is used.

Where Customer personal data is transferred outside the Customer’s jurisdiction (including to Meta or other sub-processors), transfers are made subject to applicable law, including the DPDP Act (and any Central Government notifications on restricted territories).

ChatYug does not currently offer services to, or monitor the behaviour of, individuals located in the EU or UK. If and when we onboard customers or data subjects in these regions, we will appoint a representative under Article 27 of the EU/UK GDPR and implement appropriate transfer safeguards such as Standard Contractual Clauses, and update this document accordingly.

10. Return and deletion

Upon termination or expiry of the ChatYug subscription, or earlier written request, SICIPL will delete or return Customer personal data in accordance with the Terms and Privacy Policy (including the one-calendar-month subscription-lapse deletion window), unless retention is required by applicable law (for example GST or other tax records relating to the Customer’s account, which are outside Processor end-user data). The Customer should export data before expiry.

11. Audit rights

Upon reasonable written notice, not more than once per twelve (12) months (unless a material breach is reasonably suspected), SICIPL will make available information and, where proportionate, allow audits or inspections relating to processing under this DPA, conducted by the Customer or an independent auditor bound by confidentiality, during business hours and without unreasonably disrupting operations. Remote questionnaire-based reviews are preferred where they adequately address the Customer’s legitimate concerns.

12. Liability

Liability arising under or in connection with this DPA is subject to the limitations and exclusions in the Terms of Service, including the aggregate liability cap. Nothing in this DPA excludes liability that cannot be excluded under applicable law.

Annex 1 — Description of processing

Subject matter

Processing of personal data as necessary to provide ChatYug WhatsApp Business API platform services to the Customer.

Duration

For the term of the Customer’s ChatYug subscription and any post-termination retention period stated in the Terms / Privacy Policy, unless earlier deleted on instruction where feasible.

Nature and purpose

Hosting, transmission, storage, display, and related processing of messages, contacts, media, delivery/read events, catalogs, orders, chatbot/automation outputs, and API/MCP-initiated actions instructed by the Customer, including via webhooks.

Types of personal data

• WhatsApp / phone numbers and profile names of end users;
• Message content and media (images, video, audio, documents) sent or received;
• Delivery, read, and related webhook event metadata;
• Contact list fields uploaded by the Customer (for example CSV imports);
• Commerce-related order and product interaction data where enabled;
• Other data the Customer elects to store in CRM or automation fields.

Categories of data subjects

The Customer’s customers, prospects, and other individuals the Customer chooses to contact or whose data the Customer uploads (end users / Data Principals relative to the Customer).

Annex 2 — Technical and organisational security measures

• Access control and role-based permissions for Customer accounts and SICIPL personnel;
• HTTPS / TLS encryption in transit;
• Hashed or otherwise protected credentials; scoped API and MCP tokens with plan-based gating;
• Logging and monitoring of security-relevant events, including audit signals for programmatic access where implemented;
• Segregation of Customer data in a multi-tenant architecture;
• Secure development and change practices;
• Personnel confidentiality and need-to-know access;
• Incident response procedures aligned with Section 7.

ChatYug is self-hosted by SICIPL on its own cloud infrastructure located in India. Email is sent from SICIPL’s own mail servers. ChatYug is an official product of sicitechnologies.com. No third-party hosting or email provider is used.

Annex 3 — Approved sub-processors

ChatYug does not use any third-party hosting, email, analytics, error-monitoring, or CRM sub-processors. Application hosting and email are operated by SICIPL on its own infrastructure located in India.

Indian UPI / QR-code payments settle on the UPI network; ChatYug retains a transaction reference (for example a UTR) and invoice record only. Meta conversation charges are billed by Meta separately.