⚙ TECH TEAM: Provide: complete list of all vendors/processors; nature of service; categories of User data processed; and country of data storage for each vendor.
1. PARTIES
- Data Fiduciary: SRIT India Limited, TC 24/3088/2, Ushasandya Building, Dotspace Business Centre, PMG TTC RoadDotSpace, Kowdiar Thiruvananthapuram Kerala 695003 India (CIN: U72200KA1999PLC025692).
- Data Processor: [Vendor Name — TO BE INSERTED] | [Vendor Address] | [Vendor Registration/CIN]
2. DEFINITIONS
| Term |
Definition |
| Data Fiduciary |
SRIT India Limited — determines purpose and means of processing Personal Data. |
| Data Processor |
The third-party vendor executing this Agreement, processing Personal Data only per OPLive's instructions. |
| Processing Instructions |
Written instructions from Data Fiduciary specifying scope, nature, purpose, and duration of processing. |
| Sub-processor |
Any third party engaged by the Data Processor to process Personal Data under this Agreement. |
| Personal Data Breach |
Accidental or unauthorised access, use, disclosure, alteration, or destruction of Personal Data. |
3. DATA PROCESSOR OBLIGATIONS
- Process Personal Data only on documented instructions from OPLive.
- Ensure personnel with data access are bound by confidentiality obligations.
- Implement industry-standard technical and organisational security measures.
- Not engage Sub-processors without prior written authorisation from OPLive.
- Assist OPLive in fulfilling Data Principal rights (access, correction, erasure).
- Notify OPLive within 24 hours of becoming aware of any confirmed or suspected Personal Data Breach.
- Delete or return all Personal Data on termination and provide written certification of deletion.
- Cooperate fully with OPLive audits of data processing activities.
4. SCHEDULE 1 — PROCESSING DETAILS (per vendor)
| Schedule Parameter |
Specification Details |
| Vendor Name |
[TO BE INSERTED] |
| Nature of Service |
[e.g., Cloud Hosting / Payment Processing / SMS / Analytics] |
| Categories of Data Processed |
[e.g., Identity data / Health data / Payment data / Technical data] |
| Purpose |
[e.g., Cloud storage of encrypted consultation records] |
| Retention Period |
[Specific period or 'Duration of commercial agreement + 30 days'] |
| Location of Processing |
[India / Overseas — specify country and region] |
| Sub-processors Approved |
[List any pre-approved sub-processors] |
5. LIABILITY AND GOVERNING LAW
The Data Processor indemnifies OPLive from all claims, penalties, and costs arising from breach of this Agreement, any Personal Data Breach attributable to the Data Processor, or non-compliance with the DPDP Act or SPDI Rules. Governed by laws of India. Jurisdiction: Trivandrum, Kerala.
