Data Processing Agreement

This Data Processing Agreement (DPA) describes how BCDRPulse processes personal data on behalf of customers who use our Service. It is intended for customers who need a processor agreement for their own compliance obligations.

If you require a signed DPA, contact us at support@bcdrpulse.com and we will arrange it.

For personal data processed through the Service, the customer is the data controller (or, where applicable, a processor acting for its own customers) and BCDRPulse acts as the data processor (or sub-processor). Each party will comply with its obligations under applicable data protection law, including the Digital Personal Data Protection Act, 2023 (India) and, where it applies, the EU/UK General Data Protection Regulation.

• Subject matter: provision of the BCDRPulse service — monitoring, performance and security testing, and reporting on the customer's verified assets.
• Duration: for as long as the customer uses the Service, plus any retention period required by law.
• Nature and purpose: hosting, processing, and analysing the data necessary to deliver the Service and its reports.
• Types of personal data: account identifiers (name, email) and any personal data incidentally contained in the assets or results the customer chooses to process.
• Categories of data subjects: the customer's authorised users and personnel.

• Process personal data only on the customer's documented instructions, including as set out in this DPA and the Terms of Service.
• Ensure that personnel authorised to process the data are bound by confidentiality.
• Implement appropriate technical and organisational security measures (see our Security page).
• Assist the customer, so far as reasonably possible, in responding to data-subject requests and in meeting its security, breach-notification, and impact-assessment obligations.
• Notify the customer without undue delay after becoming aware of a personal-data breach affecting the customer's data.
• On termination, delete or return the customer's personal data, except where retention is required by law.

The customer authorises BCDRPulse to engage the sub-processors listed on our Subprocessors page to help deliver the Service. We will impose data-protection obligations on those sub-processors comparable to those in this DPA, and we will provide a way to learn of changes so the customer can object on reasonable grounds.

Some of our sub-processors operate outside India. Where personal data is transferred internationally, we rely on the safeguards described by those providers and on mechanisms permitted by applicable law.

On reasonable written request, and subject to confidentiality, we will make available the information necessary to demonstrate compliance with this DPA. The specific audit mechanism should be agreed between the parties.

This DPA takes effect when the customer accepts it or the Terms of Service and continues for as long as we process personal data on the customer's behalf.