This Data Processing Agreement ("DPA") applies when DGo Digital handles personal data for a client while delivering services under a signed proposal, statement of work or services agreement (the "Agreement"). It becomes binding only when the Agreement refers to it or both parties sign it. This public version shows the terms we offer; we sign a copy with each client on request.
- DGo Digital: DGo Digital (proprietor: Darpan Kumar, sole proprietorship), Santacruz, Mumbai, Maharashtra 400055, India ("Processor"). The contracting party is Darpan Kumar, trading as DGo Digital.
- Client: the business named in the Agreement ("Controller").
1. Roles and scope
- The client is the controller (or "business" under US state laws, or "data fiduciary" under India's DPDP Act) for the personal data it gives us or lets us access. DGo Digital is the processor (or "service provider", "contractor" or "data processor").
- This DPA covers only that client personal data. Data we collect about the client's own staff to run the relationship (for example contact details for invoices) is covered by our Privacy Policy.
2. Details of the processing
| Criteria | Description |
|---|---|
| Subject matter | The services in the Agreement: marketing and analytics audits and set-up, campaign management, CRM and email automation, brand and domain protection, AI consulting |
| Duration | The term of the Agreement, plus the return or deletion period in section 10 |
| Nature and purpose | Reviewing, configuring and reporting on the client's marketing, analytics, CRM and advertising systems; preparing findings and deliverables |
| Data subjects | The client's prospects, leads, customers, website visitors and staff |
| Types of data | Contact details, business details, online identifiers, campaign and analytics data, CRM records, communication data, and other data the client chooses to share |
| Sensitive data | None, unless agreed in writing with extra safeguards |
| Item | Description |
|---|---|
| Subject matter | The services in the Agreement: marketing and analytics audits and set-up, campaign management, CRM and email automation, brand and domain protection, AI consulting |
| Duration | The term of the Agreement, plus the return or deletion period in section 10 |
| Nature and purpose | Reviewing, configuring and reporting on the client's marketing, analytics, CRM and advertising systems; preparing findings and deliverables |
| Data subjects | The client's prospects, leads, customers, website visitors and staff |
| Types of data | Contact details, business details, online identifiers, campaign and analytics data, CRM records, communication data, and other data the client chooses to share |
| Sensitive data | None, unless agreed in writing with extra safeguards |
3. Instructions
We process client personal data only on the client's documented instructions (the Agreement, this DPA and written requests), unless the law requires otherwise, in which case we tell the client first unless the law forbids it. If we believe an instruction breaks data protection law, we say so and may pause that processing.
4. Confidentiality
Only Darpan Kumar and any approved subprocessor or named specialist bound by a written confidentiality duty may access client personal data, and only as needed for the services.
5. Security
We apply the measures in our Security Center, including: read-only access wherever possible; no shared passwords; two-factor sign-in on every account; encryption in transit; secrets stored encrypted; access removed at the end of the work; no copies of client data on personal devices beyond what the work needs, deleted when it ends.
6. Subprocessors
- The client gives general authorization for the client-work subprocessors in section 2 of our Subprocessors page and for specialists named in the Agreement. Our website and advertising vendors are not subprocessors of client personal data, and we do not move client personal data into consumer email or spreadsheet accounts.
- We tell the client at least 15 days before adding or replacing a subprocessor that will handle client personal data. The client may object on reasonable data protection grounds; if we cannot resolve the objection, either party may end the affected services.
- Each subprocessor is bound by data protection terms at least as protective as this DPA, and we remain responsible for its performance.
7. Helping the client
Taking into account the nature of the processing, we help the client to:
- answer requests from data subjects (we pass on any request we receive within 5 business days);
- meet its security, breach notification, impact assessment and regulator consultation duties.
8. Personal data breaches
We notify the client without undue delay, and in any case within 48 hours of becoming aware of a breach affecting client personal data, with the information we have (what happened, data and people affected, likely effects, steps taken), and we update it as we learn more. We also give any notice India's CERT-In Directions require of us.
9. Audits
On reasonable written notice, and no more than once a year unless a breach or a regulator requires it, we make available the information needed to show compliance with this DPA and allow an audit by the client or an auditor bound by confidentiality, at the client's cost and without disrupting other clients.
10. Return and deletion
When the services end, we return client personal data on request and then delete it, including copies, within 30 days, unless the law requires us to keep it. We confirm deletion in writing on request.
11. International transfers
DGo Digital is based in India. Where client personal data from the EU, EEA, UK or Switzerland is transferred to us or to a subprocessor outside those regions, the parties rely on the European Commission's Standard Contractual Clauses (Module 2 or 3 as applicable), with the UK International Data Transfer Addendum or the Swiss amendments where relevant, which are incorporated by reference. The options are completed in the signed copy: Clause 7 (docking clause), Clause 9(a) (subprocessor authorization option and notice period), Clause 11 (redress option), Clause 13 (competent supervisory authority), Clause 17 (governing law), Clause 18 (forum), and Annexes I to III (parties, description of the transfer, technical and organizational measures). Where Indian law restricts transfers to a country, we follow that restriction.
12. US state laws (CCPA, CPRA and similar)
As a service provider or contractor, we:
- do not sell or share client personal data, or use it for targeted advertising for anyone other than the client;
- do not keep, use or disclose it outside the direct business relationship or for any purpose other than the services;
- do not combine it with personal data from other sources except as the law allows for the services;
- comply with the applicable laws and give the same level of protection they require;
- tell the client if we can no longer meet these duties, and allow the client to take reasonable steps to stop unauthorized use.
13. India (DPDP Act, 2023)
We process client personal data only to deliver the services, apply reasonable security safeguards, help the client meet its duties as data fiduciary (including notices, consent withdrawal, grievance handling and breach reporting), and delete the data when the purpose is served or the client asks.
14. Order of precedence
If this DPA conflicts with the Agreement on data protection, this DPA applies. If it conflicts with the Standard Contractual Clauses, the Clauses apply.