1. Purpose and Application

This Data Processing Addendum ("DPA") applies where a Customer organisation ("Company") determines the purposes and means of processing personal data of its own personnel or other data subjects through HOTTRIX CHAT (the "Service"), and Hottrix IT Services Private Limited ("HOTTRIX") processes that data on the Company's behalf and instructions. Where applicable under the Digital Personal Data Protection Act, 2023 and its rules, the Company may act as Data Fiduciary and HOTTRIX as a processing entity acting on the Company's instructions, in each case only to the extent the actual facts of processing support that classification.

2. Subject Matter and Duration

The subject matter of processing is the operation of the Service for the Company, including its communication (chat, file/media sharing, voice notes, voice and video calling) and workforce-management (attendance, leave, payroll) functionality. Processing continues for the duration of the Company's subscription to the Service and, thereafter, for any period required to comply with the Company's instructions regarding data return/deletion, applicable law, or legitimate retention needs described in the Privacy Policy.

3. Nature and Purpose of Processing

HOTTRIX processes personal data to store, transmit, and make available the content and information the Company's users submit to the Service, and to operate the platform's security, access-control, and administrative functionality, all as necessary to provide the Service to the Company in accordance with the Company's configuration and use of it.

4. Categories of Personal Data and Data Subjects

The categories of personal data processed are described in the Privacy Policy. The categories of data subjects are principally the Company's own employees/users (in the Company Admin, HR, Manager, and Employee roles) and, incidentally, any other individuals referenced within content those users submit (for example, in a chat message).

5. Customer Instructions

HOTTRIX will process personal data submitted to the Service only in accordance with the Company's documented instructions, which are given principally through the Company's configuration and use of the Service (including actions taken by its Company Admin and HR users), and as otherwise agreed in writing between the parties.

6. Confidentiality

HOTTRIX personnel authorised to access Company data are subject to confidentiality obligations appropriate to their role.

7. Security Safeguards

HOTTRIX implements the technical and organisational security measures described in the Security & Data Protection Policy, including tenant isolation, role-based access control, encrypted password storage, CSRF protection, input validation, and authenticated file access.

8. Sub-processors

HOTTRIX may engage third-party infrastructure providers (such as hosting/database providers, and publicly available network-traversal services used to help establish peer-to-peer calls) as necessary to operate the Service. HOTTRIX remains responsible for such sub-processors' handling of Company data to the extent required by applicable law and any separate written agreement with the Company.

9. Data Breach Notification

HOTTRIX will notify the affected Company without undue delay upon becoming aware of a confirmed personal data breach affecting that Company's data, and will provide reasonably available information to assist the Company in meeting any of its own notification obligations under applicable law.

10. Assistance with Data Subject Requests

Taking into account the nature of processing, HOTTRIX will provide reasonable assistance to the Company in responding to requests from data subjects seeking to exercise their rights under applicable data protection law, where such requests relate to data processed through the Service.

11. Data Return and Deletion

Upon termination of the Company's subscription, HOTTRIX will, at the Company's choice and to the extent technically feasible, make Company data available for export, and/or delete it in accordance with the Refund/Cancellation Policy and applicable law, unless a longer retention period is required by law.

12. International Transfers

Where personal data is transferred outside India in connection with the Service's hosting or infrastructure arrangements, HOTTRIX will do so in accordance with applicable requirements under Indian law in force at the relevant time.

13. Audit and Cooperation

HOTTRIX will reasonably cooperate with the Company to demonstrate compliance with this DPA, including by providing relevant information about its security practices, subject to reasonable confidentiality and operational constraints.

14. Termination

This DPA terminates automatically upon termination of the Company's subscription to the Service, without prejudice to obligations (such as confidentiality and data deletion/return) that by their nature survive termination.

15. Contact

Hottrix IT Services Private Limited
Legal Email: info@hottrix.in