Data Processing Agreement (DPA)

2. Roles of the Parties

The parties acknowledge and agree that:

• Customer acts as the Data Fiduciary (under the DPDP Act) or Data Controller (under GDPR). The Customer determines the purposes, categories, and lawful basis for collecting and qualifying lead details.
• NeetiCRM acts as the Data Processor. NeetiCRM only processes personal data on behalf of and according to the instructions of the Customer, as outlined in the Terms of Service and this DPA.

3. Processing & Instructions

NeetiCRM shall:

• Process Customer Lead Data solely in accordance with the Customer’s written instructions, including configurations set up in the workflow builder, dashboard campaigns, and webhook links.
• Ensure that all personnel authorized to process lead data are bound by strict obligations of confidentiality.
• Promptly inform the Customer if, in our opinion, an instruction from the Customer violates applicable data protection regulations.

4. Technical & Organizational Measures

We implement and maintain industry-standard security controls to protect lead data against unauthorized access, loss, alteration, or disclosure. These controls include:

• Encryption of all personal data at rest (AES-256) and in transit (TLS 1.3).
• Vulnerability monitoring, firewalls, and regular security patching of our database hosting environments.
• Access tracking, role-based controls, and security awareness training for NeetiCRM engineering and operations staff.
• Audit logs that record API queries and administrative changes made inside your workspace.

5. Sub-processors

The Customer grants NeetiCRM general authorization to engage sub-processors to perform infrastructure, hosting, AI transcription, and payment processing tasks.

We list all active sub-processors in our Privacy Policy. We ensure that our contracts with sub-processors impose data protection obligations no less restrictive than those set out in this DPA.

We will notify you of any additions or replacements to our sub-processor directory via email or system notification. If you have reasonable grounds to object to a new sub-processor on security or data protection grounds, you must notify us in writing within ten (10) days of receiving the update.

6. Security Incident Notification

In the event of a confirmed security incident leading to the unauthorized access, disclosure, or loss of Customer Lead Data hosted on NeetiCRM (a “Data Breach”):

• We will notify the Customer without undue delay, and in any case within seventy-two (72) hours of confirming the breach.
• Our notification will describe the nature of the breach, the estimated volume of affected lead records, and our mitigation actions.
• We will immediately take all necessary measures to secure our infrastructure and prevent further data exposure.

7. Data Return & Deletion

During the active subscription term, you may export your lead records, logs, and transcripts from the dashboard at any time.

Upon termination of your account or subscription:

• NeetiCRM will retain lead data in an archival state for up to ninety (90) days to allow you to renew or download your records.
• After this retention window, we will permanently delete all Customer Lead Data, call recordings, and chat transcripts from our active databases and servers.
• Data residing in secure database backups will be systematically overwritten according to our 30-day backup cycle.

Annex A: Details of Processing