Data Processing Addendum

1. Scope and roles

This DPA forms part of the Terms and applies while Zertical Private Limited processes personal data contained in customer records to provide MSMENXT. The customer ordinarily acts as Data Fiduciary for that content and Zertical Private Limited acts as Data Processor on the customer's documented instructions. Zertical Private Limited separately acts as Data Fiduciary for its own account, security, subscription, support and legal-compliance records.

2. Processing details

Subject and duration: provision of the subscribed MSMENXT workspace for the subscription and deletion lifecycle. Nature and purpose: hosting, extraction, confirmation, calculation, reconciliation, reporting, support, security, export and deletion. Data subjects: authorised users and persons represented in customer-uploaded employee, customer, supplier, director, banking or trade records. Data: identity, contact, employment, transaction, financial, operational and audit data supplied by the customer.

3. Processor commitments

• Process customer content only to provide and secure the service, comply with documented instructions, or meet applicable law.
• Restrict access to authorised personnel and subprocessors subject to confidentiality and appropriate safeguards.
• Maintain proportionate technical and organisational security described at /retention-security.
• Assist the customer, taking account of the nature of processing, with verified individual-rights requests, security incidents, deletion and compliance information.
• Notify the customer without undue delay after confirming a personal-data breach affecting the customer's workspace, subject to lawful restrictions.
• Return or delete customer data according to the documented export and deletion process at the end of service, unless retention is required by law.

4. Customer instructions and obligations

The Terms, enabled features, user actions and written support requests are the customer's documented instructions. The customer is responsible for lawful collection, notices, authority, accuracy, user permissions and deciding whether MSMENXT is suitable for a particular regulated record or decision.

5. Subprocessors and transfers

The customer gives general authorisation for the subprocessors listed at /subprocessors. A material new category or provider will be published before use where practicable. Zertical Private Limited remains responsible for imposing appropriate data-protection obligations on its subprocessors. Cross-border processing will follow applicable Indian restrictions.

6. Audit information and precedence

On reasonable written request, Zertical Private Limited will provide available information reasonably necessary to demonstrate these commitments, subject to confidentiality, security and protection of other customers. This DPA prevails over inconsistent Terms only for personal-data processing.