Data Processing Addendum
Last updated: 9 September 2026
This Data Processing Addendum (DPA) describes how Agicentral will process personal data on behalf of a customer organisation once they use the platform (for example, personal data a customer uploads to their Personal Data Processing Register, or manages through Data Mapping or Incident Management). It's published here so prospective customers can review it ahead of signing; a signed, dated copy will form part of the commercial agreement with each customer.
1. Roles of the parties
For data a customer manages within the platform, the customer is the Data Fiduciary under the DPDPA. They decide what personal data to record and why. Agicentral acts as a processor engaged by the customer, handling that data only on the customer's documented instructions and for the purpose of providing the platform.
2. Scope of processing
This DPA covers personal data that a customer's authorised users choose to enter into their workspace (such as records in their Personal Data Processing Register, data-mapping diagrams, task and incident details, and supporting evidence) for as long as the customer maintains an active workspace.
3. Our obligations
When processing a customer's workspace data, we commit to:
- Process it only as instructed by the customer through their normal use of the platform, or as required by law.
- Keep it confidential, and limit access to personnel and sub-processors who need it to operate the platform.
- Apply reasonable technical and organisational security measures appropriate to the sensitivity of the data. See Section 6.
- Notify the customer without undue delay if we become aware of a personal data breach affecting their workspace data.
- Assist the customer in responding to a data principal exercising their rights (access, correction, erasure, and so on) where that request relates to data held in their workspace.
- Delete or return workspace data at the end of the relationship, as described in Section 7.
4. Sub-processing
We use a limited number of sub-processors to help deliver the platform (for hosting, email delivery, and similar infrastructure). Our current list is published on the Sub-processors page. We'll give customers reasonable notice before adding a new sub-processor with access to their workspace data, so they can raise an objection.
5. Data location and transfers
Our plan is India-first hosting for customer workspace data on the platform. Where a sub-processor is located outside India, we'll only use them where the DPDPA permits, and we'll keep the Sub-processors page current so customers can see exactly where their data may be handled.
6. Security measures
We apply reasonable safeguards appropriate to a platform handling personal data readiness records, including encryption of data in transit, access controls limiting who can view workspace data, and role-based permissions within each customer's workspace. As the platform matures, we intend to formalise and publish more detail here, including any independent audits or certifications we obtain.
7. Data return and deletion
When a customer's subscription ends, we will, at their choice, return their workspace data in a reasonable exportable format or delete it, within a reasonable period, except where we're required to retain it by law.
8. Liability
Liability under this DPA follows the terms of the main commercial agreement between the customer and us. Nothing here is intended to create liability beyond what that agreement sets out.
9. Executing this DPA
This page describes our standard DPA terms. To request a signed, countersigned copy for your organisation's records, contact us through the Contact page.