At Fenricstitch, the processing of personal data is treated as a core responsibility rather than a mere compliance requirement. This Data Processing Agreement (DPA) defines the framework under which Personal Data is handled when you use our services. It establishes a clear, transparent relationship between you, acting as the Data Controller, and us, acting as the Data Processor, outlining how data is processed, protected, and managed throughout the service lifecycle.
For the purposes of this DPA, “we,” “us,” or “our” refers to Fenricstitch, while “you” or “your” refers to the individual or entity agreeing to these terms. By accepting this agreement, both parties confirm a shared commitment to lawful, secure, and responsible data processing in accordance with applicable regulations.
A secure data ecosystem depends on clearly defined responsibilities. This section explains how accountability is divided to ensure transparency and compliance at every stage of data handling.
The Data Controller determines why Personal Data is processed and how it should be used. This includes identifying lawful grounds for processing, ensuring compliance with applicable data protection laws, and providing clear instructions regarding the handling of Personal Data.
The Data Processor processes Personal Data strictly based on the Controller’s documented instructions. Processing is limited to what is necessary for providing the agreed services, and all activities are carried out in a manner that supports confidentiality, integrity, and regulatory compliance.
Personal Data is processed only to support legitimate and defined operational needs. This section outlines the nature and purpose of processing activities undertaken by Fenricstitch.
We process Personal Data solely to enable essential functions such as completing transactions, performing required verifications, strengthening security controls, preventing unauthorized or fraudulent activity, and maintaining accurate operational and regulatory records. All processing activities are limited to what is relevant and necessary for delivering services effectively and securely.
All data processing is conducted in line with RBI, NPCI, and applicable payment network requirements, ensuring consistency, reliability, and adherence to regulatory expectations.
Protecting Personal Data is fundamental to how Fenricstitch operates. This section describes the safeguards implemented to reduce risk and prevent unauthorized access or misuse.
We apply layered technical and organizational security measures designed to protect data throughout its lifecycle. These include encryption of data during transmission and storage, controlled access through multi-factor authentication, secure handling of cryptographic materials, routine security testing, and ongoing staff training focused on confidentiality and data protection obligations. Together, these controls create a resilient and secure processing environment.
Respecting individual rights is a key part of responsible data processing. This section explains how data subject requests are supported.
In cooperation with the Data Controller, we assist in fulfilling requests from data subjects relating to their Personal Data. This includes access to information, correction of inaccuracies, deletion where legally permitted, data portability, and restrictions or objections to certain processing activities. Support is provided in a timely and structured manner to ensure that individual rights are upheld in accordance with applicable laws.
In certain circumstances, third-party service providers may be involved in processing activities. This section outlines how such engagements are governed.
Subprocessors are appointed only with prior written approval from the Data Controller. Each Subprocessor is required to meet equivalent data protection and security standards, enter into binding confidentiality and data protection agreements, and process Personal Data solely for authorized purposes. These controls ensure that accountability and data protection are maintained even when processing is delegated.
Despite preventive measures, security incidents may occur. This section explains how such events are handled.
If a Personal Data breach is identified, Fenricstitch notifies the Data Controller within 24 hours of becoming aware of the incident. The notification includes a description of the breach, the type and estimated volume of affected data, mitigation actions taken, and measures planned to prevent recurrence. Prompt communication enables swift response and risk management.
Ongoing oversight is essential for maintaining trust. This section describes audit and compliance obligations.
The Data Controller may conduct audits of the Processor’s data processing activities with reasonable prior notice. During such reviews, the Processor provides relevant policies, procedures, certifications, and compliance evidence demonstrating adherence to this DPA. Audits help verify that contractual and regulatory commitments are actively maintained.
Responsible data handling includes limiting how long information is retained. This section explains retention and disposal practices.
Personal Data is retained only for as long as required to fulfill processing purposes or meet legal and regulatory obligations. Once data is no longer necessary, it is securely deleted or returned to the Data Controller, unless retention is mandated by applicable law. This approach minimizes exposure while preserving compliance.
Regulatory requirements evolve over time. This section addresses how changes are managed. When new or amended laws affect Personal Data processing, Fenricstitch informs the Data Controller without undue delay. Early notification allows both parties to adapt procedures and controls, ensuring continued compliance and uninterrupted service delivery.
Clear allocation of responsibility supports fairness and accountability. This section outlines liability principles. Each party remains responsible for its own obligations under this DPA. If a party fails to comply and causes loss or damage, that party bears the resulting liability. The Processor further agrees to indemnify the Controller against claims, penalties, or losses arising from the Processor’s breach of applicable data protection requirements.
A defined legal framework ensures clarity in enforcement. This section specifies jurisdiction. This DPA is governed by the laws of India. Any disputes arising from or related to this agreement fall under the exclusive jurisdiction of the courts of India.
Changes must be clearly documented to avoid ambiguity. This section explains how updates are made. Any modification to this DPA is valid only if recorded in writing and mutually agreed upon by both parties. This ensures that responsibilities and obligations remain clear, current, and enforceable.
By agreeing to this DPA, both parties confirm that they have reviewed, understood, and accepted all terms set out herein. This acknowledgment reflects a shared commitment to handling Personal Data with care, security, and accountability, reinforcing trust between the Data Controller and the Data Processor.
