Data Processing Agreement

This Data Processing Agreement (DPA) forms part of the Terms of Service and applies whenever Fininvo processes personal data on your behalf in providing the services. In that context you act as the controller (or, where you process on behalf of another, as a processor) and Fininvo acts as the processor (or sub-processor), as those terms are used in the GDPR and the DPDP Act.

The parties agree that the Terms of Service and this DPA constitute your complete and documented instructions regarding our processing of your personal data. We process personal data only in accordance with those documented instructions, except where law requires otherwise, in which case we will inform you unless prohibited from doing so.

The services provide controls and security features that you can use to retrieve, correct, delete, export or restrict personal data. You are responsible for configuring and using those controls, and for the lawfulness of the personal data you provide and the instructions you give.

You authorise Fininvo to engage sub-processors to help deliver the services. Our current sub-processors are listed on the Sub-processors page, with their purpose and location.

We remain responsible for our sub-processors' performance of their data protection obligations.

Where personal data is transferred across borders to a country without an adequacy decision, the transfer is governed by the European Commission Standard Contractual Clauses (SCCs), which are incorporated into this DPA by reference, together with the UK International Data Transfer Addendum and the Swiss addendum where those regimes apply. Transfers of Indian data principals' data occur only to countries not restricted under the DPDP Act.

We ensure that personnel authorised to process personal data are bound by confidentiality.

We make available information reasonably necessary to demonstrate compliance with this DPA and, subject to confidentiality and reasonable notice, allow for audits. We assist you, taking into account the nature of processing, with data subject requests, data protection impact assessments and consultations with supervisory authorities.

On termination, you may export your personal data for 30 days. After that period, we delete or return the personal data we process on your behalf and delete existing copies, except where law requires continued retention. Backups are purged in line with our backup cycle.