Data Processing Agreement

This Data Processing Agreement (DPA) defines the relationship between you (the Controller) and Nexline Global Pvt. Ltd. (the Processor) when processing personal data.

Effective as of: July 13, 2026

Parties:

• Data Controller: You (the user/organization)
• Data Processor: Nexline Global Pvt. Ltd., 484 Near HP Petrol Pump, Kishanganj, District Baran, Rajasthan, India — PIN 325216

This DPA applies when you use Uprity to process personal data of customers, employees, or other data subjects. It is mandatory for customers subject to:

• GDPR (EU/UK): General Data Protection Regulation
• DPDPA 2023 (India): Digital Personal Data Protection Act
• CCPA/CPRA (California): California Privacy Laws
• Other data protection laws requiring processor agreements

By using Uprity to process personal data, you agree to this DPA.

• Personal Data: Any information relating to an identified or identifiable natural person
• Processing: Any operation on personal data (collection, storage, analysis, sharing, deletion)
• Data Subject: The individual to whom personal data relates
• Sub-processor: A third party engaged by the Processor to process personal data
• Data Breach: Unauthorized access to or disclosure of personal data

The Processor processes personal data only on documented instructions from the Controller, including:

• Purpose of processing (review management, analytics, reporting)
• Duration of processing (until account deletion or policy change)
• Nature of processing (collection, storage, analysis)
• Categories of data (names, emails, business data, review content)
• Categories of data subjects (customers, reviewers)

Instructions are defined in the Privacy Policy and Terms of Service.

The Processor implements appropriate technical and organizational measures to protect personal data:

• Encryption in transit (TLS 1.3+) and at rest
• Access control (authentication, authorization, role-based permissions)
• Password security (hashing with Argon2, history enforcement, lockout policy)
• WebAuthn / passkey support for multi-factor authentication
• Daily encrypted backups stored in secure, redundant systems
• Regular security audits and penetration testing
• Data minimization (collect only necessary data)

See our Security page for full details.

The Processor engages sub-processors (third-party service providers) to process personal data. The Controller is informed of all sub-processors via the Sub-processors list.

The Processor:

• Only engages sub-processors with documented processing agreements
• Ensures sub-processors provide equivalent security and confidentiality
• Notifies the Controller of changes to the sub-processor list
• Provides opt-out mechanisms where legally required

The Processor assists the Controller in responding to data subject requests for:

• Access: Providing a copy of their personal data (via data export feature)
• Correction: Updating inaccurate data
• Deletion: Removing their personal data (right to be forgotten)
• Portability: Transferring data to another controller (via export)
• Objection: Opting out of marketing or profiling
• Restriction: Limiting processing pending investigation

Requests must be submitted through your account or via privacy@uprity.com. The Processor acknowledges requests promptly and responds within 30 days (consistent with our Privacy Policy), or any shorter period required by applicable law.

Upon discovering a personal data breach affecting the Controller's personal data, the Processor notifies the Controller without undue delay, and in any case within 72 hours of discovery, so that the Controller can meet its own notification obligations (e.g., to supervisory authorities under GDPR, or to the Data Protection Board of India and affected data principals under the DPDPA 2023 and its Rules). Where Nexline Global Pvt. Ltd. is itself the Data Fiduciary for the affected data, it will make those notifications directly.

Notification includes:

• Description of the breach (what data, how many individuals affected)
• Likely impact and remediation measures
• Contact point for further information

Personal data may be transferred to countries outside the data subject's jurisdiction. For transfers between India and the EU, the Processor relies on:

• Standard Contractual Clauses (SCCs): EU-approved contractual safeguards
• Adequacy Decisions: Where an equivalency determination exists
• Explicit Consent: From the Controller or data subject where required

An SCCs annex is appended to this DPA and available upon request.

This DPA remains in effect for the duration of the Service. Upon termination:

• The Processor returns or deletes all personal data at the Controller's election
• The Processor certifies deletion in writing within 30 days
• Obligations regarding sub-processors and confidentiality survive termination

The Controller may audit the Processor's compliance with this DPA through:

• Written responses to reasonable security questionnaires and documentation of our security measures (see the Security page)
• Scheduled compliance audits (on request, with reasonable notice, at the Controller's expense, no more than once per year)
• Review of incident logs and breach response procedures relevant to the Controller's data

If and when we obtain third-party security certifications (e.g., SOC 2), reports will be made available under NDA on request.

The Processor's aggregate liability under this DPA is subject to the same limitations and cap as the Terms of Service (fees paid in the 3 calendar months preceding the claim), except where applicable data protection law does not permit such limitation.

The Processor may modify this DPA if required by law. Material changes are communicated 30 days in advance. The Controller may terminate the Service if changes are unacceptable.

This DPA is executed by and between the Parties as of the Effective Date. It supplements the Terms of Service and Privacy Policy.

For Enterprise customers: A signed DPA PDF is available upon request. Email legal@uprity.com for execution.

Questions about this DPA?

• Data Protection Officer: privacy@uprity.com
• Legal inquiries: legal@uprity.com