Capisso Business Services - Outsourced Bookkeeping & Software Development

Introduction

This Data Processing Agreement ("DPA") forms part of the service agreement between Capisso Business Services ("Processor," "we," "us," or "our") and the client ("Controller," "you," or "your") for the provision of bookkeeping and software development services.

This DPA governs the processing of personal data by Capisso on behalf of the Controller in accordance with applicable data protection laws, including but not limited to the General Data Protection Regulation (GDPR) and other relevant privacy legislation.

1. Definitions

For the purposes of this DPA, the following definitions apply:

"Controller"

The client who determines the purposes and means of processing personal data.

"Processor"

Capisso Business Services, which processes personal data on behalf of the Controller.

"Personal Data"

Any information relating to an identified or identifiable natural person.

"Processing"

Any operation performed on personal data, including collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure, or destruction.

"Data Subject"

An identified or identifiable natural person.

"Sub-processor"

Any third party engaged by the Processor to process personal data on behalf of the Controller.

2. Scope and Nature of Processing

2.1 Subject Matter

The processing of personal data is necessary for the provision of bookkeeping and software development services as outlined in the main service agreement.

2.2 Duration

Processing will continue for the duration of the service agreement and any applicable retention periods as specified in our Privacy Policy or as required by law.

2.3 Purpose of Processing

Providing bookkeeping and financial management services
Developing and maintaining software applications
Managing client relationships and communications
Ensuring compliance with legal and regulatory requirements
Providing technical support and maintenance

2.4 Categories of Data Subjects

Client employees and contractors
Client customers and suppliers
End users of developed software applications
Other individuals whose data is processed in connection with our services

2.5 Categories of Personal Data

Contact information (names, addresses, phone numbers, email addresses)
Financial information (bank details, payment information, transaction records)
Employment information (job titles, salary information, tax details)
Technical data (IP addresses, system logs, usage data)
Other business-related information necessary for service provision

3. Processor Obligations

3.1 Processing Instructions

We will process personal data only on documented instructions from the Controller, including with regard to transfers of personal data to third countries or international organizations.

3.2 Confidentiality

We ensure that persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

3.3 Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

Encryption of personal data in transit and at rest
Regular security assessments and penetration testing
Access controls and authentication mechanisms
Regular backup and disaster recovery procedures
Employee training on data protection and security
Incident response and breach notification procedures

3.4 Sub-processing

We may engage sub-processors with the Controller's prior written consent. We maintain a list of authorized sub-processors and will notify the Controller of any intended changes to this list.

4. Data Subject Rights

We will assist the Controller in fulfilling data subject rights requests, including:

Right of access to personal data
Right to rectification of inaccurate personal data
Right to erasure ("right to be forgotten")
Right to restriction of processing
Right to data portability
Right to object to processing
Rights related to automated decision-making and profiling

We will respond to data subject requests forwarded by the Controller within a reasonable timeframe and provide necessary technical and organizational assistance.

5. International Data Transfers

Personal data may be transferred to and processed in countries outside the European Economic Area (EEA), including India where our primary operations are located.

5.1 Transfer Safeguards

For transfers to countries without an adequacy decision, we implement appropriate safeguards:

Standard Contractual Clauses (SCCs) approved by the European Commission
Binding Corporate Rules where applicable
Certification schemes and codes of conduct
Additional technical and organizational measures as required

5.2 Transfer Impact Assessment

We conduct transfer impact assessments to ensure that the level of protection of personal data is not undermined by the transfer.

6. Data Breach Notification

6.1 Notification Obligation

We will notify the Controller without undue delay after becoming aware of a personal data breach, and in any case within 72 hours of discovery.

6.2 Breach Information

The notification will include:

Description of the nature of the breach
Categories and approximate number of data subjects affected
Categories and approximate number of personal data records affected
Likely consequences of the breach
Measures taken or proposed to address the breach
Contact details for further information

6.3 Assistance

We will provide reasonable assistance to the Controller in notifying supervisory authorities and data subjects as required by applicable law.

7. Audits and Inspections

7.1 Audit Rights

The Controller has the right to conduct audits and inspections to verify compliance with this DPA and applicable data protection laws.

7.2 Audit Process

Audits must be conducted with reasonable advance notice
Audits should be conducted during normal business hours
The Controller may use qualified third-party auditors
We will provide reasonable cooperation and access to relevant information

7.3 Audit Costs

The Controller will bear the costs of audits unless the audit reveals material non-compliance with this DPA.

8. Data Protection Impact Assessment

We will provide reasonable assistance to the Controller in conducting Data Protection Impact Assessments (DPIAs) when required by applicable law, including:

Providing information about our processing activities
Describing technical and organizational security measures
Assisting in risk assessment and mitigation strategies
Supporting consultation with supervisory authorities when required

9. Return and Deletion of Personal Data

9.1 End of Processing

Upon termination of the service agreement, we will, at the Controller's choice, return or securely delete all personal data and any copies thereof.

9.2 Legal Requirements

We may retain personal data to the extent required by applicable law, provided that we ensure the confidentiality of such data and process it only for the purposes specified by law.

9.3 Certification

Upon request, we will provide written certification that personal data has been returned or securely deleted in accordance with this DPA.

10. Liability and Indemnification

10.1 Liability Allocation

Each party's liability under this DPA is subject to the limitation of liability provisions in the main service agreement.

10.2 Regulatory Fines

In case of regulatory fines or penalties imposed due to non-compliance with this DPA, liability will be allocated based on the respective party's degree of responsibility for the non-compliance.

11. Governing Law and Dispute Resolution

This DPA is governed by the same law as the main service agreement. Any disputes arising from this DPA will be resolved through the dispute resolution mechanisms specified in the main service agreement.

Nothing in this DPA reduces the Controller's or data subjects' rights under applicable data protection laws.

12. Contact Information

For any questions or concerns regarding this DPA or our data processing activities, please contact:

Data Protection Officer

Capisso Business Services

Address: Opp Civil Station, Mahe, Puducherry, India

Email: dpo@capisso.in

Phone: +91 XXX XXX XXXX

Website: capisso.in

13. Amendments

This DPA may be amended only by written agreement between the parties. We may update this DPA to reflect changes in applicable data protection laws, provided that such updates do not reduce the level of protection afforded to personal data.