1. Scope and roles
This Data Processing Agreement (“DPA”) is between the Customer named in the workspace (the Data Fiduciary) and [Vettri legal entity name] (the Data Processor). It applies to digital personal data that the Customer or its users put into Vettri HRMS (“Customer Personal Data”), and is governed by the Digital Personal Data Protection Act, 2023 and its rules (“DPDP Act”) and the Information Technology Act, 2000. Terms not defined here have the meaning in the DPDP Act or the Terms of Service.
2. Processing only on instructions
Vettri processes Customer Personal Data only to provide the service, on the Customer’s documented instructions. The Terms, this DPA, and the Customer’s configuration and use of the product (for example enabling modules, the device agent or selfie attendance) are the Customer’s instructions. Vettri will tell the Customer if it believes an instruction breaks the law, and will not process the data for its own purposes.
3. Details of processing
| Data principals | The Customer’s employees, former employees, candidates, contractors and users; contacts such as nominees and emergency contacts. |
|---|---|
| Categories of data | Identity and contact details; employment details; attendance (including biometric device PINs, location and optional selfie at check-in); leave; payroll, tax and statutory identifiers (PAN, UAN, ESI), bank details; documents; expenses; assets; device activity and inventory data from the Windows agent; audit logs. |
| Purpose | Providing HR, attendance, payroll, recruitment, onboarding, expense and IT device management features to the Customer. |
| Duration | The term of the agreement, then as described in section 10. |
4. Confidentiality
Vettri ensures that its personnel who can access Customer Personal Data are bound by confidentiality obligations, receive privacy and security training, and access data only when needed to provide or support the service (for example a support request the Customer raises).
5. Security measures
Vettri maintains reasonable security safeguards appropriate to the risk, including:
- encryption in transit (TLS) and encryption at rest for databases and file storage;
- logical separation of each customer’s data, with company scoping enforced on every request;
- role-based access with organisation, department, team and self scopes, and audit logs of sensitive actions;
- hashed passwords, short-lived sessions, and two-factor authentication that customers can make mandatory;
- least-privilege access for Vettri staff, logging of administrative access, and regular backups;
- vulnerability management and secure development practices.
6. Sub-processors
The Customer authorises Vettri to use the sub-processors listed in the Privacy Policy (currently AWS, Render, Vercel, Razorpay and Zoho Mail [to confirm]). Vettri imposes data protection terms on each sub-processor that are no less protective than this DPA and remains responsible for their performance. Vettri will notify administrators at least 30 days before adding or replacing a sub-processor; the Customer may object on reasonable data protection grounds and, if the parties cannot resolve the objection, terminate the affected service and receive a pro-rata refund of prepaid fees.
7. Data principal requests
Vettri provides tools for the Customer to meet its obligations to data principals: employees can download a copy of their data, request corrections and request erasure from the in-app Privacy page; HR handles requests in a queue with a 30-day due date; erasure anonymises personal fields while preserving records the law requires the Customer to keep. If Vettri receives a request directly, it will redirect the person to the Customer and will not respond itself except as instructed.
8. Personal data breach notification
Vettri will notify the Customer’s breach contact (configured in Settings › Privacy & Data, or the organisation administrators) without undue delay and in any event within [48] hours of becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe the nature of the breach, the data and people likely affected, likely consequences, and the measures taken or proposed. Vettri will help the Customer meet its obligations to inform the Data Protection Board of India and affected data principals, and will meet its own CERT-In reporting obligations.
9. Location and transfers
Customer Personal Data is primarily hosted in India [AWS Mumbai region - to confirm]. Transfers outside India happen only through the sub-processors listed and in compliance with any restrictions notified under section 16 of the DPDP Act.
10. Return and deletion
The Customer can export all workspace data at any time as CSV files from Settings › Privacy & Data. When the Customer requests account deletion, deletion is scheduled after a 30-day grace period during which it can be cancelled. At the end of that period Vettri anonymises personal data and removes the account, and backups expire within [35] days, unless the law requires Vettri to keep particular records. The Customer is responsible for exporting and retaining any records it must keep under labour and tax laws (for example payroll registers for the statutory period).
11. Information and audits
On reasonable written request, and no more than once a year (or after a breach), Vettri will provide information needed to demonstrate compliance with this DPA, such as security documentation, responses to security questionnaires and summaries of third-party assessments. On-site audits require 30 days’ notice, are conducted during business hours under confidentiality, and are at the Customer’s cost.
12. Customer responsibilities
- Have a lawful basis to process employee data and give employees the notices the DPDP Act requires, including a clear notice before using device monitoring (Vettri provides an in-app monitoring notice and consent record).
- Configure access, retention and monitoring-consent settings appropriately, and appoint a grievance officer visible to employees.
- Only upload the data needed for the purposes above, and keep it accurate.
13. General
This DPA lasts as long as Vettri processes Customer Personal Data. The liability limits in the Terms apply. If this DPA conflicts with the Terms regarding personal data, this DPA prevails. Governing law and jurisdiction are as set out in the Terms (India; courts at [city]).