Data Processing Addendum

Last updated 6 September 2026  ·  Varnan Digital (OPC) Private Limited  ·  CIN U62090KL2025OPC096808

This Addendum applies whenever Varnan processes personal data on a client’s behalf. It forms part of the Client Service Terms and any signed agreement between us, and sets out the obligations each side takes on.

1. Scope of processing

2. Our obligations as processor

Varnan will:

• Process personal data only on your documented instructions, including for transfers, unless the law requires otherwise, in which case we will tell you first unless prohibited from doing so.
• Tell you promptly if in our opinion an instruction breaches applicable data protection law. We may decline to act on it.
• Ensure everyone authorised to process the data is bound by confidentiality.
• Implement the security measures in section 4.
• Respect the conditions in section 5 before engaging a sub-processor.
• Assist you with data subject requests, impact assessments and regulator consultations, taking into account the nature of the processing and the information available to us.
• Delete or return personal data at the end of the engagement as set out in section 9.
• Make available the information reasonably needed to demonstrate compliance, and allow audits under section 10.
• Keep a record of the processing we carry out for you.

3. Your obligations as controller

You warrant that:

• You have a valid lawful basis for the processing you instruct, and where consent is the basis, that it was validly obtained and is recorded.
• Your privacy notice accurately describes the processing we carry out for you, including any tracking, profiling and AI-assisted automation.
• You have the right to disclose the personal data to us and to the platforms named in the statement of work.
• Any customer list you ask us to upload to an advertising platform was collected with consent covering that use.
• Your instructions to us will not put us in breach of data protection law.

You remain responsible for the accuracy and quality of the personal data you provide.

4. Security measures

Taking account of the state of the art, cost, and the risk to individuals, we maintain:

• Encryption in transit over TLS for all systems handling client data, and at rest where the platform provides it.
• Access control on least-privilege terms. Access is limited to people working on your engagement, uses unique accounts, and requires multi-factor authentication wherever the platform supports it.
• Credential hygiene — no shared logins where an individual account is available, secrets held in environment configuration rather than in code or documents, and access revoked when someone leaves the engagement.
• Network and application protection for systems we host, including a web application firewall, malware scanning and prompt patching.
• Data minimisation — we ask for the least data that will do the job, and prefer hashed or aggregated data where a platform supports it.
• Segregation of client environments and accounts, so one client’s data is not commingled with another’s.
• Backups for systems we host, with restoration tested periodically.

5. Sub-processors

You give general written authorisation for us to engage sub-processors. The current list is published in the Third-Party Policy, which forms the sub-processor register for this Addendum.

• We impose data protection obligations on each sub-processor that are no less protective than those in this Addendum.
• We remain fully liable to you for a sub-processor’s performance.
• We give you at least 30 days’ notice before adding or replacing a sub-processor that will process your personal data.
• You may object on reasonable data protection grounds within that period. We will work with you to find an alternative, and if we cannot, either of us may terminate the affected part of the engagement without penalty, with fees for work already done still payable.

6. International transfers

Several of our sub-processors are outside India. Where personal data protected by UK or EU law is transferred outside those regions, the transfer is made under Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision. Under the DPDP Act we transfer only to countries not restricted by the Central Government. On request we will identify the mechanism relied on for a specific provider.

7. Data subject requests

If someone contacts us directly to exercise a right over data we hold for you, we will not respond substantively. We will forward it to you without undue delay and help you answer it. Where you need us to locate, export, correct or delete data inside a system we operate, we will do so within the timescale you need to meet your legal deadline, at no extra charge for a reasonable volume of requests.

8. Personal data breaches

We will notify you without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting your data. The notification will describe what we know: the nature of the breach, categories and approximate numbers affected, likely consequences, and the measures taken or proposed. We will keep you updated as the picture develops and cooperate fully with your reporting obligations to regulators and individuals. We will not make a public statement about a breach affecting your data without consulting you, unless we are legally required to.

9. Return and deletion

At the end of the engagement, or earlier on your written request, we will at your choice return or delete the personal data we hold for you, and delete existing copies, within 60 days. Exceptions are data we are required by law to keep, and routine backups, which are deleted on their normal rotation and remain protected by this Addendum until they are. We will confirm deletion in writing when asked. Account access we hold on your platforms is transferred back or revoked at the same time.

10. Audit

On reasonable written notice, and no more than once a year unless a regulator or a breach requires otherwise, we will provide the information needed to demonstrate compliance with this Addendum. Where a physical or on-site audit is genuinely necessary, we will cooperate, subject to reasonable confidentiality protections, our other clients’ security, and your covering the reasonable cost of our time.

11. AI processing

Some services involve AI models processing content that may contain personal data. Our providers are listed in the Third-Party Policy and act as sub-processors. We use commercial API terms under which your data is not used to train the provider’s models. Restrictions on what we send a model, and your right to limit or exclude AI processing on your account, are set out in the AI Usage Policy.

12. Liability and precedence

Liability under this Addendum is subject to the limits in the Client Service Terms or your signed agreement. If this Addendum conflicts with those terms, this Addendum prevails on data protection matters. If it conflicts with Standard Contractual Clauses, the Clauses prevail.

13. Signing this

This Addendum takes effect automatically as part of the engagement, and no signature is needed for it to apply. If your procurement process requires a countersigned copy, or your own DPA template, email [email protected] and we will execute it.