Data Processing Agreement — RackVolt Cloud

1Parties and roles

This Data Processing Agreement ("DPA") is between you (the "Customer") and RackVolt Cloud Solutions Pvt Ltd ("RackVolt"). It forms part of, and is governed by, the agreement under which RackVolt provides services to you (the "Agreement").

Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"):

You are the Data Fiduciary. You decide the purpose and means of processing the personal data you place on our infrastructure.
RackVolt is the Data Processor. We process that data only to provide the services, on your instructions.

How accountability works under the Act. Section 8(1) of the DPDP Act keeps the Data Fiduciary accountable for processing carried out on its behalf. This DPA gives you control and binding commitments from us, and it sits alongside your own statutory accountability rather than replacing it — which is how the Act is written for every processor relationship.

This DPA is offered under section 8(2) of the DPDP Act, which permits a Data Fiduciary to engage a processor only under a valid contract.

2What we process, and why

RackVolt operates compute, storage and network infrastructure. We do not select, inspect or make use of the content you place on it.

Item	Detail
Subject matter	Provision of hosting, compute, storage and network services under the Agreement.
Duration	The term of the Agreement, plus the deletion period in section 8.
Nature of processing	Hosting, storage, transmission, backup and, where contracted, administration of the systems on which your data sits.
Purpose	Only to deliver, secure, support and bill for the services. No other purpose.
Categories of data	Determined entirely by you. We do not require, request or control what you upload.
Categories of Data Principals	Determined entirely by you — typically your own customers, staff or users.
Account data we hold as Fiduciary	Separately, we are the Data Fiduciary for your own account details — contact name, email, phone, billing and tax identifiers, and service logs. That processing is covered by our privacy notice, not by this DPA.

3Our obligations

RackVolt will:

process personal data only on your documented instructions, and only for the purposes in section 2;
not determine the purpose of processing, and not use your data to train models, build profiles, or for any marketing;
not sell, licence or disclose your data to any third party, except to a sub-processor under section 5 or where legally compelled under section 7;
keep the reasonable security safeguards described in section 4;
require confidentiality from every member of personnel with access, under written terms that survive their engagement, and limit access to those who need it to do their job;
assist you, at your cost where the work is substantial, in meeting your own obligations — including responding to Data Principal requests, carrying out impact assessments, and notifying the Data Protection Board;
tell you promptly if we believe an instruction from you would breach the DPDP Act, and pause that instruction until it is resolved.

4Security safeguards

We maintain technical and organisational measures appropriate to the infrastructure we run, including:

encryption of data in transit over public networks, and support for encryption at rest that you control;
role-based access control with least privilege, individually attributed administrative accounts, and multi-factor authentication on administrative access;
network segregation between customers, and per-customer isolation at the hypervisor;
always-on denial-of-service mitigation at the network edge;
access and security logging retained for 180 days, with records of administrative action;
patching of infrastructure we operate, and documented change control for maintenance;
backup of data where backup is part of your service, held in the same country as the primary service.

For your vendor review: tell us what your procurement process requires and we will describe our technical and organisational controls in writing and answer a security questionnaire.

Security inside your instance — your operating system, applications, credentials, patching and access policy — remains yours. Where you contract managed administration from us, the division of responsibility is set out in that Agreement.

5Sub-processors

You give general authorisation for RackVolt to engage sub-processors to deliver the services. We will:

keep a current list of sub-processors and the function each performs, available on request to [email protected];
impose data protection obligations on each sub-processor no less protective than this DPA;
give you at least 30 days' notice before adding or replacing a sub-processor that will process your personal data;
remain responsible to you for a sub-processor's performance.

If you reasonably object to a new sub-processor on data protection grounds within that notice period, we will work with you on an alternative. If none is workable, you may terminate the affected service without penalty for the unexpired term, and we will refund fees paid in advance for it.

6Personal data breach

If we become aware of a personal data breach affecting personal data we process for you, we will notify you without undue delay and in any event within 48 hours, by email to your registered account contact and, where you have given one, your security contact.

Our notification will include what we know at the time: the nature of the breach, the categories and approximate volume of data affected, the likely consequences, the measures taken or proposed, and a contact point. Where we cannot provide everything at once, we will send it in stages without further undue delay rather than waiting for a complete picture.

We will assist you in notifying the Data Protection Board of India and affected Data Principals, as required of you under the DPDP Act. Notifying regulators and Data Principals is your decision and your obligation as Data Fiduciary; we will not make that notification on your behalf unless the Agreement says so.

We retain incident records, including our own investigation, for at least 180 days.

7Data location and transfers

For services you purchase in our India region, personal data and its backups are stored and processed in India.

If you purchase services in another region, the data for those services is stored in that region and you are choosing that location. We will not move personal data out of the region you selected without instruction from you, except where strictly necessary to deliver the service and permitted by law, and we will tell you if that ever arises.

We will not transfer personal data to any territory to which transfer is restricted by the Central Government under the DPDP Act.

Government and legal requests

If we receive a binding legal demand for your data, we will — unless legally prohibited — notify you before disclosing anything, so that you can seek to challenge it. We will disclose only what the demand compels, and we will keep a record of each request.

8Retention, return and deletion

We retain personal data for as long as you keep it on the service. On your written instruction, or on termination of the Agreement, we will delete or return the personal data you hold on the service within 30 days, and delete remaining copies from backups within a further 60 days as backup cycles expire.

Where you withdraw a Data Principal's consent and instruct deletion, we will act on that instruction without undue delay.

We may retain data for longer only where law requires it — for example statutory tax and accounting records, and security logs retained for the 180-day period described above. In that case we keep only what is required, and only for as long as required.

9Audit and information

On request, no more than once a year unless an incident gives you reason to ask sooner, we will provide a written description of our technical and organisational measures and complete a reasonable security questionnaire.

Where you need an on-site or third-party audit, we will agree scope, timing, cost and confidentiality with you in advance. Audits must not compromise the security or privacy of our other customers.

10Term, changes and precedence

This DPA takes effect when the Agreement does and continues while we process personal data for you. Where this DPA conflicts with the Agreement on a data protection matter, this DPA governs. Where it conflicts with the DPDP Act, the Act governs.

We may update this DPA to reflect changes in law, the final DPDP Rules, or our sub-processors. We will not reduce your protections during a contract term without your agreement; the version in force when your term began continues to apply until renewal. Material changes will be notified to your account contact at least 30 days in advance.

A countersigned copy on your paper, or ours, is available on request — email [email protected] and we will send a signature-ready version. We can also sign a mutual NDA before any detailed technical or security discussion.

11Contact

RackVolt Cloud Solutions Pvt Ltd · CIN U63999BR2024PTC068951 · GSTIN 10AANCR5738G1ZC
Data protection enquiries: [email protected]

See also our India Infrastructure SLA and compliance overview.