Template — pending legal review
A starting point for a data processing agreement between Skillozia and a customer. It has not been reviewed by a lawyer yet and is not legal advice. Placeholders in [square brackets] are for the parties to complete.
This Data Processing Agreement ("DPA") is between [Customer legal name] ("Customer") and Questiverse Learning LLP, which operates Skillozia ("Skillozia"). It applies to personal data Skillozia processes on the Customer's behalf when providing the Skillozia service under the Customer's agreement or the Terms of Service (the "Agreement").
Under India's Digital Personal Data Protection Act, 2023 the Customer is the Data Fiduciary and Skillozia is a Data Processor. Where the GDPR applies, the Customer is the controller and Skillozia the processor.
Skillozia processes personal data only on the Customer's documented instructions — the Agreement, this DPA and the Customer's use of the service — unless the law requires otherwise, in which case Skillozia will tell the Customer first where the law allows.
Skillozia ensures that people authorised to process the personal data are bound by confidentiality.
Skillozia keeps technical and organisational measures appropriate to the risk, as described on the Security page (skillozia.com/security), including encryption in transit, role-based access, tenant isolation and audit logging of key actions.
The Customer authorises the subprocessors listed at skillozia.com/legal/subprocessors. Skillozia will give [30] days' notice of a new subprocessor by [email / an update to that page], and the Customer may object on reasonable data-protection grounds. Skillozia remains responsible for its subprocessors' processing.
The service lets the Customer export and delete a candidate's data. Skillozia will help the Customer, taking into account the nature of the processing, to answer requests from data subjects to exercise their rights.
Skillozia will notify the Customer without undue delay, and within [72] hours, after confirming a personal data breach affecting the Customer's data, with the information the Customer reasonably needs to meet its own obligations.
When the Agreement ends, the Customer can export its data from the service. Skillozia will delete the Customer's personal data within [30] days afterwards, except where the law requires it to keep a copy.
Skillozia will make available the information reasonably needed to show compliance with this DPA and will answer reasonable written questionnaires [once a year].
The platform is hosted in AWS ap-south-1 (Mumbai, India). Some subprocessors may process data outside India; the subprocessor page shows each location as it is confirmed. [Transfer safeguards, if any are required, to be added on legal review.]
Liability under this DPA is subject to the limits in the Agreement. If this DPA and the Agreement conflict on the processing of personal data, this DPA prevails.