Data Processing Agreement

1. Definitions

• Personal Data: Any information relating to an identified or identifiable natural person processed by Uplabs on behalf of the Studio within the platform.
• Processing: Any operation performed on Personal Data including collection, storage, retrieval, use, disclosure, or deletion.
• Data Controller: The Studio, which determines the purposes and means of processing Personal Data.
• Data Processor: Uplabs, which processes Personal Data on behalf of the Studio.
• Sub-Processor: A third party engaged by Uplabs to assist in processing, including Supabase and Cloudflare.

2. Scope of Processing

Uplabs processes the following categories of personal data on behalf of the Studio:

• Client contact information (names, email addresses, phone numbers, addresses).
• Employee and contractor information (names, contact details, salary data, attendance records).
• Vendor and supplier contact information.
• Any other personal data the Studio chooses to enter into the platform.

The purpose of processing is solely to provide the Uplabs platform services as described in the Terms & Conditions. Uplabs will not process Studio Data for any other purpose except where required by law or where the Studio has provided explicit consent (e.g. AI improvement).

3. Processor Obligations

Uplabs, as Data Processor, agrees to:

• Process Personal Data only on documented instructions from the Studio (i.e. actions taken within the platform).
• Ensure all personnel with access to Personal Data are bound by confidentiality obligations.
• Implement and maintain appropriate technical and organisational security measures as described in the Privacy Policy.
• Not engage any new Sub-Processor without prior notification to Studios. Current Sub-Processors are listed in the Privacy Policy.
• Assist the Studio in responding to Data Principal rights requests (access, correction, erasure) relating to data processed within the platform.
• Notify the Studio without undue delay upon becoming aware of a personal data breach affecting Studio Data.
• Delete or return all Personal Data upon termination of the agreement, at the Studio's request, subject to legal retention requirements.
• Make available all information necessary to demonstrate compliance with this DPA upon reasonable written request.

4. Controller Obligations

The Studio, as Data Controller, agrees to:

• Ensure there is a lawful basis for inputting personal data of third parties (clients, employees) into the platform.
• Obtain all necessary consents from data subjects whose data is entered into Uplabs, where required by applicable law.
• Not input special categories of sensitive personal data (as defined under DPDPA) into the platform without prior written agreement with Uplabs.
• Promptly inform Uplabs of any Data Principal rights requests received relating to data processed on the platform.

5. Sub-Processors

Uplabs engages the following Sub-Processors to assist in delivering the platform services. The Studio hereby provides general authorisation for the use of these Sub-Processors:

• Supabase Inc. — database hosting, authentication, file storage (servers in US/EU).
• Cloudflare Inc. — CDN, security, and R2 object storage (global infrastructure).
• Razorpay — payment processing.

Uplabs will notify Studios of any addition or replacement of Sub-Processors with at least 7 days advance notice, during which the Studio may object. Where Uplabs cannot accommodate a reasonable objection, the Studio may terminate their subscription.

6. Data Breach Notification

Uplabs will notify the Studio of any confirmed personal data breach affecting Studio Data as soon as practicable and in any event within 72 hours of becoming aware. Notification will include: nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed.

7. International Transfers

Personal Data may be transferred to and processed in countries outside India (including the United States) by our Sub-Processors. Uplabs ensures such transfers are governed by appropriate contractual safeguards. By entering into this DPA, the Studio acknowledges and consents to such transfers.

8. Term and Termination

This DPA remains in effect for the duration of the Studio's subscription to Uplabs. Upon termination, Uplabs will retain Studio Data in accordance with the Terms & Conditions and will action deletion requests as described therein.

DPA questions: legal@uplabs.in.