Data Processing Agreement

Effective Date: 16 May 2026 | Document Version: 2.0 | Next Review: 16 May 2027
(supersedes Version 1.1, effective 12 July 2025 as amended 18 August 2025)

1. Introduction

This Data Processing Agreement (“DPA”) applies when you use OPS360 for business purposes where personal data is processed. This DPA is between you (the “Data Controller” / “Data Fiduciary”) and Delisys Technologies Ltd (“Data Processor”). It supplements our Privacy Policy and Terms of Service.

Data Residency Notice: OPS360 operates a regional data residency program. Personal data is stored and processed in-region based on your selected Operating Country at onboarding. Only organizations operating in the United Kingdom (UK), India (IND), or the United States of America (USA) may onboard at this time. (EU/EEA availability is not offered at this time.)

2. Key Definitions

• Data Controller / Data Fiduciary: Your organization that determines how personal data is processed.
• Data Processor: Delisys Technologies Ltd, processing data on your behalf.
• Personal Data: Information about identifiable individuals.
• Data Subjects / Data Principals: The individuals whose data is processed (your employees, customers, etc.).
• Operating Country: The country you select during onboarding that determines your data residency region.
• Operating Region: One of UK, IND (India), or USA, derived from the Operating Country and used to pin your data to a regional cluster.
• Regional Cluster: The dedicated OPS360 database and storage resources deployed within the Operating Region for your tenant.
• Cross-Border Transfer: Movement of personal data outside the Operating Region applicable to your tenant.

3. What We Process

3.1 Processing Activities

We process personal data to provide: platform services (user accounts, projects, tasks); communication services (chat, WhatsApp, notifications); file management (storage, sharing, version control); e-signature services (digital signing, identity verification); payment processing (invoices, transactions); mobile services (location, camera, offline storage); AI services (chatbot, automated processing); site audit services (location tracking, reporting).

3.2 Types of Personal Data

Identity and contact information; professional and company data; technical and usage data; location and device data; communication and chat data; financial and payment data; biometric data (with explicit consent); documents and files.

3.3 Data Subjects

Your employees and users; your customers and clients; third parties interacting with your business.

3.4 Regional Availability and Residency

• Allowed regions: Only UK, India, and USA are supported for onboarding.
• Region pinning: Your selected Operating Country determines the Operating Region (UK, IND, USA) and the regional cluster where your tenant data is stored and processed.
• Finality of choice: The Operating Country selection cannot be changed in-app. Any change requires a formal migration (see Annex C).

4. Our Responsibilities

4.1 What We Do

Process data only according to your instructions; implement appropriate security measures; use authorized sub-processors only; assist with data subject requests; notify you of data breaches promptly; delete data when services end; provide compliance information.

4.2 What We Don’t Do

Process data for our own purposes (except as required by law); share data with unauthorized parties; combine data for non-service purposes; use data for marketing without consent.

4.3 Data Residency and Regional Processing

• Region-pinned storage: We store and process your tenant’s personal data in the regional cluster corresponding to your Operating Region.
• In-region resilience and backups (current, factual):
  • UK: Primary processing in Microsoft Azure UK South. Storage is locally-redundant (multiple copies within the UK region); the database (MongoDB Atlas) and its backups are deployed within the UK. OPS360 does not replicate UK personal data to any out-of-region or paired region.
  • India: Primary processing in Microsoft Azure Central India. Locally-redundant in-region storage; Atlas database and backups within India. No out-of-region replication.
  • USA: Primary processing in Microsoft Azure US. Locally-redundant in-region storage; Atlas database and backups within the United States. No out-of-region replication.
• Keys-in-region: Encryption keys for each tenant are managed per region and remain in-region.
• Cross-border default: Cross-border transfers are disabled by default and only occur if you explicitly instruct us and appropriate safeguards are in place (see Section 8).
• Telemetry and support: Operational telemetry and support access are designed to keep personal data within your Operating Region. Application telemetry is collected into in-region monitoring (e.g., UK telemetry in the UK region, India telemetry in the India region). Where remote support access is necessary, it is just-in-time, audited, and does not copy data out of region.

5. Your Responsibilities

You must: have a lawful basis for processing; obtain necessary consents from data subjects; provide clear privacy notices; ensure data accuracy; respond to data subject requests; notify us of changes to processing purposes; conduct impact assessments where required; select an accurate Operating Country at onboarding and inform us if a migration is required.

6. Sub-processors

6.1 Authorized Sub-processors

We use these categories of sub-processors (the current itemised list, with locations and transfer mechanisms, is maintained in the Sub-processor List, https://ops360.net/sub-processors/):

• Cloud Infrastructure: Microsoft Azure, MongoDB Atlas
• Communication: WhatsApp Business API (Meta), Firebase (Google), transactional email provider
• Payments: Stripe, PayPal, Razorpay
• AI Services: Azure OpenAI, Google Vision API
• Analytics: Google Analytics, Firebase Analytics
• Support: Customer support / ticketing tooling

6.2 Sub-processor Changes

We will notify you of changes to sub-processors; you can object within 30 days; we will work with you to find alternatives if you object.

6.3 Regional Deployment and Localization

We require our sub-processors to process your data within your Operating Region where region-pinned services are available. If a sub-processor cannot offer an in-region service for a specific feature, we will disable that feature by default for your tenant, or obtain your documented instructions and implement appropriate safeguards before enabling it.

7. Data Security

• Encryption: AES-256 for stored data; TLS 1.2 or higher for data in transit
• Access Controls: Multi-factor authentication, role-based access, least-privilege managed identities
• Network Security: Firewalls, network security groups (deny-by-default), web application firewall at the edge
• Employee Training: Regular security awareness training
• Physical Security: Secure cloud data centres with provider access controls
• Regional Key Management: Encryption keys managed and stored within your Operating Region

8. International Data Transfers and Data Residency

• Default position: We do not transfer your personal data outside your Operating Region.
• Controller instructions: Cross-border transfers occur only where you provide prior documented instructions and where lawful transfer mechanisms are in place.
• Transfer mechanisms:
  • UK: UK International Data Transfer Agreement (IDTA) or the UK Addendum to the SCCs, and applicable adequacy regulations, with supplementary measures where required.
  • India: Transfers only as permitted under the Digital Personal Data Protection Act, 2023 and any Central Government rules or notifications in force.
  • USA: Where receiving data from UK/India, Standard Contractual Clauses or equivalent as applicable.
• Data localization commitments: UK tenant data remains within the UK; India tenant data remains within India; USA tenant data remains within the USA. Any exception requires your explicit authorization and compliance safeguards.

9. Data Subject Rights

9.1 How We Help

We assist you with data subject / data principal requests for: access, correction, deletion, portability, restriction, and objection.

9.2 Process

Data subjects normally contact the Controller directly; we forward any requests we receive to you, provide technical assistance to fulfil valid requests, and provide platform features for per-region data export and deletion. Individuals may also contact our Privacy Team or India Grievance Officer (see Privacy Policy) and we will route and assist.

10. Data Breaches

If a breach occurs we will: notify you within 72 hours where feasible; provide detailed breach information; describe likely consequences and mitigation; assist with regulatory notifications; and coordinate notifications consistent with the laws of your Operating Region (UK GDPR, US state laws, India DPP Act).

11. Data Retention and Deletion

11.1 Retention

Data is retained while you use OPS360; legal requirements may extend retention; backup systems have automatic deletion schedules maintained per region. See the Data Retention Policy (https://ops360.net/data-retention-policy/).

11.2 Deletion

When services end we will: delete data from active systems within 30 days (in-region); remove data from backups within 90 days (in-region); provide confirmation of deletion; maintain deletion logs for audit purposes. Residual copies persist only in time-bounded in-region backup snapshots until snapshot expiry.

12. Audits and Compliance

You may request information about our processing, conduct audits, review security measures, and inspect processing records. We provide annual compliance information, security attestations, incident reports, sub-processor documentation, and regional data residency verification on request.

13. Liability

We are liable for our breaches of this DPA, unauthorized processing by our sub-processors, and violations due to our actions. You are liable for your breaches of this DPA, unlawful processing instructions, and inadequate consent or legal basis. Total liability is subject to the limits in our Terms of Service.

14. Changes and Termination

We may update this DPA for legal or regulatory changes; material changes require 30 days’ notice; continued use after the effective date constitutes acceptance. This DPA ends when you stop using OPS360, the Terms of Service terminate, or all personal data is deleted or returned.

15. Governing Law

This DPA is governed by the laws of England and Wales, together with the mandatory data-protection laws applicable to your Operating Region: the UK GDPR and Data Protection Act 2018 (UK), CCPA/CPRA and other applicable US state laws (USA), and the Digital Personal Data Protection Act, 2023 (India).

16. Contact Information

Data Protection Contacts:

• Data Protection Officer: dpo@ops360.net
• Legal Team: legal@ops360.net
• DPA Inquiries: dpa@ops360.net
• Breach Notifications: security@ops360.net (see our Security page)
• India Grievance Officer: grievance.in@ops360.net

Delisys Technologies Ltd
Address: Suite 5, 22-26 Nottingham Road, Stapleford, Nottingham NG9 8AA, United Kingdom
Email: info@ops360.net
Website: https://ops360.net

This DPA applies to business customers using OPS360 where personal data is processed.

© 2026 Delisys Technologies Ltd. All rights reserved.

Annex A, Regional Data Residency Schedule

• UK Region: Primary processing, United Kingdom (Azure UK South). Resilience, locally-redundant storage and in-region MongoDB Atlas backups, all within the UK (no out-of-region/paired-region replication). Database cluster: UK regional cluster.
• India Region: Primary processing, India (Azure Central India). Resilience, locally-redundant in-region storage and in-region Atlas backups, all within India. Database cluster: India regional cluster.
• USA Region: Primary processing, United States (Microsoft Azure US). Resilience, locally-redundant in-region storage and in-region Atlas backups, all within the United States. Database cluster: US regional cluster.

Annex B, Sub-Processor and Data Center Locations (Summary)

• Cloud Infrastructure: Microsoft Azure, MongoDB Atlas, deployed within your Operating Region.
• Communications, Payments, Analytics, AI, Support: configured to use in-region services where available. Features lacking in-region processing are disabled by default or require your explicit documented instructions with appropriate safeguards. See the full Sub-processor List (https://ops360.net/sub-processors/).

Annex C, Regional Migration Procedure

Initiation (you submit a migration request with target Operating Country/Region and justification) → Assessment (compliance, technical, scheduling review; downtime advisory) → Safeguards (appropriate transfer mechanisms if cross-border; encrypted, audited migration) → Execution (export/import within approved windows; integrity verification; tenant metadata update) → Completion (migration completion report and regional residency confirmation). Fees may apply.