Data Processing Agreement

This Data Processing Agreement (the “DPA”) forms part of, and is incorporated by reference into, the agreement between the customer (“you”, the “Customer”) and DotSpheres Technologies Pvt Ltd (“ReachBell”, “we”, “us”) for the use of ReachBell, comprising our Terms of Service and Privacy Policy (together, the “Agreement”). It reflects the requirements of Article 28 of the EU General Data Protection Regulation (the “GDPR”) and India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”).

This DPA applies where we process personal data on your behalf in the course of providing ReachBell. To the extent of any conflict between this DPA and the rest of the Agreement specifically regarding the processing of personal data, this DPA prevails. A counter-signed copy of this DPA is available on request — email support@reachbell.com.

1. Roles of the parties

For personal data we process on your behalf to deliver ReachBell — principally data about your subscribers and end users — you are the controller (the Data Fiduciary under the DPDP Act) and DotSpheres Technologies Pvt Ltd is the processor (the Data Processor under the DPDP Act), acting on your behalf. You are responsible for the lawfulness of the personal data and instructions you provide, including having a valid legal basis and any required notice or consent from data subjects. Where we determine the purposes and means of processing our own account, billing, and website data, we act as a controller / Data Fiduciary, and that processing is governed by our Privacy Policy rather than this DPA.

2. Subject-matter, duration, nature & purpose

The subject-matter of the processing is the personal data you submit to, or that is generated through your use of, ReachBell. The duration is the term of the Agreement, plus any limited period required to return or delete the data as described in Section 9. The nature and purpose of the processing is to provide the service: storing and managing subscriber and audience data; sending web and mobile push, email, SMS, and WhatsApp messages; building segments; running automations; recording engagement and consent events; and providing related support, security, and analytics functions.

3. Categories of data subjects & types of personal data

The categories of data subjects are your customers’ subscribers and end users — the people you message and whose data you manage through ReachBell.

The types of personal data may include:

• push subscription tokens and device push identifiers (FCM/APNs tokens, web-push endpoints);
• email addresses and phone numbers, where you use email, SMS, or WhatsApp channels;
• device and technical data, including browser/OS and coarse (approximate) geolocation derived from IP;
• tags, attributes, and external / customer-supplied identifiers you attach to subscribers; and
• engagement events (such as deliveries, opens, clicks, and opt-in / opt-out actions).

You control what data you send to ReachBell; you should not submit special-category data unless you have ensured an appropriate legal basis and the service is suitable for it.

4. Our obligations as processor

When processing personal data on your behalf, we will:

• Process only on documented instructions. We process the personal data only on your documented instructions — including with regard to international transfers — as set out in this DPA and the Agreement and as given through your use of the service, unless required to do otherwise by applicable law (in which case we will, where legally permitted, inform you first).
• Confidentiality of personnel. We ensure that personnel authorized to process the personal data are bound by appropriate confidentiality obligations and access it only on a need-to-know basis.
• Security. We implement appropriate technical and organizational measures to protect personal data, including encryption in transit (TLS), encryption of sensitive credentials at rest, role-based access control (RBAC) and least-privilege access, and audit logging of administrative actions. Further detail is on our Security page.

5. Sub-processors

You provide a general authorization for us to engage the sub-processors listed at our sub-processor list to help us deliver the service. We give advance notice of any intended changes to that list — the addition or replacement of a sub-processor — so that you have the opportunity to object on reasonable data-protection grounds before the change takes effect. We impose on each sub-processor, by written contract, data-protection obligations equivalent to those in this DPA, and we remain responsible to you for each sub-processor’s performance of those obligations.

6. Assisting with data-subject requests

Taking into account the nature of the processing, we provide reasonable assistance to help you respond to requests from data subjects exercising their rights (such as access, correction, erasure, and objection) under the GDPR, the DPDP Act, and other applicable law. This includes the hosted preference center, which lets your subscribers manage their channel preferences or unsubscribe directly. Where a data subject contacts us directly about data we process on your behalf, we will, where appropriate, direct them to you.

7. Personal-data breach notification

We notify you without undue delay after becoming aware of a personal-data breach affecting personal data we process on your behalf, and provide the information then available to help you meet your own notification obligations to regulators (including, in India, the Data Protection Board) and to affected data subjects. We will provide further detail as it becomes available and reasonably cooperate in investigating and mitigating the breach.

8. International transfers

Where providing the service involves transferring personal data across borders — including engaging sub-processors located outside your or the data subjects’ jurisdiction — we put in place an appropriate transfer safeguard recognized under applicable law, such as the EU Standard Contractual Clauses (SCCs) for transfers subject to the GDPR, and an equivalent mechanism for transfers of personal data out of India as required under the DPDP Act and its rules.

9. Deletion or return on termination

On termination or expiry of the Agreement, we delete or return the personal data we process on your behalf in accordance with the retention terms described in our Privacy Policy, and delete existing copies, except to the extent we are required to retain a copy by applicable law. You can also export or delete data during the term using the controls available in the dashboard.

10. Audits & demonstrating compliance

We make available to you the information reasonably necessary to demonstrate compliance with our obligations under this DPA, and allow for and contribute to reasonable audits — including by providing relevant third-party reports and documentation where available, and otherwise responding to reasonable audit requests — conducted by you or an auditor you mandate, on reasonable prior notice, during business hours, no more than once per year (except where required by a regulator or following a breach), and subject to appropriate confidentiality obligations.

11. How to execute & contact

For most customers, accepting the Agreement incorporates this DPA, and no separate signature is required. If your organization requires a counter-signed copy, or you have questions about this DPA, email support@reachbell.com and we will arrange it. This DPA should be read together with our Privacy Policy, Terms of Service, and the current list of sub-processors.