Data Processing Addendum
Last updated: October 2026
This Data Processing Addendum ("DPA") supplements the Terms of Service, or the Master SaaS Agreement for Enterprise customers (the "Agreement"), between you ("Customer") and Burdenoff Consultancy Services Pvt Ltd ("we", "us", "our") for your use of VibeControls (the "Service"). It sets out the terms on which we process personal data on your behalf. On data-protection matters, this DPA prevails over the Agreement.
This is the standard DPA template for VibeControls. It is pending final legal review. To request a countersigned copy, contact contact@vibecontrols.com.
1. Roles of the parties
1.1 For personal data that you or your authorised users submit to, or generate within, the Service ("Customer Data"), you are the controller (the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023) and we are the processor.
1.2 For the account, billing and website-visitor data we collect directly to run and bill for the Service, we act as a controller in our own right, as described in our Privacy Policy.
2. Scope of processing
2.1 Subject matter and duration. We process Customer Data only to provide, secure and support the Service, for the term of the Agreement plus the return and deletion period in Section 8.
2.2 Nature and purpose. Hosting, storage, transmission and processing of Customer Data to deliver the features of VibeControls that you use, together with the security, support and billing operations needed to deliver them.
2.3 Data subjects. Your authorised users (for example employees and contractors) and any other individuals whose personal data you choose to include in Customer Data.
2.4 Categories of personal data. Account identifiers (name, email address), authentication data, usage and log data, and any other personal data you choose to submit. You must not submit special-category or regulated data that the Service is not designed to process.
3. Our obligations as processor
We will:
- process Customer Data only on your documented instructions (this DPA, the Agreement and your configuration of the Service), unless the law requires otherwise, in which case we will tell you first unless the law forbids it;
- make sure everyone authorised to process Customer Data is bound by confidentiality obligations;
- apply the technical and organisational measures described in Section 5;
- help you, taking into account the nature of the processing, to respond to data-subject requests and to carry out data-protection impact assessments where they are required;
- notify you without undue delay after we become aware of a personal-data breach affecting Customer Data;
- give you the information reasonably necessary to show that we comply with this DPA, and support audits as set out in Section 7.
4. Subprocessors
4.1 You authorise us to engage the subprocessors listed on our Subprocessors page to host, secure and support the Service. We impose data-protection obligations on each subprocessor that are materially equivalent to those in this DPA, and we remain responsible for their performance.
4.2 We will give notice of a new subprocessor by updating the Subprocessors page before it starts processing Customer Data. You may object on reasonable data-protection grounds by writing to contact@vibecontrols.com.
5. Security measures
We maintain measures appropriate to the risk, including:
- Encryption in transit: TLS 1.2 or higher on all external endpoints.
- Encryption at rest: storage-level encryption on managed databases and object storage, with additional field-level encryption for credentials and secrets.
- Access control: role-based access control enforced at the API gateway, with workspace-scoped isolation of Customer Data.
- Secrets management: application secrets kept in a managed secrets service, never in source control.
- Audit logging: records of administrative and security-relevant actions.
- Vulnerability management: dependency and container-image scanning in the build pipeline.
- Personnel: least-privilege access to production systems.
6. International transfers
Customer Data is hosted in India by default. Where a subprocessor processes data outside India, we rely on lawful transfer safeguards appropriate to the applicable data-protection law, such as standard contractual clauses or adequacy decisions.
7. Audits
You may request information about our security and data-handling practices. Once a year, with reasonable notice, you may request a completed security questionnaire or, where applicable law requires it and at your cost, an audit of the controls relevant to your data, subject to confidentiality obligations.
8. Return and deletion
When the Agreement ends, we will, at your choice and where technically feasible, return or delete Customer Data within 90 days, except where the law requires us to keep it (for example, billing records kept for tax and accounting purposes).
9. Liability
Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where applicable data-protection law does not allow such a limitation.
10. Contact
For questions about this DPA, or to request a signed copy, contact us at contact@vibecontrols.com.
Burdenoff Consultancy Services Pvt Ltd
Plot No.43, Veeramani Nagar, 2nd Cross Street, Nanmangalam, Chennai - 600117