1. Parties and scope
This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer ("Controller" or "Data Fiduciary") and 9live ("Processor"). It applies to personal data that the Controller stores or processes in applications and databases hosted on 9live.
2. Roles
The Controller determines the purposes and means of processing. 9live processes personal data only on documented instructions from the Controller, which include the Terms, the dashboard configuration and support requests. Under the Digital Personal Data Protection Act 2023, the Controller is the Data Fiduciary and 9live is a Data Processor.
3. Nature and purpose of processing
Hosting, storage, backup, transmission and display of data as needed to provide the Service. 9live does not access the contents of customer databases except when instructed, for example during a migration or a support ticket, and such access is logged.
4. Location
Primary processing and backups occur in India. Processing outside India occurs only if the Controller enables a non-Indian region or uses a feature that explicitly states otherwise.
5. Confidentiality
9live personnel with access to customer environments are bound by confidentiality obligations, background-checked and granted access on a just-in-time basis.
6. Security measures
9live implements the measures described on its Security page, including hardware-virtualised tenant isolation, encryption at rest (AES-256) and in transit (TLS 1.2+), private networking, access logging, patch management and tested backups.
7. Sub-processors
The Controller authorises the use of the sub-processors listed below. 9live will notify the Controller by email at least 30 days before adding a sub-processor that will process personal data, and the Controller may object on reasonable grounds.
Current sub-processors: data centre colocation provider (Mumbai, India); off-site backup storage provider (India); payment processor; transactional email provider; support and ticketing tooling. Specific vendor names are available on request and in the dashboard.
8. Assistance
9live will assist the Controller, at reasonable cost where significant effort is required, in responding to data principal requests, conducting data protection impact assessments and dealing with regulators, to the extent the information is in 9live's possession.
9. Personal data breach
9live will notify the Controller without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting the Controller's data, with the information reasonably available at the time and updates as the investigation proceeds.
10. Deletion and return
On termination, the Controller may export its data for 14 days. 9live then deletes personal data from active systems and backups expire according to the plan retention schedule, unless retention is required by law.
11. Audit
9live will make available information necessary to demonstrate compliance with this DPA, including summaries of third-party audits where available. On-site audits are available to Custom plan customers once per year with 30 days' notice, at the Controller's cost.
12. Liability
Liability under this DPA is subject to the limitations in the Terms of Service.
13. Precedence
In case of conflict between this DPA and the Terms regarding processing of personal data, this DPA prevails.
14. Contact
Data protection enquiries: support@9live.in.