Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Master Service Agreement or other agreement (the “Agreement”) between Manjonka LLC (“GroXpertise,” “Processor”) and the client (“Client,” “Controller”). It applies where GroXpertise processes personal data on the Client’s behalf in the course of providing the Services, and reflects the requirements of the GDPR, UK GDPR, and similar laws. If there is a conflict between this DPA and the Agreement regarding personal data, this DPA controls.

1. Definitions

“Personal Data,” “Processing,” “Controller,” “Processor,” “Data Subject,” and “Supervisory Authority” have the meanings given in applicable data-protection law. “Applicable Law” means the data-protection laws that apply to the Processing.

2. Roles & Scope

The Client is the Controller and GroXpertise is the Processor with respect to Personal Data processed under the Agreement. Each party will comply with its obligations under Applicable Law. The subject matter, duration, nature, and purpose of Processing, and the types of Personal Data and categories of Data Subjects, are described in Annex 1.

3. Processing Instructions

GroXpertise will process Personal Data only on the Client’s documented instructions, including the Agreement and this DPA, unless required by law (in which case we will notify the Client where legally permitted). We will inform the Client if, in our opinion, an instruction infringes Applicable Law.

4. Confidentiality

We ensure that personnel authorized to process Personal Data are bound by confidentiality obligations and are trained on their responsibilities.

5. Security Measures

We implement appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, or damage, taking into account the state of the art and the risks involved. A summary is set out in Annex 2.

6. Sub-processors

The Client provides general authorization for GroXpertise to engage sub-processors to support the Services, listed in Annex 3. We impose data-protection obligations on each sub-processor that are no less protective than this DPA, and we remain responsible for their performance. We will give the Client reasonable notice of any intended changes to sub-processors so the Client can object on reasonable grounds.

7. Data Subject Rights

Taking into account the nature of the Processing, we will assist the Client with appropriate measures to respond to Data Subject requests to exercise their rights (access, rectification, erasure, restriction, portability, and objection). If we receive such a request directly, we will forward it to the Client and will not respond except on the Client’s instructions or as required by law.

8. Personal Data Breach

We will notify the Client without undue delay after becoming aware of a Personal Data breach affecting the Client’s data, and will provide information reasonably necessary to enable the Client to meet its notification obligations.

9. Assistance & Impact Assessments

Taking into account the nature of Processing and the information available to us, we will provide reasonable assistance to the Client with data-protection impact assessments and prior consultations with Supervisory Authorities.

10. Deletion or Return of Data

Upon termination of the Services, and at the Client’s choice, we will delete or return the Personal Data and delete existing copies, unless retention is required by law.

11. Audits

We will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Client or an auditor it mandates, subject to reasonable notice, confidentiality, and frequency limits.

12. International Transfers

Where Processing involves transfer of Personal Data to a country without an adequacy decision, the parties will put in place an appropriate transfer mechanism, such as the Standard Contractual Clauses, which are incorporated by reference where applicable.

13. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions of liability set out in the Agreement.

14. Governing Law

This DPA is governed by the law of the Agreement, unless Applicable Law requires otherwise.

Annex 1 � Details of Processing

• Subject matter: provision of the Services under the Agreement.
• Duration: the term of the Agreement plus any legally required retention.
• Nature & purpose: hosting, analytics, marketing, lead generation, automation, reporting, and support.
• Types of Personal Data: contact details, business information, usage and device data, and any data within Client Materials.
• Categories of Data Subjects: the Client’s customers, prospects, website visitors, and personnel.

Annex 2 � Security Measures

• Access controls, authentication, and least-privilege permissions;
• Encryption in transit and, where appropriate, at rest;
• Secure hosting with monitoring, logging, and backups;
• Vendor due diligence and contractual safeguards;
• Personnel confidentiality and security awareness;
• Incident response and breach-notification procedures.

Annex 3 � Sub-processors

Current categories of sub-processors include hosting and infrastructure, analytics, email and CRM, advertising platforms, and payment processing. A current list is available on request to [email protected].

Contact

Questions about this DPA: [email protected].