Data processing addendum

Last updated: 3 November 2026

This addendum is part of the agreement between Hadoopt Technologies Private Limited, India ("Hadoopt", "we", "the processor") and the organisation that subscribes to a SmartMy product ("the customer"). It sets out how we process personal data on the customer's behalf under the Digital Personal Data Protection Act, 2023 and the rules made under it ("DPDP law"). Where it differs from the rest of the agreement on personal data, this addendum applies.

1. Roles

• The customer is the Data Fiduciary for the personal data it, its users and the people it serves put into the service ("customer personal data"). It decides why and how that data is processed.
• Hadoopt is the customer's Data Processor for customer personal data. We process it to provide the service on the customer's documented instructions, and for our own research and product work as section 4 says. The customer agreement, the settings the customer chooses in the product and the requests its administrators make are those instructions.
• For the data we collect for ourselves (our websites, sign-up, billing, the account directory that lets apps find a workspace, and our own support records), Hadoopt is the Data Fiduciary, as our privacy notice explains.

2. What we process

3. Our commitments

We will:

1. process customer personal data only on the customer's instructions, and tell the customer if we believe an instruction breaks DPDP law;
2. not sell it, and not use it for advertising;
3. make sure everyone at Hadoopt who can reach customer personal data is bound to confidentiality, and give access only to those who need it;
4. keep the security measures in section 7;
5. help the customer answer requests from the people its data is about (access, correction, erasure, nomination, grievance) through the tools in the product, and assist where a request cannot be answered with them;
6. tell the customer of a personal data breach as in section 8;
7. delete customer personal data at the end as in section 11.

4. Our research and product work

The customer agrees that we may use customer personal data for our own purposes: to study how the products are used, to find and fix problems, to improve and build products and services, and to train, test and improve AI models, our own or ones we build with service providers working for us. For this use we decide why and how the data is processed, so we are a Data Fiduciary for it and answer for it under DPDP law. We will:

1. not sell the data, and not use it for advertising;
2. use the least data the work needs, and remove names, contact details and other details that identify a person wherever the work allows;
3. give access only to our staff and service providers who do this work, under confidentiality;
4. keep the security measures in section 7 for this data too.

5. The customer's commitments

The customer will:

1. tell the people its data is about, in its own notice, that Hadoopt may also use their data for research, product work and AI training as section 4 says;
2. give each person the notice DPDP law requires and have a lawful basis (consent or a legitimate use) for everything it records, including the purpose-wise consent the product asks for before enrolling a face;
3. take verifiable consent from a parent or lawful guardian before processing data of a child (anyone under 18), except where DPDP law exempts it, and not use the service to track or monitor children's behaviour beyond what that law allows an educational institution, hostel or transport service;
4. set up roles so that each user sees only what that user needs;
5. turn on only the optional features (AI, face recognition, location sharing, messaging channels) it has a basis for;
6. answer the requests of its own people, and publish its own grievance contact.

6. Sub-processors

The customer authorises us to use the service providers listed in section 9 of our privacy notice, each for the purpose listed there and each bound by a written contract with protections no weaker than this addendum. Some of them are used only when the customer turns on the feature that needs them (for example WhatsApp, SMS, a payment gateway, single sign-on, AI or face recognition). We will publish any new sub-processor on that page at least 30 days before it starts processing customer personal data; a customer that objects on reasonable grounds may end the affected product without penalty before the change takes effect. We remain responsible for our sub-processors.

7. Security

• Encryption in transit (HTTPS/TLS) for every website, portal, app and service connection.
• Face templates: no user, of the customer or of Hadoopt, can read them through the product; only the server process uses them. On devices they are kept in encrypted storage and wiped after 7 days without a sync, on sign-out and when the device is blocked.
• Passwords stored only as salted hashes; optional single sign-on and two-step sign-in.
• Keys and passwords of connected services (single sign-on, messaging, payment terminals, calendars) stored encrypted and readable only by the administrators who set them.
• Patching of servers and dependencies; least-privilege access for our staff, with strong authentication.

8. Personal data breaches

We will tell the customer without undue delay, and in any case within 24 hours of becoming aware of a breach affecting its personal data, with what we know: what happened, the data and people likely affected, what we have done and what we recommend. We will update the customer as we learn more and give the help it needs to inform the Data Protection Board of India and the people affected within the time DPDP law sets. Informing the Board and the people is the customer's duty as Data Fiduciary, unless we agree that we do it on its behalf.

9. Where data is stored

Customer personal data may be stored and processed in India or in other countries where we or our sub-processors operate, but never in a country to which the Government of India has restricted transfers under section 16 of the DPDP Act. The same safeguards apply everywhere. We will tell the customer before its data is moved to another country.

10. Audits and information

We will give the customer the information it reasonably needs to show that this addendum is followed: answers to security questionnaires once a year, the support-access log, and our sub-processor list. Any on-site audit is by agreement, with reasonable notice, at the customer's cost, and subject to confidentiality.

11. End of the service and deletion

• We delete nothing automatically while the service runs: customer data stays until the customer deletes it. The customer can correct or delete records itself, and may switch on deletion periods in the products itself; all are off unless the customer sets them.
• While a subscription is active, the customer can export its records with the export functions in each product.
• When a product is given up, it is locked and its data kept for 15 days in case the customer takes it again; then, or earlier on "Delete now", that product's data and files are deleted. Data the customer's other products use is kept.
• When the agreement ends, the customer's whole database and files are deleted 15 days after the end; when a bill stays unpaid 15 days after access was blocked, they are deleted then. We may extend any of these periods, at the customer's request or when we choose to, and tell the customer the new date. These, and a given-up product's data above, are the only automatic deletions.
• Deleted data drops out of our backups as they expire, within 15 days. We keep nothing after that, except invoices and records the law requires us to keep, which hold no customer personal data beyond the billing contact.

12. Contact

Questions about this addendum, and breach notices: Grievance Officer, Hadoopt Technologies Private Limited, [email protected].