LEGAL
Data Processing Addendum
Version 1.1 · Last updated 4 November 2026
This Data Processing Addendum (“DPA”) governs personal data that Kasplo Internet Private Limited (“Kasplo”) processes on behalf of its customer (“Customer”) through the subscribed Kasplo services. It forms part of the governing service agreement and accepted Order Forms (“Agreement”).
1 Application and definitions
This DPA takes effect when incorporated into an Agreement accepted by Customer or otherwise agreed in writing. Publication alone does not replace an existing negotiated DPA.
Customer Personal Data means personal information submitted by or for Customer, or generated for Customer through the Services, that Kasplo processes on Customer’s behalf. It includes identifiable recipient, message, engagement and integration data. Services means the Kasplo modules actually subscribed to.
Applicable Data Protection Law means privacy, security and data-protection laws binding on the relevant party and processing, as amended and to the extent in force. Statutory terms, including controller, processor, data fiduciary, service provider and consumer, have their applicable legal meanings.
A Security Incident is a security breach causing accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data.
This DPA prevails over conflicting Agreement terms concerning personal-data processing. Mandatory law and applicable transfer clauses take priority. Commercial terms remain governed by the Agreement, subject to Section 13.
2 Roles and scope
Customer acts as controller or data fiduciary, or as a processor authorised by the relevant controller. Kasplo acts as processor, subprocessor or equivalent service provider. Customer must be authorised to give instructions for each controller or affiliate it represents.
Schedule 1 describes the processing. Sending profiles and account permissions do not create separate contracting entities or permission to share data between unrelated customers.
Kasplo’s independent handling of business-contact, account-administration and billing information is described in its Privacy Policy. Actual activities and law determine those roles; recipient data and message-event logs remain subject to this DPA when processed on Customer’s behalf.
3 Instructions and permitted use
The Agreement, this DPA, accepted configurations, API requests and authorised service use constitute Customer’s documented instructions. Further lawful instructions must remain within the agreed scope.
Kasplo will process Customer Personal Data only to provide, secure and support Customer’s Services, follow those instructions or meet applicable legal obligations. If Kasplo considers an instruction unlawful, it will promptly inform Customer and may suspend the affected processing while the parties resolve it, without obstructing legally required assistance.
Kasplo will not sell Customer Personal Data, use recipient lists for its own or another customer’s marketing, or use identifiable data for unrelated commercial purposes. It will not pool identifiable recipient data across customers for independent reuse.
Any information used outside Customer’s service must be lawfully and genuinely anonymised and contain no identifiable Customer confidential information. Hashing alone does not make information anonymous. Kasplo will not attempt reidentification.
4 Customer responsibilities
Customer determines its recipients, communications, content, integrations and enabled tracking or segmentation. It is responsible for lawful collection, required notices and permissions, an appropriate lawful basis, accurate instructions, and honouring objections and suppressions.
Customer must protect its credentials, authorised users and connected systems, and promptly report suspected compromise. A Customer acting for another controller remains responsible for its authority and obligations to that controller.
Customer must minimise sensitive information. Special-category or otherwise highly regulated processing requires an expressly accepted scope and the necessary safeguards. Unnecessary authentication secrets, full payment-card credentials and highly regulated records must not be uploaded to contact lists or profiles.
These duties do not remove Kasplo’s obligations, including protection of personal data submitted contrary to the agreed scope.
5 Confidentiality and security
Kasplo will restrict access to personnel and authorised providers who need it for the permitted work. Authorised personnel must be subject to contractual or statutory confidentiality duties continuing after access ends.
Kasplo will maintain technical and organisational measures appropriate to the processing and risks, taking account of the state of the art and implementation costs. Schedule 2 sets out its security commitments. Measures may be improved or replaced without materially reducing overall protection.
Additional certifications, dedicated infrastructure, recovery objectives or customer-specific controls apply when expressly agreed, without limiting safeguards required by law.
6 Subprocessors
Customer gives general written authorisation for the subprocessors in Schedule 4 and those appointed under this section. Kasplo will identify the provider, processing purpose and relevant locations, impose written data-protection obligations no less protective than this DPA as applicable to the delegated processing, and remain responsible for those obligations.
Kasplo will give at least 15 calendar days’ prior written notice before a new or replacement subprocessor processes Customer Personal Data. Notice goes to Customer’s designated contact or account administrator. Customer may object during that period on reasonable data-protection grounds.
The parties will seek a reasonable solution and may pause the affected processing while resolving the objection. While a timely objection remains unresolved, the proposed subprocessor will not receive the affected data unless Customer authorises it or law requires it. If no workable solution is available, either party may terminate the affected Service. Kasplo will refund unused prepaid platform fees for its remaining term; further minimum fees for that Service will cease. Properly incurred, non-refundable external-channel charges remain governed by the Agreement.
Corporate CRM, accounting and other business tools fall within this section only when they process Customer Personal Data for the Services. Customer-selected integrations, destination mail servers, carriers and channel platforms are assessed according to their actual roles; any provider acting as Kasplo’s subprocessor remains subject to this section.
7 Rights requests and assistance
Taking account of the processing and information available, Kasplo will provide timely, reasonable assistance with individual rights requests, security, breach reporting, impact assessments and required regulatory consultations or assessments.
Kasplo will promptly notify or refer a request concerning Customer Personal Data to Customer unless prohibited by law. Customer determines the response; Kasplo will not respond substantively without instructions unless legally required.
Existing service tools and ordinary cooperation are included. Substantial additional work may carry reasonable charges disclosed and agreed in advance where lawful. Kasplo will not charge for assistance required because of its breach or withhold mandatory assistance because a charge is disputed.
8 Security Incidents
Kasplo will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data in processing by Kasplo or its subprocessors, and meet any shorter applicable legal deadline.
The initial notice will contain available information about the incident, affected data and individuals, likely consequences, mitigation and a follow-up contact. Kasplo will supply further information without undue delay as the investigation progresses.
Kasplo will contain, investigate and mitigate the incident, preserve relevant evidence and assist with required notifications. Customer controls notifications concerning its processing; each party remains responsible for reports it is independently required to make. Neither party must await the other’s approval to meet a legal deadline.
Notice goes to Customer’s security contact or, failing one, its account administrator, with additional urgent channels where appropriate. Customer must keep those details current. Unsuccessful attempts that do not cause a personal-data breach are not Security Incidents. Notification does not itself admit liability.
9 Required disclosures
Where law requires Kasplo to process or disclose Customer Personal Data, Kasplo will inform Customer beforehand where permitted and limit disclosure to what is required.
Kasplo will assess public-authority requests, seek clarification or challenge them where there are reasonable legal grounds, and document relevant requests and responses as permitted. Applicable transfer-clause duties concerning government access, notification and challenges remain in force.
10 Return and deletion
During the subscription, Customer may use available export and deletion facilities or request reasonable assistance. In-service retention follows the accepted Order Form, module terms or retention schedule. Termination does not restore data already lawfully deleted.
After termination, the following single 30-calendar-day offboarding period applies:
During the first 30 days — Customer may request export of data still retained or instruct earlier deletion.
By the end of day 30 — Kasplo deletes operational copies from the application and databases, and remaining backup copies.
Both deadlines run from termination. Export uses available, commonly used machine-readable formats or another agreed secure method. Customer should request export promptly so it can be completed before deletion; an export request does not automatically extend the deadline.
A different lawful schedule must be expressly agreed in writing. Longer mandatory switching or retrieval rights, including applicable rights under Section 19 of Kasplo’s standard Service Agreement, prevail.
Pending deletion, retained data remains protected and restricted to permitted retrieval, recovery or legally required purposes. Deletions and suppressions must be reapplied following a backup restoration before ordinary service use.
Legally required records, lawful holds and limited suppression records may be retained only for justified, lawful purposes and periods, subject to any stricter transfer-clause requirement. This does not permit retention of whole recipient lists for general commercial use. Kasplo will confirm deletion and explain lawful retention exceptions on written request.
11 Hosting and transfers
Primary application hosting is on AWS in Mumbai, India, subject to any different express deployment agreement. Agreed location restrictions apply to hosting, backups and authorised access. Planned infrastructure is not represented as an active deployment.
Destination communications infrastructure, authorised integrations, support access and corporate systems may involve other countries. Kasplo will not make a restricted international transfer without applicable lawful safeguards. Schedule 3 applies to the relevant jurisdictions and transfers.
The parties will provide information needed for transfer assessments and additional safeguards. Where required safeguards are unavailable or insufficient, affected transfers must be suspended until a lawful solution is in place. Mandatory transfer-clause suspension and termination rights remain unaffected.
12 Compliance information and audits
Kasplo will maintain required records and make available information needed to demonstrate compliance. Relevant security documentation and available independent reports may be used first.
Where that information does not reasonably satisfy applicable audit rights, Kasplo will allow and contribute to a proportionate audit by Customer or a qualified independent auditor. Ordinary audits normally occur once in twelve months on 30 days’ notice, during business hours and under suitable confidentiality and security arrangements.
Those limits do not restrict audits required by law, a competent authority, a relevant Security Incident or reasonable evidence of material non-compliance. Audit arrangements must protect other customers’ information and avoid unnecessary disruption without obstructing lawful oversight. Penetration testing requires separate authorisation.
Customer bears its auditor’s costs. Exceptional Kasplo assistance is chargeable only where reasonable, agreed in advance and lawful. Kasplo bears reasonable remediation and re-verification costs attributable to its material breach. Regulatory access rights remain unaffected.
13 Liability
The Agreement’s lawful liability framework applies to this DPA within the same aggregate cap across the Services. This DPA creates no separate cap.
Where Kasplo’s standard Service Agreement applies, Section 17 governs the cap, eligible platform/service fees and excluded taxes and external-channel pass-through charges. A negotiated Agreement retains its expressly agreed lawful framework.
No exclusion or cap restricts liability that mandatory law or applicable transfer clauses prohibit limiting, binds regulators, or removes non-waivable individual rights or remedies.
14 Duration, changes and contacts
This DPA continues while Kasplo retains Customer Personal Data subject to it. Changes follow the Agreement’s applicable notice and acceptance process; posting a new version alone does not replace negotiated terms.
The Agreement’s governing law and dispute provisions apply except where mandatory law or Schedule 3 requires otherwise.
Privacy and processing requests: support@kasplo.com
Formal legal notices: legal@kasplo.com
Urgent security and subprocessor notices go to Customer’s designated contacts without routine next-business-day notice delays.
Schedule 1 — Processing details
This schedule supplies Annex I.A and I.B of the EU standard contractual clauses where applicable.
A Parties and roles
Customer / data exporter: the legal entity, registered address and designated contact in the Agreement or accepted Order Form. Its activity is using the subscribed communications or marketing services; its role is controller or processor according to the actual processing. Customer must keep these details complete and current.
Kasplo / data importer: Kasplo Internet Private Limited, No. 71, 2nd Floor, Flex co-works, Vishnu Estates Building, 15th Cross, Dollars Layout, JP Nagar 3rd Phase, Bengaluru, Karnataka 560078, India. Its activity is providing the subscribed Services as processor or subprocessor. Privacy contact: support@kasplo.com; formal notices: legal@kasplo.com.
Acceptance: legally binding acceptance of the Agreement incorporating this DPA, or separate execution, constitutes each party’s acceptance and signature of the applicable transfer clauses and schedules on that effective date.
B Processing description
Only subscribed and enabled features apply.
Subject and purposes — Providing, securing and supporting Customer’s subscribed communications, marketing, verification and intelligence services under its lawful instructions.
Operations — Receiving, validating, organising, storing, retrieving, segmenting, analysing, transmitting, supporting, suppressing and deleting information.
Marketing Cloud — Contacts, audiences, campaigns, segmentation, RFM, journeys, enabled email/SMS/WhatsApp communications and connected-store or engagement reporting.
Email API / SMTP — Message submission and transmission, delivery events, webhooks, suppression/preference handling, troubleshooting and reporting.
Email Verification — Assessing submitted email addresses and returning verification results.
Email Intelligence — Analysis of Customer-authorised sending, deliverability, inbox placement, complaints and related information.
Individuals — Customer’s recipients, subscribers, customers, prospects, users and others whose data it lawfully submits or authorises collection of.
Data categories — Contact/profile details and identifiers; preferences, consent and suppression records; message content and headers; delivery, open, click, bounce and complaint events; IP/device and interaction data; verification results; authorised store, order and integration data.
Frequency and duration — Ongoing or on demand during the subscription and the permitted offboarding or mandatory retention periods in Section 10.
Sensitive data — Only within an expressly accepted scope and safeguards required by law. Purpose limitation, restricted access, minimisation, risk-appropriate encryption and agreed retention apply. Additional required safeguards must be agreed before processing. Section 4 remains applicable.
Schedule 2 — Security measures
Kasplo will maintain the following measures. Additional service-specific safeguards may supplement them without reducing protection required by law.
Access — Individual staff access, role-based permissions and least privilege; approved and periodically reviewed production access; prompt removal of unnecessary access; multi-factor authentication for privileged production access.
Customer separation — Logical separation and authorisation checks for application, API, job and export access. Customer administrators manage their authorised users within available permissions.
Transport — TLS/HTTPS for public application, API and administrative connections. Encrypted messaging transport where supported and appropriate, subject to mandatory or expressly agreed requirements. Destination mail servers and carriers form part of the delivery path.
Storage and secrets — Some customer-database storage is not encrypted at rest. Backups containing Customer Personal Data are encrypted. Access to keys and secrets is restricted; credentials and password storage are handled securely; unnecessary secrets are excluded from support records. Kasplo will provide the applicable encryption scope for due diligence.
Network and changes — Restricted production network access, firewalls or equivalent controls, separation of administrative functions, controlled changes and risk-based vulnerability remediation.
Logging — Risk-appropriate access and security-event records, protection against unauthorised access or alteration, relevant alert review and retention consistent with legal duties.
Recovery — Protected backups, documented recovery procedures and periodic restoration testing. Specific recovery-time or recovery-point guarantees apply only when expressly agreed.
Testing and incidents — Periodic vulnerability/security assessments, risk-based remediation and documented incident handling, escalation and notification procedures.
People and suppliers — Confidentiality duties, security awareness, controlled support access and contractual oversight of subprocessors.
Data lifecycle — Documented retention and deletion, restricted backup access, reapplication of deletions after restoration, and assistance with lawful exports and rights requests.
Relevant supporting detail will be supplied under Section 12. Further measures required for specific sensitive data or transfer risks must be documented before that processing.
Schedule 3 — Regional and transfer provisions
A India
Where Indian law applies, the parties perform their respective data-fiduciary, processor or other applicable roles under the Information Technology Act, 2000, relevant SPDI Rules, and the Digital Personal Data Protection Act, 2023 and Rules, to the extent applicable and in force.
Kasplo will assist Customer with applicable security, incident, rights, grievance, retention and deletion obligations within its role and the information available. Customer’s responsibilities do not remove a duty imposed directly on Kasplo.
B EEA transfers
For a transfer requiring safeguards under Chapter V GDPR, where the following clauses are an available lawful mechanism and no applicable alternative is relied upon, the unmodified relevant modules of the EU standard contractual clauses under Decision (EU) 2021/914 (“EU SCCs”) are incorporated as follows:
Parties — Customer is exporter; Kasplo is importer, as described in Schedule 1A.
Modules — Module Two for controller-to-processor transfers; Module Three for processor-to-subprocessor transfers. Each applies only to its relevant data flow. Modules One and Four do not apply.
Clause 7 — Optional docking clause does not apply. Any additional contracting party must be validly identified and accepted through the governing contractual process.
Clause 9(a) — Option 2, general written authorisation; 15 calendar days’ prior notice. Section 6 supplies the notice and objection process without reducing mandatory SCC rights.
Clause 11(a) — Optional independent dispute-resolution language does not apply.
Clause 13 / Annex I.C — The competent authority determined by Clause 13: normally Customer’s competent EEA authority; where Customer is outside the EEA, the authority applicable to its representative or relevant data subjects as that clause requires. Customer must identify the applicable authority before the transfer.
Clause 17 — Option 1; Irish law, provided third-party-beneficiary rights are recognised as required by the SCCs.
Clause 18 — Courts of Ireland, without limiting an individual’s additional rights under that clause.
Annex I.A and I.B — Schedule 1 and the completed Customer details in the Agreement or Order Form.
Annex II — Schedule 2 and any agreed additional measures for the relevant processing or transfer.
Annex III — Schedule 4 and changes validly notified and authorised under Section 6.
The SCCs prevail over inconsistent terms, including liability or audit restrictions. They are not amended by a general limitation in the Agreement. The parties will comply with the SCCs’ local-law assessment, government-access, notification, suspension and termination requirements.
The SCCs apply only within their permitted scope. Any different required instrument or additional measure must be implemented before the relevant transfer. Kasplo does not rely on the EU–US Data Privacy Framework for its India processing.
C United Kingdom
Where required for a UK restricted transfer, the EU SCCs above apply as amended by the ICO International Data Transfer Addendum, version B1.0 (“UK Addendum”), including its mandatory provisions and permitted revisions.
Table 1 — The parties, contacts, roles, acceptance and start date in Schedule 1A and the completed Agreement or Order Form. Any additional party-identification details required for the transfer must be supplied before it begins.
Table 2 — The approved EU SCCs and applicable Modules Two/Three and selections identified in Schedule 3B.
Table 3 — Schedule 1 supplies parties and transfer details; Schedule 2 supplies technical/organisational measures; Schedule 4 supplies subprocessors.
Table 4 — Neither Party is selected to end the UK Addendum under its Section 19 following an approved-addendum change.
The UK Addendum controls conflicts for the relevant UK transfer.
D Switzerland
Where Swiss transfer safeguards are required, the EU SCCs apply with the modifications necessary under the current Swiss Federal Act on Data Protection. References include that Act and equivalent provisions; Swiss individuals are not excluded from third-party-beneficiary rights; and the Swiss Federal Data Protection and Information Commissioner is the competent authority for Swiss-only matters.
For Swiss-only transfers, references to EU member-state law and courts are read as Swiss law and competent Swiss courts where necessary. Where GDPR also applies, its required authority, law and forum remain in place for that processing, and Swiss individuals retain applicable access to Swiss courts.
E United States
Where Customer discloses personal information under an applicable US state privacy law, Kasplo acts as processor, service provider or contractor as appropriate, for the limited business purposes specified in Schedule 1.
Kasplo will not sell that information or share it for cross-context behavioural advertising; retain, use or disclose it for unrelated commercial purposes or outside the direct business relationship except as law permits; or combine it with data from other sources except to the limited extent permitted by applicable law for the agreed purposes. Kasplo will provide the same level of privacy protection required by applicable US law, including the protection required of businesses under the CCPA where it applies. Kasplo certifies that it understands and will comply with these restrictions.
Customer may take reasonable steps to verify compliant use and, upon notice, stop and remediate unauthorised use. Kasplo will notify Customer if it can no longer meet its applicable obligations, cooperate with lawful individual requests and assessments, and impose required obligations on further processors. These provisions do not authorise an exception prohibited by another applicable law or this DPA.
F Other applicable jurisdictions
Additional mandatory processing terms or approved transfer instruments required for another jurisdiction must be put in place before the affected processing or transfer. A general reference to the EU SCCs does not substitute for a different instrument required by that jurisdiction.
Schedule 4 — Subprocessors
Customer authorises the provider below for the specified processing, subject to Section 6.
Amazon Web Services (AWS) — Processing: Cloud hosting and infrastructure supporting the subscribed Services, during the subscription and permitted deletion lifecycle Location: India; primary application hosting in Mumbai.
Kasplo will disclose relevant deployment and authorised access locations and respect agreed restrictions under Section 11. Proposed deployments become part of the active processing record only when implemented and appropriately disclosed.
A dated Subprocessor List supplied to Customer may maintain these details under Section 6. It cannot expand processing purposes or override agreed location restrictions. Additional providers require authorisation under that section.