Data processing agreement

1. Roles

You (the client) are the data controller. THE TECH GENIUS DIGITAL MARKETING STORE is the data processor. We process personal data only on your documented instructions, which include the statement of work and any written instruction you give us afterwards.

If we believe an instruction breaches applicable data protection law, we will tell you and may pause that processing until it is resolved.

2. Scope of processing

• Subject matter — provision of website, ecommerce, software, automation, messaging and search services.
• Duration — the term of the engagement, plus any agreed retention period.
• Categories of data subject — typically your customers, prospects, enquirers, guests or staff.
• Types of personal data — typically names, contact details, order and booking records, message content, and technical identifiers. We do not process special category data unless expressly agreed in writing.

3. Confidentiality

Everyone we allow to process your data is bound by a duty of confidentiality that survives the end of the engagement.

4. Security

We implement measures appropriate to the risk, including encryption in transit, access limited to those who need it, multi-factor authentication where the platform supports it, and separation of client environments.

We hold no formal certification such as ISO 27001 or SOC 2. We state that openly rather than implying an audited standard we have not been audited against. If your procurement process requires certification, we are probably not the right vendor for that engagement, and we would rather say so at the start.

5. Sub-processors

You give general authorisation for us to engage sub-processors. Current ones are:

• Vercel Inc. — hosting and content delivery (US/EU)
• Resend — transactional email delivery (US/EU)
• Google LLC — analytics and search reporting (US/EU)
• Meta Platforms — WhatsApp Business Platform, where your project uses it
• Shopify Inc. — where your project is built on Shopify
• AI model providers — where an AI feature is part of your project, named in the statement of work

We will give you at least 30 days’ notice before adding or replacing a sub-processor, and you may object on reasonable data protection grounds.

6. International transfers

We are established in India, which does not currently benefit from an EU or UK adequacy decision. Where we process personal data originating in the EEA, UK or Switzerland, transfers are made under the European Commission’s Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum, together with a transfer risk assessment on request.

7. Assisting you

We will help you, at your cost where the effort is material, to respond to data subject requests, carry out data protection impact assessments, and consult supervisory authorities. If a data subject contacts us directly about your data, we will forward it to you rather than responding ourselves.

8. Personal data breaches

We will notify you without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting your data, with the information you need to meet your own notification obligations.

9. Deletion and return

On termination we will, at your choice, delete or return the personal data we hold on your behalf, except where we are required to retain it by law. Where you ask for deletion we will confirm in writing when it is done.

10. Audit

We will make available the information reasonably necessary to demonstrate compliance with this agreement, and allow for audits on reasonable written notice, no more than once a year unless a breach or a regulator requires otherwise.

11. Relationship to other terms

This agreement forms part of, and is governed by, our terms of service. Our own handling of data as a controller is described in our privacy policy.

Contacting us about this

Questions about this document, or any request relating to your data, should go to thetechgenius.in@gmail.com. We aim to respond within five working days, and within any shorter period the law requires.