Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between the customer business using Cerebyl (“Customer”, the “Data Fiduciary”) and Enthrella Online Solutions (a sole proprietorship of Harish Sharma, GSTIN 06QBZPS7608C1ZQ, Karnal, Haryana), operating Cerebyl (“Cerebyl”, the “Data Processor”). It governs Cerebyl’s processing of personal data that the Customer enters into the Service on behalf of the Customer’s own customers, parties, and contacts (“Customer Personal Data”). It is written with reference to India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”).

1. Roles

For Customer Personal Data, the Customer is the Data Fiduciary and determines the purposes of processing; Cerebyl is the Data Processor and processes such data only on the Customer’s documented instructions, being the provision of the Service under the Terms.

2. Scope and purpose of processing

• Subject matter: provision of the Cerebyl business-management service.
• Nature and purpose: hosting, storage, retrieval, display, organisation, and processing of Customer Personal Data to deliver the Service’s features (CRM, orders, invoicing, reporting, AI assistant, notifications).
• Categories of data subjects: the Customer’s customers, parties, contacts, leads, and the Customer’s own staff whose records the Customer enters.
• Categories of data: names, contact details, business addresses, order and transaction records, and other business data the Customer chooses to enter.

3. Cerebyl’s obligations

Cerebyl will: (a) process Customer Personal Data only on the Customer’s documented instructions and as needed to provide the Service; (b) not sell Customer Personal Data and not use it to train AI models; (c) ensure persons authorised to process the data are under confidentiality obligations; (d) implement reasonable technical and organisational security measures (Section 5); (e) assist the Customer, taking into account the nature of processing, in responding to data principals exercising their rights and in meeting the Customer’s security and breach obligations; and (f) make available information reasonably necessary to demonstrate compliance with this DPA.

4. Sub-processors

The Customer authorises Cerebyl to engage the following sub-processors, each engaged under terms requiring appropriate security and use of the data only to provide their service:

Sub-processor	Purpose	Location
Supabase	Database, authentication, file storage	India (Mumbai)
Cloudflare	Hosting, content delivery, email routing	Global CDN
Google (Gemini)	AI assistant and automated WhatsApp replies	Google infrastructure
Meta Platforms (WhatsApp Business Platform)	Delivery of WhatsApp messages through the Customer’s connected number	Meta infrastructure
Resend	Transactional email delivery	Provider infrastructure
Sentry	Error monitoring (personal details removed before sending)	European Union

Cerebyl will give the Customer reasonable notice of any intended addition or replacement of a sub-processor, giving the Customer the opportunity to object.

5. Security

Cerebyl maintains reasonable technical and organisational measures appropriate to the risk, including: per-company data isolation enforced by database row-level security; authentication and role-based access control on every request; encryption of sensitive stored secrets; encrypted transport (HTTPS); restricted administrative access; and logging and monitoring to detect and respond to incidents.

6. Personal data breach

Cerebyl will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide information reasonably available to help the Customer meet its own notification obligations under the DPDP Act.

7. Data location and transfers

Customer Personal Data is stored in India (Mumbai region). Any processing outside India by a sub-processor is limited to what is necessary to provide the Service and is carried out only to the extent permitted by the DPDP Act and applicable law.

8. Return and deletion

On termination of the Service, Cerebyl will delete personal and contact data within 180 days, except financial and invoice records which are retained for 6 years to meet Indian statutory obligations and then deleted. On the Customer’s written request before deletion, Cerebyl will make available an export of Customer Personal Data in a commonly used format where technically feasible.

9. Liability

Each party’s liability under this DPA is subject to the limitations of liability in the Terms of Service.

10. Contact

Data queries and notices under this DPA: Cerebyl — Harish Sharma, Grievance Officer, support@cerebyl.com