This Data Processing Addendum forms part of the Terms of Service between you and NeuroRank. It applies where NeuroRank processes personal data on your behalf in its capacity as a data processor, as defined under applicable data protection law including UK/EU GDPR and India’s DPDPA.

 

This DPA does not apply to personal data that NeuroRank collects and processes as a data controller for its own purposes (which is governed by the Privacy Policy).

 

1. Definitions

Data Controller: the party that determines the purposes and means of processing personal data (you, as the business customer).

 

Data Processor: the party that processes personal data on behalf of and under the instruction of the Data Controller (NeuroRank).

 

Personal Data and processing have the meanings given under applicable data protection law.

 

2. Processing Instructions

NeuroRank will process personal data only on your documented instructions and only to the extent necessary to provide the services you have contracted. We will not process your customers’ personal data for any other purpose without your instruction, except where required by law.

 

3. Confidentiality

All personnel authorised by NeuroRank to process personal data are bound by confidentiality obligations and will only process data as necessary to provide the services.

 

4. Security

NeuroRank will implement and maintain the technical and organisational security measures described in the Privacy Policy (Section 8) to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

 

5. Sub-Processors

You authorise NeuroRank to engage sub-processors to assist in providing the services. Current sub-processors are listed in the Privacy Policy (Section 4.1). We will notify you of any intended addition or replacement of material sub-processors. You may object to new sub-processors by terminating your subscription.

 

6. Data Subject Rights

NeuroRank will, to the extent technically feasible, assist you in fulfilling your obligations to respond to data subject rights requests relating to personal data we process on your behalf. You are responsible for responding to data subjects directly.

 

7. Data Breach Notification

NeuroRank will notify you without undue delay, and in any event within 72 hours, upon becoming aware of a personal data breach affecting personal data we process on your behalf. We will provide sufficient information to allow you to fulfil your own breach notification obligations under applicable law.

 

8. Data Protection Impact Assessments

NeuroRank will, upon your reasonable request, provide information necessary for you to carry out data protection impact assessments (DPIAs) where required under applicable law.

 

9. Deletion and Return of Data

Upon termination of the services or upon your request, NeuroRank will delete or return all personal data processed on your behalf, and will delete existing copies, except to the extent we are required to retain it by applicable law.

 

10. Audit Rights

NeuroRank will make available to you all information reasonably necessary to demonstrate compliance with these obligations and will allow for and contribute to audits and inspections, at your cost and with reasonable advance notice. Audits will be conducted in a manner that does not disrupt our operations or expose confidential information of other customers.

 

11. International Transfers

Where the processing involves transfer of personal data outside the EEA, UK, or other jurisdiction that restricts international transfers, NeuroRank will ensure appropriate safeguards are in place as described in the Privacy Policy.

 

12. Governing Law

This DPA is governed by the same law as the Terms of Service (laws of India), except where applicable data protection law requires a different standard, in which case that standard will apply.