This Data Processing Addendum (“DPA”) supplements the Terms of Service between ZopPay Technologies Pvt. Ltd. (“Processor”) and the merchant identified on the ZopPay account (“Controller”) where applicable data-protection laws require a written agreement between the parties.
1. Roles
When ZopPay processes personal data on behalf of Controller in connection with the Service, ZopPay acts as a data processor and Controller acts as a data controller. Controller determines the purposes and means of processing; ZopPay processes only on documented instructions.
2. Scope of processing
- Subject matter: provision of the ZopPay payment orchestration platform.
- Duration: the term of the Terms of Service, plus a reasonable tail period required for reconciliation, audit, and legal obligations.
- Nature and purpose: relaying payment instructions, generating transaction metadata, producing reports and invoices, maintaining audit logs, and providing support.
- Categories of data subjects: Controller's end customers, authorised users of Controller's account.
- Categories of data: account identifiers; customer names, email addresses and phone numbers where supplied; for saved cards, the card brand, last four digits and gateway card token; transaction metadata; and logs. For ePayLater payments, the customer's PAN and/or Aadhaar number and one-time password pass through ZopPay's servers to ePayLater. ZopPay does not receive raw card numbers or CVVs.
3. Controller instructions
Controller's complete and final instructions to ZopPay are: (a) the Terms of Service and any applicable order form; (b) this DPA; and (c) the configuration and API calls that Controller issues through the Service. ZopPay will notify Controller if it considers an instruction to violate applicable law.
4. Confidentiality
ZopPay will ensure that personnel authorised to process personal data have committed to confidentiality and receive appropriate data-protection training.
5. Security
ZopPay implements appropriate technical and organisational measures to protect personal data, including (without limitation) TLS in transit, AES-256-GCM envelope encryption of gateway credentials and webhook secrets, SHA-256 hashing of API keys, bcrypt hashing of passwords, scoping of every record to its organisation, logging of staff access, and rate limiting. These measures are described further in the Security page of the marketing site.
6. Sub-processors
Controller authorises ZopPay to engage sub-processors for the provision of the Service, including cloud infrastructure (currently Google Cloud) and email delivery providers. A current list is available on request at privacy@zoppay.in. ZopPay will give Controller reasonable prior notice of new sub-processors and an opportunity to object on reasonable grounds.
7. International transfers
Where personal data is transferred from a jurisdiction that restricts international transfers to ZopPay or a sub-processor, the parties will rely on applicable transfer mechanisms, including Standard Contractual Clauses where required.
8. Data subject requests
ZopPay will, to the extent legally permitted, promptly notify Controller of any request received directly from a data subject, and will provide reasonable assistance to enable Controller to respond.
9. Personal data breach
ZopPay will notify Controller without undue delay after becoming aware of a personal data breach affecting Controller's data, with information reasonably required for Controller to meet its own notification obligations.
10. Audit
On reasonable notice and not more than once per year (except where required by a regulator or following a material incident), Controller may, subject to appropriate confidentiality obligations, audit ZopPay's compliance with this DPA. ZopPay may satisfy this obligation by providing recent third-party audit reports, where available.
11. Return or deletion
On termination, ZopPay will, at Controller's choice and subject to legal retention obligations, delete or return personal data processed on Controller's behalf.
12. Contact
Questions or execution requests: legal@zoppay.in.