Data Processing Agreement

Two parties, two roles, one body of data.

1. This agreement is between the organisation that has accepted our Terms of Service (“you”, the customer) and SORVI AI LTD, a company registered in England and Wales with company number 16927720, whose registered office is at Unit 5a Victoria Road, Stoke-On-Trent, England, ST4 2HS, United Kingdom (“SorviAI”, “we”, “us”).
2. You are the Data Fiduciary of the personal data in your workspace: you decide why it is processed and how. That includes everything you and your authorised users enter, upload, sync or send through SorviAI. Under the SPDI Rules 2011 you are the body corporate that collects it.
3. We are your Data Processor. We process that data only on your behalf, to provide the service to you, on your documented instructions, and for no purpose of our own.
4. This agreement does not apply to personal data we decide about ourselves: our own signup, account, billing, support, website, newsletter and careers data. Our Privacy Policy governs that data.
5. We are established in the United Kingdom and have no company or office in India. Our team works from the United Kingdom and India.

This agreement is not signed on its own: it travels with the Terms of Service.

1. This agreement forms part of the Terms of Service and is concluded when they are: when a workspace is created or the service is first used for your organisation, or when both parties sign an order form. It applies for as long as we process personal data for you under the Terms of Service.
2. If you need a copy signed by us for your records, ask at [email protected] and we will send one. A signed copy carries the same terms as the version published here on the date it is signed.
3. If documents conflict, they apply in this order, each only to the extent of the conflict: (a) the terms in Annex 4, for personal data of people in the European Union they cover; (b) this agreement, for personal data we process for you; (c) an order form, for the commercial terms it sets out, where it says expressly that it overrides the Terms of Service; (d) the Terms of Service; and (e) the other documents the Terms of Service list. It is the same order the Terms of Service set out.

1. Customer personal data means personal data in your workspace that we process for you, as described in Annex 1.
2. Data protection law means, to the extent each applies to the processing: section 43A of the Information Technology Act 2000 and the SPDI Rules 2011, until they cease to apply; the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025, as each part comes into force; for personal data of people in the European Union, the GDPR (Regulation (EU) 2016/679), as Annex 4 sets out; and any other data protection law that applies to your processing.
3. Sub-processor means a third party we engage that can reach customer personal data. Services you connect yourself are not sub-processors, as Sub-processors explains.
4. Onward transfer means sending customer personal data, or making it accessible, to a recipient in another country that is a separate legal entity from us.
5. Personal data breach means any unauthorised processing of customer personal data, or its accidental disclosure, acquisition, sharing, use, alteration or destruction, or loss of access to it, that compromises its confidentiality, integrity or availability.
6. Working day means a day other than a Saturday, a Sunday or a public holiday in England.
7. Other terms, such as Data Fiduciary, Data Principal, Data Processor and processing, have the meanings they have in the Digital Personal Data Protection Act 2023.

A processor contract should describe the processing itself. Annex 1 does that module by module; this section sets the frame.

1. Subject matter. Providing the SorviAI platform and the applications you subscribe to, such as Finance, Inventory, Worklink, Repairs, Storefront, the Customer and Vendor Portals, Nest and TeamEmail.
2. Duration. For as long as the Terms of Service run, and after that until the data is deleted under Deletion and return at the end.
3. Nature. Hosting, storing, backing up, retrieving, displaying, transmitting, syncing, exporting and deleting, together with the support, security and incident work needed to run the service.
4. Purpose. Only to provide, support and secure the service for you. We do not use customer personal data for our own purposes, we do not sell it, we do not use it for advertising, and we do not use it to train artificial intelligence models.
5. SorviAI does not currently use an AI provider. If we add one, it will be listed as a sub-processor with where it processes data, under Sub-processors.

1. We process customer personal data only on your documented instructions. Your instructions are: (a) the Terms of Service and this agreement; (b) what you and your authorised users do in the product, such as creating a record, uploading a file, connecting a mailbox, sharing a Nest link or sending a document by email; and (c) any further written instruction you give us that is consistent with the service, for example about a rights request or a breach.
2. The one exception is where a law that applies to us, in India, the United Kingdom or elsewhere, requires us to process the data in some other way, such as under a lawful order from a court or a public authority. In that case we tell you before we act, unless the law or the order forbids it. Requests from public authorities describes how we handle those requests.
3. We tell you promptly if, in our opinion, an instruction infringes data protection law. We are not obliged to carry out an instruction we reasonably believe is unlawful while we discuss it with you.
4. As Data Fiduciary, you are responsible for having a lawful ground, consent or a legitimate use, for what you put into SorviAI, for giving the people concerned the notice the law requires, and for the lawfulness of your instructions. For Worklink in particular, Worklink: employee data sets out what that means for an employer.

Our people reach workspace content in two ways only. Both are described plainly here, including what neither of them records.

1. Everyone at SorviAI who can reach customer personal data is bound by a duty of confidentiality, by contract or by law.
2. Support access. A SorviAI super administrator can sign in to your workspace on a user’s behalf through an impersonation route. We use it only to resolve a support request from you, to investigate a credible abuse report or to meet a legal duty, and a senior engineer approves each use. The start of each session is recorded in our platform audit log in the same database transaction as the access, so it cannot happen unrecorded, and your interface shows a banner for as long as it lasts. A session can last up to 30 days. What the staff member does during the session is not recorded separately.
3. Direct database access. Our director and one or two senior engineers can connect to production databases directly from their work computers to run operational and diagnostic tasks. The list of people with this access is reviewed every quarter. These connections leave no audit record.
4. Before access. Background checks are carried out before anyone is given access to production systems or customer personal data. Security and data protection training is given at onboarding, with a refresher each year.
5. Devices. Work laptops have full-disk encryption, a screen lock and automatic updates. Personal devices are not used for production access.
6. Leavers. When someone leaves, their access to our code repository, our hosting, our payment provider, email and the platform is removed on the day they leave. Our director is accountable for it.
7. Where we work. Our team works remotely, from the United Kingdom and India, and no office holds customer personal data. Where your data is, and where it goes explains how access from India is treated.

1. We apply the technical and organisational measures in Annex 2 as our reasonable security safeguards (DPDP Act, section 8(5), and DPDP Rules 2025, rule 6) and reasonable security practices (SPDI Rules 2011, rule 8). Annex 2 is taken from our Security page, row for row, with each measure’s status today. Where a measure is not in place, Annex 2 says so, and we do not claim it.
2. We may change the measures as the service develops, but we will not reduce the overall level of protection they give. When a measure listed as not in place is put in place, we update Annex 2 and the Security page together.
3. You are responsible for the security of what sits on your side: who you give access to, which roles they hold, and whether your users turn on two-factor authentication, which an administrator cannot yet require.

1. General authorisation. You give us general written authorisation to engage sub-processors. Those in place on the date of this version are listed in Annex 3, and the maintained list is published on our Compliance page.
2. Notice. Before a new or replacement sub-processor starts handling customer personal data, we announce it on the published list and email your workspace account owners at least 30 days in advance. There is no separate subscription for these notices.
3. Objection. You may object on reasonable data protection grounds within that period by writing to [email protected]. We will discuss the objection with you in good faith. If we cannot resolve it, you may end the affected subscription by written notice before the change takes effect, and we will refund, pro rata, the fees you have paid for the unused part of the period.
4. The same obligations, passed down. Each sub-processor that holds or processes customer personal data for us (our hosting, email, payment, error monitoring and support mailbox providers) is bound by a written contract imposing data protection obligations no weaker than those in this agreement, including sufficient guarantees on security. Google Fonts, Google Docs Viewer, jsDelivr, unpkg and GeoNames are public services we use under their providers’ standard terms, with no separate data processing contract; Annex 3 states what each receives.
5. We stay responsible. We remain liable to you for the performance of each sub-processor’s obligations as if they were our own.
6. Services you connect are not our sub-processors. UPS, FedEx and DHL, Microsoft 365 for TeamEmail, and your own Stripe account receive data because you switch them on for your workspace. That data goes at your direction and under your own agreement with each provider, and Annex 3 lists them separately. One works differently: online invoice payment through the Customer Portal uses Stripe Connect, so payments go to your own connected Stripe account, but SorviAI creates that account and makes the charges with its own Stripe platform key, and the payer’s email address and the invoice number are sent to Stripe.

The application, the database and uploaded files are hosted in London. Nothing is kept in India. Data leaves London in a few ways, listed here.

1. We host customer personal data on DigitalOcean in its London region: the application, the database and uploaded files, for every workspace wherever the customer is. DigitalOcean keeps database backups off-site and does not publish where. A backup in India is planned, but it is not in place and has no date; until it is, we keep no copy of customer personal data in India.
2. Indian law sets no condition today on our keeping the data in the United Kingdom or on the onward transfers below. From 13 May 2027 the Government may restrict transfers to countries it names (DPDP Act, section 16). If it names a country where we or a sub-processor hold customer personal data, we tell you promptly and stop or move that processing as the restriction requires.
3. The onward transfers we make are to the sub-processors in Annex 3 that are outside the United Kingdom, or reach the data from outside it. We make no other onward transfer without your authorisation.
4. Everyone on our team in India is employed by SORVI AI LTD. A team member who reaches our systems from India is part of the same company, so that access is not an onward transfer, and it is covered by this agreement’s confidentiality and security terms.
5. Before anyone works for us as a contractor or through another company and can reach customer personal data, we sign terms with them no weaker than this agreement and, for personal data of people in the European Union, the clauses in Annex 4. No one does today.
6. If you are subject to a stricter rule, such as a sector regulator’s requirement to keep data in India, it is yours to meet, and SorviAI cannot meet it while the service is hosted in London.
7. You can ask for a copy of the terms that apply to any transfer at [email protected].

1. A request from an individual about data in your workspace is yours to answer, because you are the Data Fiduciary. If one reaches us, we pass it to you without undue delay and do not answer it ourselves, unless you instruct us to.
2. We help you answer it by appropriate technical and organisational measures, as far as that is possible, taking into account the nature of the processing. Where a request needs our help, we respond within 10 working days of your written request.
3. When we help with an access request, we search every system that can hold data about the person, and tell you which ones we searched.
4. If a grievance about personal data concerns processing we carry out for you, we help you answer it within the same 10 working days.

What SorviAI supports today

From 13 May 2027 the DPDP Rules give you at most 90 days to answer a request, and the SPDI Rules give one month for a grievance today; our 10 working days is set well inside both.

From 13 May 2027 you must tell the Data Protection Board of India and each person affected of a personal data breach without delay, and give the Board a detailed report within 72 hours (DPDP Rules 2025, rule 7). Our commitment is set so that you can still meet yours.

1. If we become aware of a personal data breach affecting customer personal data, we notify you without undue delay, and in any case within 48 hours of confirming it.
2. We notify the workspace administrators on record, and any additional contact you have given us for this purpose.
3. We tell you what happened; which categories of your data, and roughly how many people, were involved; when it occurred and when we detected it; what we have done; the likely consequences; and what you need to do. Where we do not yet know something, we tell you what we know and follow up as we learn more.
4. We take reasonable steps to contain the breach and reduce its effects, keep a record of it, and cooperate with your investigation.
5. We do not notify the Data Protection Board, or the people in your workspace, about your data on your behalf, unless you ask us to or the law requires it.
6. We report the cyber incidents CERT-In lists to CERT-In within 6 hours of noticing them, as its Directions require, whether or not your data is involved. That report is ours; it does not notify anyone on your behalf.
7. A suspected incident can be reported to us at [email protected] or by telephone on +44 20 7509 3731.

Where a breach affects data we decide about ourselves, we notify the Data Protection Board and the people affected as rule 7 requires from 13 May 2027, as our Privacy Policy explains.

The DPDP Act requires a data protection impact assessment and an audit only of a Significant Data Fiduciary (section 10), but you may want one anyway for Worklink attendance records and connected TeamEmail mailboxes.

1. Where your processing needs an impact assessment or an audit, we give you the information we reasonably can about our processing to support it. We answer your assessment questions within 10 working days of your request.
2. We cooperate with the Data Protection Board of India, CERT-In and any other authority with jurisdiction over the processing.

When the Terms of Service end, we return your data to you and delete it when you ask us to, so that you can meet your own duty to have your processor erase data (DPDP Act, section 8(7)), on the exit terms in our Terms of Service.

1. Return. While you are subscribed you can export per module: list exports are capped at 20,000 rows, Nest downloads one file at a time, and TeamEmail, Storefront, POS and Escalate have no export. There is no whole-workspace export in the product, so our team exports your data for you on request, at any time and free of charge. When a subscription ends, every application locks at once, leaving only sign-in and billing; for at least 30 days after that, our team exports your data on request.
2. Deletion. Nothing deletes a workspace automatically. Customer personal data stays in our systems, on the terms of this agreement, until you ask us in writing to delete it, so that you can re-subscribe and regain access. We delete it from our live systems within 30 days of that request, and confirm the deletion to you in writing.
3. Backups. Deleted data remains in backup copies until they are overwritten, within 7 days after deletion from our live systems. We use backups only to recover the service from a failure.
4. What the law makes us keep. Where the law requires us to keep something, we keep only what that law requires, protect it under this agreement, and use it for nothing else.

Your own retention duties continue

Deleting your workspace does not end what Indian law requires you to keep: books of account for eight years (Companies Act 2013, section 128) and GST records for 72 months from the due date of the annual return (CGST Act 2017, section 36). Our seven-day backups are not an archive and meet none of those duties, so ask for your export and keep your records before you ask us to delete them.

SorviAI holds no third-party security certification or attestation today: no Cyber Essentials certificate, no ISO 27001 certificate and no SOC 2 report. Cyber Essentials is first on our roadmap. Until a certificate exists, this section is how you check us.

1. We make available to you the information reasonably necessary to show that we meet this agreement, and we allow for and contribute to audits, including inspections, by you or an auditor you mandate.
2. We offer first: our Security page, which is the source of Annex 2, with the gaps stated; your security questionnaire, completed on your own form at no charge, within 10 working days; and a call with an engineer who has read the code, usually within a week.
3. If that information does not answer a reasonable concern, you may audit our processing of your data: on at least 30 days’ written notice; no more than once in any 12 months, unless a personal data breach or a regulator requires it; during working hours and without unreasonably disrupting the service; by you or an independent auditor who is not our competitor, under a written duty of confidentiality; and at your own cost.
4. An audit may not give access to another customer’s data, or to our systems beyond what is needed to verify our processing of yours.
5. We tell you immediately if, in our opinion, an audit instruction infringes data protection law.

1. If a public authority asks us for customer personal data, we check that the request has a valid legal basis that reaches us. In India that includes a direction from CERT-In under section 70B(6) of the Information Technology Act 2000, a direction for interception, monitoring or decryption under section 69, a blocking order under section 69A, and a call for information under section 36 of the DPDP Act once it is in force; in the United Kingdom, where the data is hosted, a warrant or notice under the law there.
2. We disclose only what the request compels, and we refuse or challenge a request that does not have a proper basis.
3. Where we can, we direct a request for your business records to you, as the Data Fiduciary.
4. We tell you before we disclose, unless the law forbids it, and for only as long as it forbids it. Directions under sections 69 and 69A of the IT Act are confidential, so for those we may not be able to tell you at all.
5. A request from an authority of another country must reach us through a legal route that binds us. We do not give access to customer personal data on such a request unless an international agreement, or the law that applies to us, requires it.

1. Each party’s liability arising out of or in connection with this agreement is subject to the limitation of liability in the Terms of Service and counts towards the same limit: the fees paid or payable by the customer in the 12 months before the event giving rise to the claim. Claims under this agreement sit inside that limit, not beside it.
2. Nothing in this agreement limits or excludes liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be limited or excluded.
3. Nothing in this agreement limits the rights the people whose data you hold have against either of us under data protection law, or the powers of the Data Protection Board of India or any other authority with jurisdiction.

For employee records you are the Data Fiduciary as employer, with the duties Indian employment and data protection law add, and we process the data on your instructions. You may process employee data for employment purposes without consent (DPDP Act, section 7(i)), but the other duties still apply. What Worklink does today, and what that means for you:

• Aadhaar numbers. Do not enter them, on an employee record or as a visitor’s ID. The Aadhaar Act 2016 (section 29) limits how an Aadhaar number may be kept, displayed and shared, and Worklink has no masked or restricted field for one.
• PAN, other ID numbers and bank details. Worklink has free-text national ID, tax ID and social security number fields, and fields for bank name, account number and routing code. They are stored in plaintext and returned in full by the API to anyone you give employee access, with no restriction to payroll roles; detail screens show only the last four characters of the ID fields, but the edit form shows them in full. Financial details are sensitive personal data under the SPDI Rules 2011. Leave the fields empty unless you need them in Worklink, and limit who has employee access.
• Health data. SorviAI sets up a “Sick Leave” leave type in every workspace that uses Worklink, and every leave request needs a free-text reason, so details of an illness can be typed into the record. A leave request can also carry a supporting document such as a doctor’s note. Medical records are sensitive personal data under the SPDI Rules 2011. Record the fact and dates of absence, tell staff not to put a diagnosis in the reason field, and ask for a doctor’s note only where you need it.
• Identity documents. A copy uploaded to an employee record is an ordinary document, visible to anyone with access to that record, and nothing deletes it automatically. Keep such copies only as long as you need them: restrict access and diarise the deletion.
• Registers. The labour codes and state rules require employers to keep registers of attendance, hours and wages. Worklink records check-in and check-out times, hours, breaks and overtime, and deletes none automatically. The records are not tamper-evident, and Worklink produces no statutory register format; the attendance records export (CSV or Excel) carries each day’s times, breaks, hours and overtime, so export it and keep the registers the law requires.
• Monitoring. Worklink records the IP address of every check-in and check-out, and there is no setting to switch it off, so tell your staff. It uses no biometrics, no location coordinates and no photographs at check-in; the only image it holds is an optional profile picture. We will not add biometric check-in without a separate data protection review. Our error monitoring records one session in ten and every session with an error, with typed inputs masked but on-screen text not, so a recording can include an open employee record; tell your staff that too.
• Automatic records. Worklink marks employees absent automatically each day when no check-in is recorded, and can clock people out automatically if you switch that on (off by default). These are records for you to review and correct, not decisions: nothing in Worklink takes a decision with legal or similarly significant effect on its own.
• Visitors. The visitor desk can record a visitor’s ID type and number. They are hidden in API responses but stored as entered, and nothing deletes them automatically. Record them only where you need them, and never an Aadhaar number.
• Connected mailboxes. Access to employees’ email through TeamEmail is monitoring too. Tell staff which mailboxes are connected and who can read them.

An employee who asks us about their record is referred to you, and we help you answer.

1. We may update this agreement to reflect changes in the law, in the service or in our sub-processors. Changes to the sub-processor list follow Sub-processors.
2. For any other change that reduces your rights or our obligations, we give workspace account owners at least 30 days’ notice by email, and you may leave before it takes effect. A change the law requires takes effect when the law requires.
3. Version 1.1 records that Session Replay runs only for users who allow analytics in our consent banner. It replaces version 1.0, effective 1 October 2026. Every later version will be published here with its date, and earlier versions will be kept at this address.
4. This agreement ends when we have finished deleting customer personal data under Deletion and return at the end. The duties in Confidentiality of our people, Deletion and return at the end and Liability continue for any data we still hold after that.

1. This agreement, and any dispute or claim arising out of or in connection with it or its subject matter (including non-contractual disputes or claims), is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, as under the Terms of Service.
2. The transfer terms in Annex 4 are governed by the law they themselves specify.

This agreement is between businesses. The choice of English law does not take away any protection that Indian law, or other data protection law applying to your processing, gives you or the people whose data you hold, and the Data Protection Board of India or a court with jurisdiction under that law keeps it.

Three kinds of request, each with its own commitment. All three reach the same desk, so an urgent one is never parked behind a routine one.

No Data Protection Officer is appointed: the DPDP Act requires one only of a Significant Data Fiduciary, and we have not been notified as one. Deepak Gupta, director, is responsible for data protection. Our reasoning is on our DPDP and GDPR Compliance page.

The processing this agreement covers, module by module.

Data subjects, overall. Your authorised users (for their activity in your workspace; their accounts with us are covered by our Privacy Policy); your employees and other staff, including repair technicians, and the family members and dependants an employee record names; visitors signed in at your visitor desk; your customers and suppliers and their contact persons; people who report a repair, raise a help desk request, send a storefront enquiry, sign in to your portals or open a file you shared by public link; people who exchange email with your team; and shipment recipients.

Frequency. Continuous, for the duration set out under What we process, for how long, and why.

Sensitive personal data. The SPDI Rules 2011 treat passwords, financial details, medical records and biometric information, among others, as sensitive personal data. In SorviAI that means: health information in Worklink (every workspace that uses it has a Sick Leave type, every leave request needs a free-text reason, and a doctor’s note can be attached); bank details and pay; and anything sensitive you choose to put in an uploaded file, an email or a free-text field. SorviAI processes no biometric data; what you type into a free-text field or upload is yours to control.

Other sensitive data. PAN and other identification numbers, held in plaintext free-text fields; copies of identity documents; and visitors’ ID numbers. Do not enter Aadhaar numbers anywhere in SorviAI.

These measures come from our Security page, with the same status. Where a row says a measure is not in place, it is not promised.

The sub-processors in place on the date of this version. The maintained list is on our Compliance page.

Contracts. DigitalOcean (which engages Cloudflare for App Platform), Twilio, Stripe, Functional Software (Sentry) and Microsoft process data under their data processing terms. Google Fonts, Google Docs Viewer, jsDelivr, unpkg and GeoNames are public services used under their providers’ standard terms, with no separate data processing contract.

Our own team. Not a sub-processor. Everyone on our team in India is employed by SORVI AI LTD, so a team member who reaches our systems from there is part of the same company. Anyone who worked for us as a contractor or through another company would be a sub-processor, bound before their access began by terms no weaker than this agreement and, for personal data of people in the European Union, by the clauses in Annex 4.

Services you connect (not our sub-processors)

This annex applies only to customer personal data that the GDPR (Regulation (EU) 2016/679) governs, such as data about your customers or suppliers in the European Union. For that data, and only for it, these terms add to the rest of this agreement.

Part A: the GDPR terms

1. Roles. You are the controller and we are your processor. This agreement is the contract article 28 of the GDPR requires: its sections on instructions, confidentiality, security (with Annex 2 as the measures article 32 asks for), sub-processors, help with requests and assessments, breaches, deletion and audits are our article 28(3) commitments.
2. Breaches. Our notice within 48 hours of confirming a breach leaves you time to notify your supervisory authority within the 72 hours article 33 allows.
3. Into the United Kingdom. Your transfer of this data to us relies on the European Commission’s adequacy decision for the United Kingdom, renewed on 19 December 2025 and valid until 27 December 2031. If it ends, we agree the Standard Contractual Clauses with you before it does.
4. Adequacy. An onward transfer to a country the European Commission recognises as adequate, including Switzerland, is made on that basis, with no further safeguard. Recipients inside the European Union, such as Sentry in Frankfurt and Stripe’s contracting entity in Ireland, receive no international transfer.
5. The Data Privacy Framework. A transfer to a recipient in the United States that is certified under the EU-US Data Privacy Framework relies on that certification, but only for the kinds of data the certification covers. DigitalOcean, Cloudflare, Twilio, Stripe, Functional Software (Sentry), Google and Microsoft are certified; the official list was checked on 28 September 2026. Cloudflare, Stripe, Google and Microsoft are certified for HR data too; for HR data, Twilio’s data protection addendum provides the transfer terms and Sentry holds its copy in Frankfurt, but DigitalOcean’s agreement adds no safeguard if HR data is reached from the United States.
6. Transfer agreements. Any other international transfer of this data is made under the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, module 3 (processor to processor), after a transfer impact assessment that we record and repeat when the law or practice in the destination changes.
7. Our team in India. They are employed by SORVI AI LTD, so their access is not an international transfer to another organisation.
8. Foreign authorities. We do not give a public authority outside the European Union access to this data unless an international agreement, or the law that applies to us, requires it (GDPR article 48).
9. Rights and supervision. Nothing in this agreement limits the rights of the people concerned under article 82 of the GDPR, or the powers of a supervisory authority in the European Union.

Part B: the Standard Contractual Clauses for contractors

We sign them before anyone outside the European Union who works for us as a contractor or through another company, in India or elsewhere, can reach this data. Today no one does: our team in India is employed by SORVI AI LTD. The clauses are used as the European Commission adopted them, without change, with these choices:

Four phrases the GDPR terms in Annex 4 use that most readers will not have met before.