Data Processing Agreement (DPA) – Setuk
This Data Processing Agreement (“Agreement”) forms part of the Terms & Conditions of Setuk (“Platform”) and governs the processing of personal and sensitive data by Setuk on behalf of its users (“Customer”).
1. Roles of the Parties
Depending on the nature of use:
- Setuk may act as a Data Processor when processing data on behalf of the Customer
- Setuk may also act as a Data Controller for certain operational, analytical, and platform-related purposes
2. Categories of Customers
This Agreement applies to all customers of Setuk, including:
- Individual political representatives (MLA, MP, MLC, Local Body Representatives, Political Aspirants)
- Political parties
- Organizations such as NGOs and campaign teams
3. Types of Data Processed
Setuk may process the following categories of data:
- Personal data (name, contact details, designation)
- Sensitive personal data (including but not limited to health, caste, religion, where provided)
- Political and constituency-related data
- Voter-level data and demographic information
- Communication records and interaction logs
- System and analytics data
4. Purpose of Processing
Data is processed for enabling political, administrative, and constituency management functions, including coordination, communication, scheduling, analytics, and operational tracking.
5. Data Storage & Location
Data is primarily stored within India using cloud infrastructure providers such as AWS, Google Cloud, Utho.com, and similar platforms.
6. Sub-Processors
Setuk may engage third-party service providers (“Sub-processors”) for operational purposes, including but not limited to:
- Hosting providers (AWS, Google Cloud, Utho.com, Hostinger)
- Payment processors (Razorpay, Cashfree)
- Messaging services (WhatsApp APIs, SMS providers)
Additional sub-processors may be added as required. By using Setuk, you consent to such engagement.
7. Data Security
Setuk implements reasonable technical and organizational measures to protect data against unauthorized access, misuse, loss, or alteration. However, absolute security cannot be guaranteed.
8. Data Breach Notification
In the event of a data breach affecting user data, Setuk will notify affected users within 72 hours of becoming aware of the breach, subject to reasonable assessment and verification.
9. Audit Rights
Customers may request reasonable information regarding data processing practices. Any audit or inspection shall be subject to prior notice, reasonable scope, and confidentiality obligations.
10. Data Retention & Deletion
Upon termination of services:
- Data will be retained for up to 60 days
- After this period, data will be deleted or anonymized in accordance with our Data Retention & Deletion Policy
11. Legal Compliance
Setuk may retain or disclose data where required to comply with applicable laws, legal processes, or governmental requests.
12. Limitation of Liability
Setuk shall not be liable for any indirect, incidental, or consequential damages arising from data processing activities, except where required by applicable law.
13. Governing Law
This Agreement shall be governed by the laws of India. Any disputes shall be subject to the jurisdiction of courts in Patna, India.
14. Updates to Agreement
Setuk reserves the right to update this Agreement from time to time. Continued use of the platform constitutes acceptance of such updates.
15. Contact
Data processing inquiries: contact@setuk.org.