Data Processing Agreement

This Data Processing Agreement (the “DPA”) forms part of the agreement between ADSCRUSH MARKETING PRIVATE LIMITED (CIN: U74999DL2020PTC372599) (“AdsCrush”, “Processor”) and the customer that has agreed to the AdsCrush Terms of Service (“Customer”, “Fiduciary”), under which AdsCrush processes personal data on behalf of the Customer. It is incorporated by reference into the Terms of Service.

This DPA sets out the rights and obligations of the parties with respect to the processing of personal data through the AdsCrush platform, in accordance with the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the DPDP Rules, 2025.

Capitalised terms used but not defined in this DPA have the meanings given in the DPDP Act and the Terms of Service. In this DPA:

• Personal Data means any personal data (including data about end users, such as leads, clicks, and conversions) that the Processor processes on behalf of the Fiduciary under the Terms of Service.
• Processing means an operation or set of operations performed on personal data, including collection, recording, storage, use, and sharing.
• Data Principal means the individual to whom the Personal Data relates.
• Personal Data Breach means a breach of security safeguards leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

The parties acknowledge and agree that, with respect to Personal Data, the Customer is the Data Fiduciary and AdsCrush is the Data Processor.

The Processor shall process Personal Data only on documented instructions from the Fiduciary, unless required to do so by applicable law, in which case the Processor shall inform the Fiduciary of that legal requirement prior to processing, unless the law prohibits such information on important grounds of public interest.

The subject matter, duration, nature, and purpose of the processing, and the categories of Data Principals and Personal Data, are described in the Schedule to this DPA.

The Fiduciary represents and warrants that it has all necessary rights, consents, and legal bases to process the Personal Data and to instruct the Processor to do so, and that such instructions comply with the DPDP Act and applicable law. The Fiduciary shall provide appropriate notice and obtain valid consent from Data Principals as required under the DPDP Act, and shall respond to Data Principal requests in accordance with its obligations as a Data Fiduciary.

The Processor shall:

• Process Personal Data only in accordance with the Fiduciary's documented instructions and this DPA;
• Ensure that persons authorised to process Personal Data are bound by appropriate confidentiality obligations;
• Implement and maintain reasonable security safeguards, as described in Section 6;
• Assist the Fiduciary in complying with its obligations under the DPDP Act, including obligations relating to Data Principal rights and Personal Data Breach intimation;
• Make available to the Fiduciary information necessary to demonstrate compliance with this DPA; and
• Not “de-identify” or otherwise use Personal Data for any purpose other than performing the Services.

Taking into account the nature, scope, and purpose of processing, the Processor shall implement reasonable security safeguards to protect Personal Data, including:

• Encryption of data in transit (TLS);
• Encryption or hashing of sensitive identifiers at rest where technically feasible;
• Role-based access controls and least-privilege access;
• Regular monitoring, logging, and incident detection; and
• Periodic review and testing of security measures.

The Fiduciary grants the Processor a general authorisation to engage sub-processors for the purpose of providing the Services. The Processor shall:

• Notify the Fiduciary of any new or replacement sub-processor by updating a list made available to the Fiduciary;
• Impose on each sub-processor data-protection obligations equivalent to those in this DPA; and
• Remain fully liable to the Fiduciary for the acts and omissions of its sub-processors.

To the extent required by the DPDP Act, the Processor shall assist the Fiduciary in responding to requests from Data Principals to exercise their rights (access, correction, erasure, and grievance redressal). Where a Data Principal makes a request directly to the Processor, the Processor shall promptly direct the Data Principal to the Fiduciary and provide reasonable assistance in addressing the request.

Upon becoming aware of a Personal Data Breach, the Processor shall:

• Notify the Fiduciary without undue delay (and in any event within seventy-two (72) hours) of becoming aware of the breach;
• Provide reasonable information available to the Processor about the nature, scope, and impact of the breach, and the measures taken or proposed to address it; and
• Provide reasonable assistance to the Fiduciary in intimating the breach to the Data Protection Board of India and affected Data Principals as required under the DPDP Act and Rules.

The Processor shall also comply with its own statutory obligations, including reporting specified security incidents to CERT-In within the timelines required by applicable directions.

Upon termination or expiry of the Terms of Service, or upon the Fiduciary's written request, the Processor shall, at the Fiduciary's option, delete or return all Personal Data in its possession, unless applicable law requires retention, in which case the Processor shall inform the Fiduciary and process the retained Personal Data only for the required purpose and duration.

Where Personal Data is transferred outside India, the Processor shall ensure such transfers comply with the DPDP Act, including through contractual safeguards with recipients, and shall provide the Fiduciary with information about such transfers upon request.

The liability of the Processor arising out of or in connection with this DPA shall be subject to the limitation of liability provision in the Terms of Service. The Fiduciary shall remain responsible for its own compliance with the DPDP Act as a Data Fiduciary.

This DPA shall remain in effect for as long as the Processor processes Personal Data on behalf of the Fiduciary and shall terminate upon deletion or return of all Personal Data in accordance with Section 10.

This DPA shall be governed by the laws of India, and the courts at New Delhi shall have exclusive jurisdiction, subject to the arbitration and dispute-resolution provisions of the Terms of Service, which shall apply mutatis mutandis.

Notices under this DPA may be sent to the Processor at legal@adscrush.com. Security-related notifications may be sent to security@adscrush.com.