Data Processing Addendum

How this Addendum works

This Data Processing Addendum ("DPA") is part of the agreement between The Bill Pro ("we", "us", the "Processor") and the operator named in the Order ("you", the "Operator"). That agreement is made up of the Order, this DPA, our Terms of Service ("Terms"), and the Privacy and Refund Policies they name (together, the "Agreement"). Words defined in the Terms have the same meaning here.

You enter this DPA by signing the Order that refers to it. It has two parts: the Key Terms (Part A), which describe the processing, and the Standard Terms (Part B), which set out each party's obligations. If they conflict, the Key Terms prevail.

---

Part A — Key Terms

Roles	For Subscriber Data (below) you are the Data Fiduciary and we are your Data Processor (DPDP Act s.2(i), s.2(k), s.8(2)). For your own account and your users' accounts we are a Data Fiduciary, and our Privacy Policy governs that data, not this DPA.
Service	SVS, offered as The Bill Pro: web software for running a cable TV and broadband operation (subscriber records, billing and collections, packages, inventory, complaints, expenses, reports, messaging).
Subscriber Data	Personal data that you or your users enter into or upload to the Service about individuals other than your own users.
Data Principals	Your subscribers (cable TV and broadband customers); the contact people of MSOs, suppliers and other businesses you record.
Categories of personal data	Name, date of birth, gender, photograph; address, email, mobile and alternate phone numbers; an identity document (an image or PDF you upload — masked Aadhaar only, §B4.3); GST, electricity-board, post and CAF numbers; connection, set-top-box and card numbers, packages and plans; bills, payments, dues and collection records; complaints and their notes; SMS messages composed for a subscriber and their log. For businesses you record: names, contact people, phone numbers, emails, addresses.
Sensitive data	None is intended. The Service does not ask for financial account, health, biometric or caste data, and you must not enter it. An identity document is the most sensitive item it holds (§B4.3).
Nature and purpose of processing	Storing Subscriber Data, displaying it to your authorised users according to the roles you assign, computing bills, dues and reports, producing the exports and printouts you ask for, backing it up, restoring it after a failure, and deleting it (§B7). Nothing else: we do not use Subscriber Data for our own purposes, for marketing, profiling or training, and we do not sell or share it.
Frequency	Continuous, for as long as the Agreement lasts.
Duration	The term of the Agreement, then until deletion under §B7.
Where it is processed	India only: Google Cloud's Mumbai (asia-south1) and Delhi (asia-south2) regions (§B3).
Approved Sub-processors	Listed in §B2.4.
Security measures	Part C.
Our contact for this DPA and for security incidents	support@thebillpro.in; [[GRIEVANCE OFFICER NAME]], [[designation]], [[REGISTERED OFFICE ADDRESS]].
Your contact	The email address in your Order, unless you tell us another in writing.

---

Part B — Standard Terms

B1. Relationship

1. We process on your behalf. For Subscriber Data, you decide why and how it is processed, and we process it only on your behalf. Under DPDP Act s.8(1) you remain responsible for complying with the Act for that data, including for processing we do for you; this DPA is the contract s.8(2) requires before a Data Fiduciary engages a Data Processor.
2. If you are yourself a processor (for example, you run the Service for an MSO or a franchisor that decides the purposes), we are your sub-processor, and you will make sure your own contract permits it.

B2. Processing

1. Your instructions. You instruct us to process Subscriber Data (a) to provide, secure, support and maintain the Service; (b) as you direct through your use of the Service (what your users enter, change, export or delete); (c) as set out in the Agreement; and (d) as you otherwise instruct in writing and we acknowledge. We follow these instructions unless Indian law prevents it, and tell you at once if we cannot. You will give only lawful instructions.

2. Changes to the Service. If we add or change a feature in a way that changes Part A (for example, connecting an SMS gateway), we will update Part A and tell you at least 30 days before the change applies to Subscriber Data.

3. Your responsibilities as Data Fiduciary. You are responsible for:

   • giving your subscribers the notice the DPDP Act s.5 requires and obtaining consent, or relying on another lawful ground, for what you record (s.4, s.6, s.7);
   • the accuracy and completeness of Subscriber Data you use to make decisions about a subscriber (s.8(3));
   • not recording a child (under 18) without verifiable consent of a parent or lawful guardian (s.9);
   • deciding how long you need each subscriber's data, and deleting or instructing us to delete it when you no longer do (s.8(7)) — the Service lets your users deactivate and delete records;
   • answering your subscribers' requests and grievances (s.11–s.14), with our help (§B5.1);
   • notifying the Data Protection Board of India and your affected subscribers of a personal data breach (s.8(6), Rule 7), with our help (§B4).

4. Sub-processors. You approve these sub-processors:

   Sub-processor	What it does	Where
   Google Cloud (Google Cloud India Private Limited; Google LLC)	Hosting, database, file storage, backups, logs, error reports, secrets	India: Mumbai (asia-south1), Delhi (asia-south2)
   [[EMAIL PROVIDER]]	Our support mailbox. It receives Subscriber Data only if you or your users send it to us in a support request	[[EMAIL PROVIDER LOCATION]]

   We will tell you at least 30 days in advance, by email, before adding or replacing a sub-processor, so that you can object. If you object on reasonable data-protection grounds and we cannot resolve it, you may terminate the Agreement before the change takes effect and we will refund the unused part of your prepaid period. We bind each sub-processor by a written contract to protect Subscriber Data at least as well as this DPA does, and we remain responsible to you for what it does.

5. Browser-side services that are not sub-processors. Two Google services are reached directly by your users' browsers, not by us (Privacy Policy §5): the Google Translate widget, which sends the text on screen, possibly including Subscriber Data, to Google, possibly outside India, only when a user picks a language; and Google Fonts, which receives the user's IP address and browser details on page loads but no Subscriber Data. Using Translate on screens that show Subscriber Data is your users' choice and your decision as Data Fiduciary; tell your users not to if your notices to subscribers do not allow it.

B3. Location and transfers

1. Subscriber Data is stored and processed in India, in the regions in Part A, including all backups, logs and uploaded files. We will not move it outside India without your written instruction, and never to a country the Government of India has restricted under DPDP Act s.16.
2. §B2.5 describes the only flows that can leave India; they start in your users' browsers at their request.

B4. Security

1. Safeguards. We keep the technical and organisational measures in Part C in place, which are reasonable security safeguards in the sense of DPDP Act s.8(5) and Rule 6. We may improve them, but will not reduce the overall protection they give.
2. Our people. Only named administrators can access production systems, and only to run, secure and support the Service. Each is bound to confidentiality.
3. Identity documents and Aadhaar. You and your users will upload an Aadhaar card as an identity document only as a masked copy: the first eight digits of the Aadhaar number hidden and only the last four visible (UIDAI's "masked Aadhaar"). You will not record a full Aadhaar number anywhere in the Service. An entity that verifies identity from a physical or electronic copy of Aadhaar may not collect, use or store the Aadhaar number (Aadhaar Act 2016 s.8A(4)(b)). If we find an unmasked Aadhaar copy, we may ask you to replace it, and you will.
4. Personal data breaches. If we become aware of a personal data breach affecting Subscriber Data, we will:
   • notify you without undue delay, and in any case within 24 hours of becoming aware of it, so that you can intimate the Board and your affected subscribers without delay and send the Board your detailed report within 72 hours (Rule 7);
   • tell you, as we learn them: what happened, when and how; which data and roughly how many subscribers; the likely consequences; what we have done and propose to do to contain and remedy it; and, if known, who caused it;
   • take prompt, reasonable steps to contain, investigate and remedy it;
   • keep a record of it. We will not notify your subscribers or the Board on your behalf unless you ask us to in writing or the law requires it. Notifying you is not an admission of fault.
5. Logs. We keep the security logs that the Service and our cloud provider produce for at least the period Rule 6(1)(e) requires once it applies (one year), and use them only to detect, investigate and remedy unauthorised access and misuse.

B5. Assistance

1. Requests from subscribers. If a subscriber or anyone else writes to us about Subscriber Data, we will forward the request to you within 7 days and will not answer it ourselves, except to tell them we have forwarded it. Your Admins can find, correct, export and deactivate a subscriber's records in the Service; where they cannot, we will help.
2. Authorities. If a court or government authority asks us for Subscriber Data, we will tell you first unless the law forbids it, and disclose only what we are legally required to.
3. Information. Once a year, on written request to the contact in Part A, we will answer a reasonable security questionnaire and give you the information you reasonably need to show that this DPA is being met. We do not hold third-party certifications (such as ISO 27001 or SOC 2) today, and will say so if asked. We keep records of our compliance with this DPA for 3 years after it ends.

B6. Confidentiality

We treat Subscriber Data as your confidential information under Terms §13, indefinitely.

B7. Return and deletion

1. During the Agreement, your users can deactivate and delete records in the Service, and export your data at any time.
2. When the Agreement ends, you may ask for an export of your data for 30 days (Terms §10). We then delete all Subscriber Data, with your account, users and uploaded files, within 90 days of the end, except what Indian law requires us to keep. Deleted data leaves our backups only as they expire: automated database backups and point-in-time recovery after 7 days, the nightly disaster-recovery copy after 30 days (plus up to 7 days soft-deleted), deleted uploads after 7 days. Until then backups are used only to restore the Service after a failure. On request we will confirm the deletion in writing.

B8. Liability

Each party's liability under this DPA is subject to the limits and exclusions in Terms §11, except where the law does not allow it to be limited.

B9. Order of precedence

If documents conflict: the Order, then this DPA, then the Terms, then the policies (Terms §1).

B10. Term

This DPA starts when the Order is signed and lasts as long as we process Subscriber Data for you, including after the Agreement ends until deletion under §B7.

B11. Governing law

This DPA is governed by the laws of India, and disputes about it are resolved as Terms §15 provides.

B12. Definitions

"Data Fiduciary", "Data Processor", "Data Principal", "personal data", "personal data breach" and "processing" have the meanings in DPDP Act s.2. Until the relevant provisions of the DPDP Act and Rules commence, the corresponding terms of the Information Technology Act 2000 and its Reasonable Security Practices Rules 2011 apply, and each party will meet whichever obligations are in force.

---

Part C — Security measures

These are the measures in place on 2026-10-07.

Area	Measure
Isolation between operators	Every operator's data carries its operator id, and the database itself (PostgreSQL row-level security, forced on every operator table) refuses any row of another operator, whatever the application asks for. The application's database account cannot bypass it. Tested by an adversarial security review before launch, and by automated tests on every change.
Access within an operator	Six roles you assign, with branch (Sub-LCO) restrictions, checked on every request.
Sign-in	A self-hosted identity service (Logto) in our own cloud account. Passwords are stored only as salted one-way hashes (Argon2); a password policy applies; repeated failures lock the identifier. Sessions can be revoked, and a deleted or suspended user's session ends.
In transit	HTTPS only (TLS), with HTTP Strict Transport Security.
At rest	Encrypted by Google Cloud (database, files, backups, logs).
Uploaded files	Private. Read only through the Service by the uploading operator's signed-in users; never public. Stored in both Indian regions.
Browser protections	An enforced Content Security Policy, and framing refused.
Backups and restore	Automated daily database backups and point-in-time recovery (7 days), kept even if the database is deleted; a nightly copy to a separate project in Delhi (30 days). Restores are tested by restoring into a new database and comparing the data.
Monitoring	Errors reported with the operator they affect; uptime checks; alerts by email for errors, failed backups and capacity.
Production access	Limited to named administrators, behind Google sign-in and, for the internal console, Google's Identity-Aware Proxy. Deployments are automated from reviewed code, with no long-lived cloud keys.
Secrets	Kept in Google Secret Manager, never in code.
Deletion	A tested procedure exports and then deletes one operator's data, users and files without touching any other operator's, rehearsed before launch.

---

Attribution

Based on the Common Paper Data Processing Agreement Standard Terms, Version 1.1 (https://commonpaper.com/standards/data-processing-agreement/1.1), © Common Paper, Inc., licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Changed: restructured as an addendum to our Terms; the GDPR, UK, Swiss and CCPA provisions and the EEA/UK transfer mechanisms removed; adapted to the DPDP Act 2023 and DPDP Rules 2025 (roles, s.8 obligations, Rule 6 safeguards, Rule 7 breach timing, s.16 transfers); the sub-processor, breach, audit, deletion and security sections rewritten for SVS as built; Aadhaar and browser-side service clauses added. Common Paper has not reviewed or endorsed this document.