This Data Processing Agreement forms part of the Terms and sets out how PulsePoint processes personal data on your behalf. It's designed for the procurement and security reviews that buyers run before signing.
1 Roles of the parties
For employee personal data processed through PulsePoint, the Customer is the Data Fiduciary and PulsePoint is the Data Processor under the DPDP Act, 2023. PulsePoint processes personal data only on the Customer's documented instructions.
2 Scope & purpose
| Subject matter | Detail |
|---|---|
| Categories of data | Roster identifiers, survey ratings, free-text comments, technical logs |
| Categories of persons | Customer's employees and administrators |
| Nature of processing | Collection, storage, aggregation, analysis, display |
| Duration | Term of the subscription + agreed retention window |
3 Our obligations as Processor
- Process personal data only on your documented instructions.
- Ensure personnel with access are bound by confidentiality.
- Implement the technical and organisational security measures in Section 5.
- Assist you in responding to Data Principal rights requests and regulator enquiries.
- Notify you without undue delay on becoming aware of a personal-data breach.
- Delete or return personal data at the end of the engagement, at your choice.
4 Sub-processors
You authorise the sub-processors listed in the Privacy Policy. We'll give at least 30 days' notice before adding or replacing a sub-processor, during which you may object on reasonable data-protection grounds.
5 Security measures
| Control | Measure |
|---|---|
| Encryption | TLS 1.2+ in transit; AES-256 at rest; optional BYOK (any paid plan) |
| Access | Role-based, least-privilege, MFA for internal admin access |
| Residency | AWS ap-south-1 (Mumbai, India) |
| Resilience | Encrypted daily backups; documented recovery objectives |
| Monitoring | Audit logging, anomaly detection, 180-day log retention |
6 Data residency & transfers
Primary processing and storage occur in India. The only cross-border flow is de-identified, aggregated data sent to Anthropic (Claude) for AI summaries, under contractual restrictions that prohibit model training on your data.
7 Breach notification
On a reportable breach we will notify affected Customers within 72 hours of becoming aware of it, provide the information you need to meet your own obligations to the Data Protection Board of India and affected individuals, and document remedial steps.
8 Deletion & return
On termination, we make your data available for export for 30 days, then delete it from live systems within 30 days and from backups within the backup rotation cycle, unless retention is required by law (e.g. billing records).