Data Processing Agreement

1. Scope

This DPA covers all the data we process for you when you use our hosting. It adds to the Terms of Service and the Privacy Policy. It is part of the deal between us.

2. Roles

We act as the Data Processor under DPDPA and under GDPR. You act as the Data Fiduciary under DPDPA and the Data Controller under GDPR. Your end users are the data subjects. The personal data is limited to email, domain, billing details, and the cookie flag.

3. Sub-processors

We work with these sub-processors:

• WhatsApp Business (Meta Platforms Ireland Ltd) for the support channel.

Our page-view analytics run on our own server (analytics.webgrow24.com). It sets no cookies and sends no personal data, so it is our own gear, not a sub-processor.

We tell you at least 30 days before we add a new sub-processor. You can object by ending the service that it affects. You pay nothing for that.

4. Breach notification

We tell you about any personal data breach within 72 hours of finding it. The note says which data and which people are affected. It also says what may happen, and what we did or plan to do about it.

5. Audit rights

You can audit us once a year, with at least 30 days notice. You pay for the audit. We answer audits with our control docs, such as our architecture, runbooks, and incident history. We do not have a SOC 2 Type II audit today. Our ISO 27001 plan is 2027. If your team needs a SOC 2 report, check it against your own rules before you sign.

6. Data location + transfers

Your data sits in our data center in Palitana, Gujarat, India. We do not copy your data outside India. If you are in the EU and ask for the EU Standard Contractual Clauses addendum, that addendum sets the rules for cross-border transfers.

7. Contact

Email hello@webhost24.in. We reply to DPA questions within five Indian business days.