Data Processing Agreement

This page sets out the Data Processing Agreement in plain language. To sign it with your entity name and effective date, contact sales at sales@cloudyfy.tv or use the contact form at /contact/.

1. Definitions

"Controller" means the customer entity that determines the purpose of processing personal data. "Processor" means Silicon IT Hub Pvt. Ltd., B1-Ground Floor, Safal Profitaire, Corporate Rd, Prahlad Nagar, Ahmedabad, Gujarat 380015, IndiaSilicon IT Hub Pvt. Ltd., B1-Ground Floor, Safal Profitaire, Corporate Rd, Prahlad Nagar, Ahmedabad, Gujarat 380015, India, operating as CloudyFy TV, being the CloudyFy TV entity that contracts with the Controller. "Personal Data," "Processing," "Data Subject" and "Sub-processor" carry the meanings given in applicable data protection law. "Applicable Data Protection Law" means the data protection laws that apply to the processing, including India's Digital Personal Data Protection Act, 2023, and, where they apply to the Customer, other applicable data protection laws in the Customer's jurisdiction.

2. Scope and roles

This Agreement applies where CloudyFy TV processes personal data on the Customer's behalf as part of the Service described in the Terms and Conditions. The Customer acts as Controller for personal data it uploads or configures within its account, such as content, employee names in user accounts, or data channel values. CloudyFy TV acts as Processor for that data.

3. Processing instructions

CloudyFy TV processes personal data only on the Customer's documented instructions, as given through the Service's configuration and this Agreement, except where required to do so by law, in which case CloudyFy TV will inform the Customer of that legal requirement before processing, unless the law prohibits such notice.

4. Confidentiality

CloudyFy TV personnel authorised to process personal data are bound by confidentiality obligations, whether through employment terms or a separate confidentiality agreement, and access is limited to what each person's role requires.

5. Security measures

CloudyFy TV maintains the technical and organisational measures described on the security page at /security/: PostgreSQL row-level security for tenant isolation, AES-256-GCM encryption of third-party integration credentials, TOTP multi-factor authentication, OIDC and Google single sign-on, IP allowlisting, role-based access control, and a full audit log. This clause references that page rather than restating it, so the two never drift out of sync.

6. Sub-processors

CloudyFy TV uses sub-processors to deliver the Service, for hosting infrastructure, email delivery, payment processing, website analytics and the AI features. The Customer gives CloudyFy TV general authorisation to engage sub-processors on the terms of this clause.

Each sub-processor is engaged under a written contract that places data protection obligations on it no less protective than those in this Agreement, and CloudyFy TV remains responsible to the Customer for what its sub-processors do.

The current sub-processor list is published below, naming each sub-processor, what it processes and where it holds data. It is updated before a new sub-processor starts work.

Before adding or replacing a sub-processor, CloudyFy TV gives the Customer notice at least 30 days before the change takes effect. The Customer may object on reasonable data protection grounds within that period, and if the objection cannot be resolved the Customer may terminate the affected part of the subscription without penalty.

7. International data transfers

Each customer's data is hosted on Amazon Web Services in the region agreed with that customer, with every customer kept separate. The default region is AWS Asia Pacific (Mumbai), in India. Media is delivered to screens through Amazon CloudFront, which caches it at locations worldwide. The forms on this website are processed in AWS US East (N. Virginia), in the United States.

Customers who need their data kept in a particular region, for example the United States or the United Arab Emirates, have it hosted in that region, and a company can also keep its media in its own storage in a region it chooses.

Where personal data is transferred out of the European Economic Area or the United Kingdom as part of the Service, CloudyFy TV relies on the European Commission Standard Contractual Clauses adopted in 2021, and on the UK International Data Transfer Addendum for a transfer subject to UK law. Those clauses form part of the signed Agreement, and CloudyFy TV applies the additional safeguards they require.

For a cross-border transfer that is not covered by those clauses, CloudyFy TV applies the transfer mechanism required by the Customer's applicable law.

Where each sub-processor holds data is stated in the sub-processor list above.

8. Assistance with data subject rights

CloudyFy TV will provide reasonable assistance to the Customer in responding to a data subject's request to access, correct, delete or export their personal data, to the extent the Customer cannot fulfil that request using the Service's own account controls.

9. Assistance with security obligations

CloudyFy TV assists the Customer with the Customer's own obligations for the security of processing, for notifying a personal data breach to a supervisory authority and to the people affected, and for carrying out a data protection impact assessment and any prior consultation that follows from it.

That assistance takes into account the nature of the processing CloudyFy TV carries out and the information available to it as Processor. In practice it means the security detail on the security page at /security/, the breach information described in the clause below, and answers to the Customer's questions about how the Service processes its data, provided on request within a reasonable period.

10. Personal data breach notification

CloudyFy TV will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data, with information reasonably available at the time, and will cooperate on any required regulatory or customer notification.

11. Data return and deletion on termination

On termination of the underlying subscription, CloudyFy TV keeps the Service running to the end of the paid period and a grace period, so the Customer can export its data, and then deletes Customer data from active systems and backups within the retention periods set out below, unless a longer retention is required by law.

12. Audit rights

The Customer may request evidence of CloudyFy TV's compliance with this Agreement, such as a description of the security measures or responses to a reasonable security questionnaire, and CloudyFy TV responds within a reasonable period. For most reviews this is the quickest route to an answer.

Where it is not enough, the Customer may audit CloudyFy TV's compliance with this Agreement, including by an inspection of the premises and systems used to process the Customer's data. An audit is carried out on at least 30 days of written notice, during business hours, at the Customer's own cost, by the Customer or by an independent auditor who is not a competitor of CloudyFy TV, and everyone taking part is bound by confidentiality.

An audit may be carried out once in any twelve-month period, and more often only after a personal data breach affecting the Customer's data or where a supervisory authority requires it. An audit must not disrupt the Service or reach the data of any other customer.

13. Liability

Liability under this Agreement follows the limitation of liability terms in the main Terms and Conditions at /terms-conditions/, except where applicable law does not permit such limitation for data protection obligations.

14. Term and termination

This Agreement remains in effect for as long as CloudyFy TV processes personal data on the Customer's behalf under the underlying subscription, and terminates automatically when that subscription ends, subject to the data return and deletion clause above.

15. Governing law

This Agreement is governed by the same law, and subject to the same courts, as the Terms and Conditions at /terms-conditions/: the laws of India, with the courts at Ahmedabad, Gujarat, India having exclusive jurisdiction. Applicable Data Protection Law continues to apply to the processing itself.

16. Execution

A signed version of this Agreement, naming the Customer entity and the effective date, is provided by the CloudyFy TV sales team on request and executed alongside or after the commercial agreement.