Data Processing Agreement

1. Purpose

This page summarizes the Data Processing Agreement (“DPA”) that governs Magdox Private Limited’s processing of personal data on behalf of customers as part of the FDIE Service, consistent with processor obligations under India’s Digital Personal Data Protection Act, 2023 (DPDPA), the GDPR, and equivalent provisions of applicable data protection laws. A fully executable DPA is available to any paid-tier customer processing personal data subject to the DPDPA or a similar regime.

2. Roles

For personal data processed through the Service:

• Customer acts as the Data Controller (or Data Fiduciary under DPDPA)
• Magdox acts as the Data Processor (or Data Processor under DPDPA), processing personal data only on the Customer’s documented instructions

3. Subject Matter, Duration, Nature and Purpose of Processing

Magdox processes personal data solely for the purpose of providing the FDIE SaaS platform: firmware security analysis, compliance reporting, account management, and related technical support. Processing continues for the duration of the underlying subscription agreement.

4. Categories of Data Subjects and Personal Data

• Data subjects: the Customer’s authorized users (employees and contractors), and to the extent present in uploaded firmware metadata, individuals referenced therein (for example, developer names or email addresses embedded in build artifacts)
• Categories of personal data: names, work email addresses, roles and permissions, authentication logs, and any personal data incidentally contained within uploaded firmware images or configuration files

5. Sub-processor Authorization and Change Notice

Magdox is authorized to engage the following sub-processors to process personal data under this DPA, each bound by data protection obligations no less protective than those in the DPA:

Infrastructure

Application & Billing Services

Monitoring

Before engaging a new sub-processor to process personal data under this DPA, Magdox will provide at least 14 days’ advance notice by posting an update to this list and, for customers with a signed DPA on file, by direct email. Customer may object on reasonable data protection grounds within that notice period by contacting [email protected]; Magdox will work with Customer in good faith to address the objection, which may include providing a commercially reasonable alternative.

6. Data Subject Rights & DPIA Assistance

Magdox will provide reasonable assistance to the Customer in responding to data principal requests (access, correction, erasure, and others) relating to personal data processed under the DPA. See our DPDPA rights page for the general process.

Taking into account the nature of processing and information available to Magdox, Magdox will also provide reasonable assistance to Customer in conducting Data Protection Impact Assessments (DPIAs) and prior consultations with supervisory authorities where required by applicable data protection law.

7. Security Measures

Magdox implements the technical and organizational security measures described in Privacy Policy Section 11 and in our Information Security Addendum, including encryption in transit and at rest, access controls, and audit logging.

8. Breach Notification

In the event of a personal data breach affecting Customer Data, Magdox will notify the affected Customer without undue delay, and in any case within 72 hours of becoming aware of the breach, providing available details to support the Customer’s own notification obligations. This commitment applies to all paid-tier SaaS accounts.

9. International Transfers

Where personal data is transferred across borders, Magdox complies with applicable cross-border data transfer requirements under the DPDPA, the GDPR, and other applicable law. Where required, Magdox puts appropriate contractual safeguards in place, including Standard Contractual Clauses for transfers of personal data out of the European Economic Area, the United Kingdom, or Switzerland.

10. Audit Rights

Customers with a signed DPA may request reasonable audits of Magdox’s compliance with the DPA, subject to confidentiality obligations and reasonable notice. Audits may be satisfied, at Magdox’s option, by providing a recent third-party audit report or security questionnaire response covering the relevant period.

11. Request a Signed DPA

Any paid-tier customer can request a fully executed DPA from our team.

Request a signed DPA

12. Full Agreement

A full executable DPA is available upon request.

13. Data Deletion on Termination

Upon termination of the subscription and written request from the Customer, Magdox will delete or return all personal data processed under this DPA within 30 business days, unless required by applicable law to retain it. Magdox may retain personal data to the extent necessary to comply with legal or regulatory obligations, establish or defend legal claims, or prevent fraud. Any retained data will be processed only for the purpose for which retention is required and deleted as soon as that ground ceases to apply. A written certificate of deletion is available on request.

14. Governing Law

This DPA is governed by and construed in accordance with the laws of India, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023. Any disputes arising under this DPA will be resolved in the competent courts of West Bengal, India.