Parties and Scope

Controller (Client): The entity that engages RedGobble for services and determines the purposes and means of processing personal data.

Processor (RedGobble): RedGobble (operated by Ritesh Pandey, India) processes personal data on behalf of the Controller in connection with the services provided under the master services agreement, statement of work, or other written agreement between the parties.

This Data Processing Agreement (DPA) forms an integral part of the agreement between RedGobble and the Client. Capitalized terms used but not defined herein shall have the meanings given to them in the applicable data protection laws or the principal agreement.

Scope of Agreement

This DPA applies to all personal data processed by RedGobble on behalf of the Client in connection with the provision of services, including but not limited to software development, AI solutions, design, consulting, support, and maintenance.

Duration: This DPA remains in effect for the duration of the principal agreement plus the period until all personal data has been deleted or returned in accordance with this DPA.
Applicable Law: This DPA is governed by the Indian Information Technology Act, 2000, the European Union General Data Protection Regulation (GDPR) where applicable, and other relevant data protection laws.
Hierarchy: In the event of any conflict between this DPA and the principal agreement, this DPA shall prevail with respect to data processing matters.

Controller and Processor Roles

The parties acknowledge and agree as follows:

Controller: The Client is the Data Controller. The Client determines the purposes and means of processing, including what data is collected, which categories of data subjects are involved, and the retention period.
Processor: RedGobble is the Data Processor. RedGobble processes personal data only on documented instructions from the Client, unless required to do so by applicable law.
Compliance: Both parties shall comply with their respective obligations under applicable data protection laws. The Client is responsible for ensuring that its instructions to RedGobble comply with applicable law.
Controller Authorization: The Client warrants that it has all necessary consents and legal bases to provide personal data to RedGobble for processing as described in this DPA.

Categories of Data

RedGobble may process the following categories of personal data on behalf of the Client:

Identity Data: First name, last name, job title, company name, professional credentials, and profile information.
Contact Data: Business email address, phone number, billing address, and business address.
Technical Data: IP addresses, browser type and version, time zone setting, browser plug-in types, operating system, platform, and device identifiers.
Usage Data: Information about how services are used, feature interactions, page views, session duration, and referral sources.
Project Data: Project requirements, specifications, communications, feedback, and deliverables related to services provided.
Communication Data: Emails, messages, meeting recordings (with consent), and support correspondence.
Financial Data: Billing information and payment history (processed via Stripe; RedGobble does not store full payment card details).

Special categories of data (sensitive data) are not processed unless explicitly agreed in writing between the parties and with appropriate safeguards in place.

Processing Activities

RedGobble processes personal data for the following purposes:

Service Delivery: Development, testing, deployment, and maintenance of software, AI models, websites, and applications.
Support and Maintenance: Troubleshooting, bug fixes, updates, and technical support.
Communication: Project updates, invoicing, proposals, and client correspondence.
Analytics and Improvement: Analyzing usage patterns to improve services, performance optimization, and user experience enhancement.
Security and Fraud Prevention: Monitoring for unauthorized access, security threats, and fraudulent activity.
Compliance: Maintaining records, responding to legal requests, and complying with regulatory obligations.

Security Measures

RedGobble implements and maintains appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

Encryption at Rest: All data stored on servers is encrypted using AES-256 encryption.
Encryption in Transit: All data transmitted between systems is encrypted using TLS 1.3 protocol.
Access Controls: Role-based access control (RBAC) with the principle of least privilege. Multi-factor authentication (MFA) required for all internal systems. Quarterly access reviews.
Physical Security: Data hosted on Vercel Edge Network and Google Cloud Platform infrastructure with 24/7 physical security, biometric access controls, and surveillance.
Personnel Security: All personnel undergo background verification, sign confidentiality agreements, and complete annual security awareness training.
Audit and Monitoring: 24/7 system monitoring with real-time alerting. Weekly vulnerability scanning. Quarterly penetration testing. Annual independent security audit.
Incident Response: Documented incident response plan with defined roles, communication protocols, and post-incident review procedures.
Business Continuity: Regular automated backups with 30-day retention. Cross-region replication for critical systems. Disaster recovery plan tested annually.

Subprocessors

The Client authorizes RedGobble to engage the following subprocessors for the provision of services:

Vercel Inc. — Website hosting and deployment infrastructure (United States).
Google Cloud LLC — Cloud infrastructure, storage, and AI/ML services (United States).
Stripe Inc. — Payment processing (United States).
Twilio Inc. (SendGrid) — Email delivery services (United States).
GitHub Inc. — Source code hosting and version control (United States).
Calendly LLC — Meeting scheduling (United States).

Subprocessor Addition or Replacement: RedGobble shall notify the Client at least 14 days before engaging any new subprocessor or replacing an existing one. The Client may object to the engagement within 7 days of notification. If the objection cannot be resolved, the Client may terminate the affected services without penalty.

RedGobble ensures that all subprocessors are bound by data processing terms substantially similar to those in this DPA and have adequate security measures in place.

Data Subject Rights

RedGobble shall assist the Client in fulfilling its obligations to respond to data subject requests under applicable data protection laws.

Notification: If RedGobble receives a data subject request directly, it shall notify the Client within 2 business days.
Assistance: RedGobble shall provide reasonable assistance to the Client in responding to data subject access requests (DSARs), rectification requests, erasure requests, portability requests, and objections to processing.
Costs: RedGobble's assistance shall be provided free of charge for up to 5 requests per year. Additional requests may be subject to a reasonable fee based on the complexity and resources required.
Timeline: RedGobble shall respond to assistance requests within 5 business days and provide the requested data or complete the requested action within 15 business days, subject to the Client's instructions and applicable law.

Data Retention and Deletion

Data retention and deletion procedures:

During Engagement: Data is retained for the duration of the principal agreement and processed in accordance with the Client's instructions.
After Termination: Upon termination of the principal agreement, RedGobble shall, at the Client's option, return or delete all personal data within 90 days, unless applicable law requires continued storage.
Backup Deletion: Personal data contained in backups shall be deleted within 180 days of the termination date, or in accordance with the backup rotation schedule, whichever is sooner.
Legal Holds: Where RedGobble is required by applicable law to retain personal data beyond the agreed period, it shall notify the Client and retain only the data required to comply with the legal obligation.
Certification: Upon completion of deletion, RedGobble shall provide written certification that the deletion has been completed in accordance with this DPA.

Breach Notification

In the event of a personal data breach, RedGobble shall:

Notification: Notify the Client without undue delay and in any event within 72 hours of becoming aware of the breach.
Content of Notification: Provide at a minimum: (a) a description of the nature of the breach, (b) the categories and approximate number of affected data subjects and records, (c) the likely consequences, (d) measures taken or proposed to address the breach and mitigate its effects, and (e) contact details for the data protection officer or responsible contact.
Cooperation: Fully cooperate with the Client in investigating the breach and complying with any notification obligations to supervisory authorities and affected data subjects.
Documentation: Document all breaches, including facts, effects, and remedial actions taken, and provide such documentation to the Client upon request.

Governing Law

This DPA shall be governed by and construed in accordance with the laws of India, without regard to its conflict of laws principles. Any disputes arising from this DPA shall be resolved in accordance with the dispute resolution provisions of the principal agreement.

For Clients established in the European Economic Area (EEA), the United Kingdom, or Switzerland, the parties agree that the Standard Contractual Clauses (SCCs) approved by the European Commission shall apply to transfers of personal data from the EEA, UK, or Switzerland to India, and form an integral part of this DPA.

Contact Information

For data protection inquiries, breach notifications, or data subject requests:

DPA Inquiries: redgobble.contact@gmail.com
Breach Notification: redgobble.contact@gmail.com (Subject: “URGENT — Data Breach”)
Phone: +91 9120025053