Data Processing Addendum (DPA)

HM-LEGAL-003·Privacy

Data Processing Addendum (DPA) — HeadshotMarketing

Document ID: HM-LEGAL-003 Title: Data Processing Addendum (DPA) Version: 1.0-draft Last updated: 2026-06-14 Publisher: Headshot Marketing Private Limited (Burdenoff Group) Canonical location: https://burdenoff.com/contracts/headshotmarketing/HM-LEGAL-003 Burdenoff Group Contract Registry — root at https://burdenoff.com/contracts (one subgroup per product). The contracts referenced in this document belong to the HeadshotMarketing subgroup at https://burdenoff.com/contracts/headshotmarketing/. Every referenced contract is identified by its Document ID (HM-LEGAL-### / HM-PRICING-###) and incorporated by reference.

Status: TEMPLATE / DRAFT — legal review pending. Parties: Headshot Marketing Private Limited (CIN [PENDING-LEGAL-CIN], GSTIN [PENDING-LEGAL-GSTIN], registered at "VISWAM", Plot No. 43, Veeramani Nagar, 2nd Cross Street, Nanmangalam, Chennai - 600117, India) ("HeadshotMarketing", "Processor") and the Customer identified in the applicable Order Form ("Customer", "Controller" / "Data Fiduciary"). Where international invoicing applies, Algoshred Technologies Corp (Delaware, USA; EIN 35-2845680) ("Algoshred US") is bound by this DPA on equivalent terms in respect of any Personal Data it processes incidental to payment processing. Effective Date: the later of (a) the Effective Date of the Order Form and (b) the date this DPA is executed. Relationship to MSA: This DPA forms part of, and is subject to, the Master SaaS Agreement (the "MSA"). In case of conflict on Personal Data matters, this DPA prevails. Data Protection Officer / Grievance Officer (DPDP Act): Vignesh T.V. (legal name: Tinnaneri Venkatanarayanan Vignesh), Founder, CEO & CTO of HeadshotMarketing — contactable at contact@headshotmarketing.com.

Why this DPA matters for HeadshotMarketing. HeadshotMarketing is a marketing platform: Customer's use of it inherently involves processing the Personal Data of contacts, leads, customers and influencers at scale — including contact and CRM records, engagement data, ad and social data, and (where Customer connects it) delivery results. This DPA therefore applies to essentially all Customer use and is treated as executed wherever a Customer processes such data.

1. Scope and roles

1.1 This DPA applies whenever HeadshotMarketing processes Personal Data on behalf of the Customer in connection with the Service.

1.2 For the purposes of:

  • the Digital Personal Data Protection Act, 2023 ("DPDP Act") — Customer is the Data Fiduciary and HeadshotMarketing is the Data Processor.
  • the Information Technology Act, 2000 and the Reasonable Security Practices and Procedures and Sensitive Personal Data or Information Rules, 2011 ("SPDI Rules") — Customer is the "body corporate" responsible for collection and HeadshotMarketing provides services.
  • the EU/UK GDPR, where Customer data subjects are located in the EEA/UK — Customer is the Controller and HeadshotMarketing is the Processor.
  • the California Consumer Privacy Act / CPRA, where applicable — Customer is the Business and HeadshotMarketing is a Service Provider.
  • other applicable laws (PDPA Singapore, PIPL China subject to separate review, LGPD Brazil) — equivalent role-mapping applies.

1.3 HeadshotMarketing will process Personal Data only on documented instructions from Customer, which are: (a) the MSA and this DPA; (b) the Customer's configuration of the Service; (c) Order Form; and (d) any other instructions provided in writing and agreed by HeadshotMarketing. HeadshotMarketing will inform Customer if it considers an instruction infringes applicable data protection law.

1.4 Operational processing. Personal Data is managed and processed by HeadshotMarketing (as the contracting Processor) using personnel of Burdenoff Consultancy Services Private Limited ("Burdenoff Consultancy"), which acts as the Burdenoff Group's manpower house and employs the engineering, support, security, and operations personnel who deliver the Service on HeadshotMarketing's behalf. Burdenoff Consultancy personnel act under HeadshotMarketing's instructions and intra-group confidentiality, access-control, and data-protection arrangements, and are treated as HeadshotMarketing's personnel for the purposes of this DPA. HeadshotMarketing remains the Customer's contractual Processor and is fully responsible for their acts and omissions in connection with Personal Data. Storage of Personal Data, the underlying compute that processes it, and incident-relevant logging are performed on managed cloud services (Microsoft Azure as the primary backend, AWS for frontend and selected backend services) acting as Subprocessors and listed in Annex 3.

1.5 Shared platform quotas. Customer acknowledges that HeadshotMarketing operates a shared technical platform across the Burdenoff Group's products and that certain platform quotas and resources (storage, compute, infrastructure, observability) are shared. Tenant isolation, access controls, and security commitments in this DPA and the Security Exhibit apply regardless of resource sharing, and HeadshotMarketing shall not allow Customer Personal Data to be accessed by an unauthorised party or another tenant. Heightened access controls apply to contact, CRM and engagement data.

1.6 Controller responsibilities for marketing data. Customer, as Controller / Data Fiduciary, is responsible for the lawful basis, notices and consents for processing contact, lead and contact Personal Data; for correct provider classification; and for any deployer obligations relating to automated marketing-decision tools (e.g., AI-content disclosure and contact notice under the EU AI Act, the EU AI Act for high-risk marketing AI, or applicable state laws). HeadshotMarketing is the processor and provides reasonable assistance as set out in §4.

2. Definitions

Capitalised terms not defined here have the meaning in the MSA, the DPDP Act, the SPDI Rules, or the GDPR (as the case requires).

  • "Personal Data" — any data relating to an identified or identifiable natural person, including "personal data" under the DPDP Act and "sensitive personal data or information" under the SPDI Rules.
  • "Processing" — has the meaning in the DPDP Act / GDPR.
  • "Subprocessor" — any third party (including HeadshotMarketing Affiliates) engaged by HeadshotMarketing to process Personal Data.
  • "Personal Data Breach" — a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
  • "Restricted Transfer" — a transfer of Personal Data to a country that, in the absence of safeguards, would breach applicable data protection law.

3. Processing details

The subject-matter, nature, purpose, duration, types of Personal Data and categories of data subjects are set out in Annex 1 (Processing Details).

4. HeadshotMarketing obligations

HeadshotMarketing shall:

4.1 Process Personal Data only on Customer's documented instructions and for the purposes set out in Annex 1.

4.2 Ensure that personnel authorised to process Personal Data are bound by appropriate confidentiality obligations.

4.3 Implement and maintain the technical and organisational security measures set out in Annex 2 (Technical and Organisational Measures), taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing and the risks to data subjects — with heightened controls for sensitive marketing data (contact records, CRM data, engagement data).

4.4 Assist Customer, taking into account the nature of processing, in fulfilling Customer's obligations to respond to data principal / data subject requests under DPDP, GDPR or other applicable law (Sections 11–14 DPDP; Articles 12–22 GDPR), to the extent practicable through Service features or reasonable assistance. Where a request comes from a contact, lead, customer or influencer, HeadshotMarketing will route it to Customer as the Controller.

4.5 Assist Customer with data protection impact assessments (marketing processing is DPIA-prone), prior consultations with regulators (e.g., the Data Protection Board of India), and security and breach notification obligations.

4.6 Make available to Customer the information reasonably necessary to demonstrate compliance with this DPA, including certifications and audit summaries (see Section 8).

4.7 At Customer's choice, delete or return all Personal Data after the end of the Subscription Term in accordance with MSA §5.5, unless retention is required by law or instructed by Customer (e.g., statutory marketing-consent / tax retention), in which case HeadshotMarketing will isolate and protect such Personal Data.

4.8 Notify Customer without undue delay, and in any event within 72 hours of becoming aware, of any Personal Data Breach affecting Customer's Personal Data. Notification will include the information specified by Section 8.6 of the DPDP Act / Article 33(3) GDPR to the extent then known, and updates as further information becomes available.

4.9 Maintain records of processing activities under Article 30(2) GDPR / equivalent under DPDP.

4.10 Not use Customer Personal Data to train, fine-tune or evaluate any machine-content or large-language model, and not build behavioural profiles of individual contacts from Customer Data.

5. Customer obligations

Customer shall:

5.1 Be solely responsible for the accuracy, quality, legality and means of collection of Personal Data, and for ensuring it has all rights, consents and notices required (including under DPDP Act Sections 5–7, GDPR Articles 6–9, the SPDI Rules, and applicable marketing-data law) to provide Personal Data to HeadshotMarketing for processing — in particular for contact, lead, contact and engagement data.

5.2 Configure the Service appropriately (RBAC, SSO, audit log retention, access reviews) and not introduce categories of Personal Data outside the scope of Annex 1 — including special-category data — without first updating Annex 1 by written notice and obtaining any Order-Form authorisation.

5.3 Provide notices to data principals (contacts, leads, customers, influencers) about HeadshotMarketing acting as Processor and any cross-border transfers, and deploy any lead fair-processing notice that applicable law requires.

5.4 Not instruct HeadshotMarketing to process Personal Data in violation of applicable law, including using AI-assisted features for automated marketing decisions without the human review, consents and notices the law requires.

5.5 Discharge any deployer obligations for automated marketing-decision tools (AI-content disclosure, contact notice, AI transparency) under applicable law.

6. Subprocessors

6.1 Customer provides general authorisation for HeadshotMarketing to engage Subprocessors. The current list is in Annex 3 (Subprocessors).

6.2 HeadshotMarketing shall (a) impose on each Subprocessor data protection obligations no less protective than this DPA, and (b) remain liable for the Subprocessor's acts and omissions in connection with Personal Data.

6.3 HeadshotMarketing will notify Customer of intended additions or replacements of Subprocessors at least 30 days in advance (by updating the public Subprocessor list and email to the Customer's privacy contact, where provided). Customer may object on reasonable data-protection grounds within 14 days; the parties will discuss a workaround, failing which Customer may terminate the affected Service by written notice and receive a pro-rata refund of prepaid, unused Fees.

6.4 Ad / social / email / SMS delivery providers are engaged as Subprocessors only when Customer connects the relevant integration; they are added to Annex 3 at enablement and process only the data needed to deliver the campaigns and messages Customer commissions.

7. International transfers

7.1 Where HeadshotMarketing or its Subprocessors transfer Personal Data across borders, HeadshotMarketing shall ensure an appropriate transfer mechanism applies, including:

  • the EU Standard Contractual Clauses (Module 2: Controller-to-Processor) for transfers from the EEA, and the UK International Data Transfer Addendum, incorporated into this DPA by reference and deemed completed with the parties as data exporter (Customer) and data importer (HeadshotMarketing), Clause 7 docking optional, Clause 9 Option 2 (general authorisation, 30 days), Clause 11 redress not enabled, Clause 17 Option 1 (law of an EU Member State to be specified by Customer; default: Ireland), Clause 18 forum: courts of that EU Member State;
  • the Indian DPDP Act cross-border rules including transfers to countries not restricted under Section 16 of the DPDP Act;
  • for sensitive personal data under the SPDI Rules, transfers only to entities ensuring the "same level of data protection" as the SPDI Rules require, and only with prior consent or where necessary for performance of a lawful contract.

7.2 Where neither party qualifies for SCCs (e.g., transfer originates in India and lands in India), no SCCs are required, and Sections 4–8 of this DPA govern the transfer.

7.3 Marketing-data localisation. Where Customer requires contact or other marketing data to remain in a specific country, that localisation is configured on the Order Form and HeadshotMarketing will store the relevant Personal Data in the agreed region.

8. Audits

8.1 HeadshotMarketing makes available to Customer (a) the most recent third-party audit report or certification (e.g., ISO 27001, SOC 2 Type II — where obtained), (b) the Security Exhibit, (c) Annex 2 of this DPA, and (d) responses to a standard security questionnaire (SIG / CAIQ).

8.2 If, after reviewing the materials in 8.1, Customer reasonably requires further audit, Customer may request, no more than once per 12-month period (except in case of a Personal Data Breach or where required by a competent authority), an audit by a mutually agreed independent third-party auditor under reasonable confidentiality terms, at Customer's cost, during business hours, with at least 30 days' written notice, and limited to controls relevant to the Service. HeadshotMarketing may redact information confidential to other customers, security-sensitive details, and trade secrets.

9. DPDP Act–specific provisions

9.1 HeadshotMarketing acknowledges its obligations as a Data Processor under Section 8(2) of the DPDP Act, including processing only as authorised, ensuring confidentiality, security safeguards under Section 8(5), assistance with data principal requests under Sections 11–14, and breach notification.

9.2 Customer remains accountable as the Data Fiduciary, including for grievance redressal (Section 8(10)) and, if applicable, Significant Data Fiduciary obligations (Section 10) — which large brands managing substantial volumes of contact Personal Data may attract.

9.3 HeadshotMarketing's role does not extend to direct interaction with data principals except as Customer instructs through the Service.

9.4 Notice of any contact from the Data Protection Board of India or other regulator about Customer's Personal Data will be provided to Customer without undue delay, unless prohibited by law.

10. Liability

The liability provisions of the MSA (including caps and exclusions) apply to claims under or relating to this DPA, except where applicable law (including the DPDP Act and GDPR Article 82) imposes mandatory direct liability to data subjects/principals, in which case those provisions apply.

11. Term, conflict, severability

11.1 This DPA remains in force for the duration of the MSA and for so long as HeadshotMarketing processes Personal Data.

11.2 If any provision is invalid under any applicable law, it is severed and the remainder remains effective.

11.3 In case of conflict between this DPA and the SCCs/UK Addendum on cross-border transfers of EEA/UK data, the SCCs/UK Addendum prevail.

Annexes

  • Annex 1 — Processing Details (HM-LEGAL-003A)
  • Annex 2 — Technical and Organisational Measures (HM-LEGAL-003B)
  • Annex 3 — Subprocessors (HM-LEGAL-003C)

Reference and incorporation

All Burdenoff Group contracts, addenda, exhibits, policies and registers referenced in this document are identified by their Document ID (HM-LEGAL-### or HM-PRICING-###) and are published at https://burdenoff.com/contracts. Each such referenced document is incorporated into this document by reference. The version of a referenced document that applies is the version published at https://burdenoff.com/contracts as at the Effective Date of the applicable Order Form (or, where no Order Form exists, the version current at the date of acceptance), unless an executed Order Form specifies a frozen version.

Back to HeadshotMarketing Contracts