Data Processing Agreement

1. Definitions

“Applicable Data Protection Laws” means the laws that apply to the processing, including India’s Digital Personal Data Protection Act, 2023 (when in force for the processing), the EU GDPR, the UK GDPR, and similar laws. “Personal Data”, “Processing”, “Controller”, “Processor”, “Data Subject”, “Personal Data Breach”, and “Sub-processor” have the meanings in those laws. “Customer Data” means Personal Data the Controller submits to the Service for issuance, management, delivery, or verification of credentials.

2. Roles

For Customer Data, the customer organisation is the Controller and HelpingGeeks is the Processor. Recipients and team members should usually contact the issuing organisation first about that data.

We also process some data as an independent controller, including account and billing records, security logs, abuse prevention, and our own service analytics, as described in the Privacy Policy. That processing is outside this DPA.

3. Subject matter and duration

We process Customer Data to provide Creadefy: designing templates, issuing PNG certificates and badges, storing assets, sending issuance and account emails, hosting public verification pages, and supporting the account.

Processing starts when the Controller uses the Service and continues for the term of the Agreement, plus any retention required by law or the Agreement. After that, data is deleted or returned as set out below.

4. Data subjects and data types

Data subjects may include credential recipients, organisation users (admins, issuers, members), and other people the Controller puts on a credential.

• Identity and contact: name, email, organisation, role or job title if the Controller includes them.
• Credential records: event or course name, issue and expiry dates, unique credential IDs, PNG files, QR/verification URLs, and verification logs.
• Account and technical data needed to run the workspace: user IDs, roles, uploads, IP address, device/browser data, and security logs.

The Controller must not upload special-category data (for example health data) or children’s data unless the Controller has a lawful basis and we have agreed in writing. Creadefy is not designed for those categories.

5. Processor obligations

• Process Customer Data only on the Controller’s documented instructions, including this DPA and product configuration, unless law requires otherwise.
• Keep people who handle Customer Data under confidentiality duties.
• Apply the security measures in Annex 1.
• Help the Controller respond to data-subject requests and meet security, DPIA, and breach duties, taking into account the nature of the Service.
• Delete or return Customer Data when the Agreement ends, unless law requires retention.

6. Controller obligations

• Have a valid legal basis to collect and instruct us to process Customer Data, including notices to recipients.
• Not instruct us to process data in a way that would break Applicable Data Protection Laws.
• Remain responsible for the accuracy of data entered into Creadefy and for what appears on issued credentials and public verification pages.

7. Sub-processors

The Controller authorises us to use Sub-processors, provided each is bound to protections no less protective than this DPA and we remain responsible for their performance. The current list is at creadefy.com/subprocessors.

We will give at least 30 days’ notice of a new Sub-processor by updating that page and, where practical, email or in-product notice. The Controller may object in writing on reasonable data-protection grounds within 14 days. If we cannot resolve the objection, the Controller may terminate the affected Services under the Agreement.

8. International transfers

HelpingGeeks is established in India. Some Sub-processors process data in other countries, including the United States (for example Vercel, Google, GitHub, SendGrid, Intercom, and Sentry). Where GDPR or UK GDPR requires a transfer tool, we rely on the European Commission’s Standard Contractual Clauses and/or the UK International Data Transfer Addendum, plus vendor terms.

9. Personal data breaches

If a Personal Data Breach affects Customer Data, we will notify the Controller without undue delay and, where feasible, within 72 hours of becoming aware, with the facts reasonably available to us (nature, approximate scale, likely consequences, and mitigation). We will cooperate so the Controller can meet its own notification duties.

10. Data subject rights

We will assist the Controller, so far as the product allows, with access, correction, deletion, restriction, portability, and objection requests. If a data subject contacts us about Customer Data, we will direct them to the Controller and forward the request where law allows.

11. Information and audits

We will provide information reasonably needed to show compliance with this DPA. If that is not enough, the Controller may audit once per 12 months, on at least 30 days’ notice, at its own cost, during business hours, without disrupting operations, and under confidentiality. More frequent audits are allowed after a Personal Data Breach or if a supervisory authority requires them. We do not currently publish SOC 2 or similar attestations.

12. Deletion and return

When the Agreement ends, or on written request, we will delete Customer Data or, if technically feasible, return it in a commonly used electronic format, unless law requires us to keep some records (for example tax). Backup copies are protected until they rotate out. Anonymised or aggregated data that cannot identify a person may be retained.

13. Miscellaneous

Liability caps in the Agreement apply to this DPA to the extent law allows. Invalid clauses are severed. This DPA follows the governing law and courts in the Agreement, except where Applicable Data Protection Laws require otherwise.

14. Contact

For DPA or privacy questions, contact:

Annex 1 — Technical and organisational measures

The following measures illustrate the safeguards we apply to Customer Data. We may refine them over time, provided the overall level of protection is not materially reduced.

• Encryption in transit using TLS. Object storage and the database use provider encryption at rest.
• Issued credentials are PNG files with unique identifiers and public verification URLs. Authenticity is checked against Creadefy records.
• Role-based access in the product. Staff access follows least privilege. Sign-in uses Google, GitHub, or email credentials.
• Production hosting, with application monitoring and error tracking as described on the Subprocessor List.
• Audit-relevant logs for account, issuance, and verification activity, retained only as needed for security and operations.
• Code review, version control, and separated development versus production environments.
• Confidentiality obligations for people with access to Customer Data, and an incident-response process including notice under this DPA.
• Backups and restore procedures provided by our infrastructure vendors, used to keep the Service available.