DATA PROCESSING AGREEMENT (DPA)
DinaBina Technical Project Management ("Processor") and the Customer ("Controller")
Version 2.0 · Last reviewed 2026-06-01 · Governing law: India; GDPR Art. 28 terms apply to EU/UK customers

1. SUBJECT MATTER AND DURATION
The Processor provides the DinaBina CMMS software-as-a-service (the "Service"). Processing lasts for the term of the Customer's subscription plus the 30-day deletion period.

2. NATURE AND PURPOSE OF PROCESSING
Hosting, storage, transmission and display of facility, asset, maintenance, community and service-marketplace data entered by the Customer or its users, solely to provide the Service.

3. CATEGORIES OF DATA SUBJECTS AND DATA
Employees, contractors, residents, visitors and service partners of the Customer. Data: names, contact details, roles, login records, location coordinates during dispatch, photographs attached to work orders, identity documents of service partners (processed by IDfy), payment references.

4. PROCESSOR OBLIGATIONS
4.1 Process personal data only on documented Customer instructions.
4.2 Ensure persons authorised to process data are bound by confidentiality.
4.3 Implement the technical and organisational measures in Annex 2.
4.4 Engage sub-processors only under Clause 6.
4.5 Assist the Customer with data-subject requests within 30 days.
4.6 Delete or return all personal data within 30 days of contract end.
4.7 Make available all information necessary to demonstrate compliance and allow audits (once per year, 30 days' notice, under NDA).

5. SECURITY INCIDENTS
The Processor notifies the Customer without undue delay and in any case within 72 hours of becoming aware of a personal-data breach, with the information required by GDPR Art. 33(3) / DPDPA s.8(6).

6. SUB-PROCESSORS
The Customer authorises the sub-processors listed at https://mydbfm.com/trust#sub-processors. Changes are announced 30 days in advance; the Customer may object in writing within that period.

7. INTERNATIONAL TRANSFERS
Data is hosted in India. Transfers to sub-processors outside India/EU are protected by Standard Contractual Clauses or an equivalent lawful mechanism.

8. LIABILITY
Liability is governed by the Master Subscription Agreement.

ANNEX 1 — PROCESSING DETAILS: as per Clauses 2–3.
ANNEX 2 — TECHNICAL AND ORGANISATIONAL MEASURES
• TLS 1.2+ in transit, AES-256 at rest • bcrypt password hashing • Role-based access with MFA (TOTP/SMS) and IP allow-listing • Immutable audit logs • Daily backups (30-day retention), RPO ≤ 24 h, RTO ≤ 8 h • Logical multi-tenant isolation enforced in every query • Vulnerability disclosure: security@mydbfm.com • Quarterly restore drills • Background-verified staff with least-privilege access.

Signatures: executed electronically on acceptance of the Master Subscription Agreement or on request as a countersigned PDF (sales@mydbfm.com).