Data Processing Addendum

This Data Processing Addendum ("DPA") applies when you (the "Customer", acting as data controller) use Mudra, operated by ARTH ("Processor"), to process personal data of other people — for example, uploading a list of your team's or clients' details to generate signatures. It supplements our Terms.

1. Roles

The Customer is the controller and determines the purposes of processing. Mudra is the processor and acts only on the Customer's documented instructions (including the configuration and data you provide).

2. Subject matter & duration

We process the personal data you upload for as long as your account is active, and delete or return it after termination as described below.

3. Nature & purpose

Processing is limited to hosting and generating email signatures and related documents on your behalf, and providing the Service.

4. Types of data & data subjects

Typically: names, job titles, email addresses, phone numbers, photos and links of your employees or contacts. Do not upload special-category data (e.g., health, biometric) unless separately agreed.

5. Our obligations

• Process only on your instructions and for the purposes above.
• Ensure personnel are bound by confidentiality.
• Apply appropriate technical and organisational security (encryption in transit, access controls, row-level security).
• Assist you, so far as reasonable, with data-subject requests and security obligations.
• Notify you without undue delay of a personal-data breach affecting your data.

6. Sub-processors

We use vetted sub-processors to run the Service, currently: Supabase (database, authentication and hosting) and, in future, a payment processor. We remain responsible for their compliance and will give notice of material changes.

7. International transfers

Where data is processed outside your country, we rely on lawful transfer mechanisms as required by applicable law (e.g., GDPR standard contractual clauses; India DPDP requirements).

8. Deletion & return

On termination, you may export your data; after a reasonable period we delete it from active systems unless retention is legally required.

9. Contact

To request a signed copy of this DPA or raise a data-protection matter: avinash@nashenterprises.in.