DATA PROCESSING ADDENDUM (DPA)
This Data Processing Addendum (“DPA”) forms part of the agreement (“Agreement”) between:
(i) Quikchex Private Limited (“Quikchex”, “Processor”), and
(ii) The Customer identified in the applicable Order Form or Master Services Agreement (“Customer”, “Controller”).
This DPA governs Quikchex’s processing of Personal Data on behalf of the Customer while providing HRMS, payroll processing, compliance management, and related services (“Services”).
- Definitions
For purposes of this DPA:
“Personal Data” means any data relating to an identified or identifiable individual, including employee or contractor information processed through the Services.
“Processing” means any operation performed on Personal Data, including collection, storage, retrieval, transmission, or deletion.
“Controller” means the Customer, which determines the purpose and means of processing Personal Data.
“Processor” means Quikchex, which processes Personal Data on behalf of the Customer.
“Sub-Processor” means any third party engaged by Quikchex to process Personal Data.
“Applicable Law” includes the Digital Personal Data Protection Act, 2023; Information Technology Act, 2000; SPDI Rules, 2011; and any other applicable data protection regulations.
- Roles of the Parties
2.1. The Customer is the Controller of all Personal Data submitted to the Quikchex platform or otherwise shared with Quikchex for HR, payroll, or compliance processing.
2.2. Quikchex acts solely as a Processor and processes Personal Data strictly in accordance with the Customer’s documented instructions.
2.3. Nothing in this DPA shall be construed to make Quikchex the Controller of Personal Data.
- Scope and Purpose of Processing
Quikchex processes Personal Data only for the following purposes:
- HRMS and employee data management
• Payroll processing and payslip generation
• Statutory calculations and compliance preparation
• Attendance, leave, and shift management
• Generating statutory registers, challans, and filings (if included in the scope)
• Customer support, troubleshooting, and implementation
• Operating, enhancing, and securing the Services
• Backups and system continuity
Quikchex shall not process Personal Data beyond what is necessary to deliver the Services.
- Customer Responsibilities
The Customer is responsible for:
- Ensuring that all Personal Data is accurate, lawful, and collected with proper consent or authority.
• Providing clear processing instructions to Quikchex.
• Ensuring compliance with employment, tax, and data protection laws applicable to its employees and operations.
• Responding to individual rights requests from its employees.
Quikchex has no obligation to verify the legality or accuracy of Personal Data supplied by the Customer.
- Sub-Processors
5.1. Quikchex may engage Sub-Processors such as cloud hosting providers, email/SMS vendors, payroll payment partners, and analytics tools.
5.2. Quikchex will ensure all Sub-Processors are bound by confidentiality and data protection obligations no less protective than those in this DPA.
5.3. A current list of Sub-Processors may be provided upon request.
5.4. The Customer authorizes Quikchex to appoint Sub-Processors as needed to deliver Services.
- Security Measures
Quikchex shall implement reasonable and industry-standard security measures, including:
- Encryption of data in transit and at rest
• Access controls and authentication
• Role-based permission management
• Network and infrastructure firewalls
• Regular vulnerability assessments
• Logging and monitoring
• Employee confidentiality agreements and training
Quikchex is ISO 27001 certified and uses SOC 2 compliant data centers.
- Access and Confidentiality
7.1. Only authorized Quikchex personnel with a business need may access Personal Data.
7.2. Quikchex ensures that such personnel are bound by confidentiality obligations.
7.3. Quikchex prohibits the use of external devices within its systems unless expressly approved.
- Data Breach Notification
8.1. In the event of a confirmed Personal Data breach, Quikchex will notify the Customer without undue delay and share:
- The nature of the breach
• Categories of affected Personal Data
• Likely consequences
• Corrective actions taken
8.2. The Customer is responsible for notifying affected individuals or authorities unless otherwise required by law.
- Cross-Border Data Transfers
If Personal Data is transferred outside India (e.g., for cloud hosting), Quikchex will ensure:
- Reasonable safeguards
• Contractual protections with Sub-Processors
• Compliance with Applicable Laws
Such transfers will only be for legitimate business and service continuity reasons.
- Data Retention and Deletion
10.1. Quikchex retains Personal Data only for as long as necessary to provide the Services or comply with legal obligations.
10.2. After termination of Services:
- Customer may retrieve data within 30 days
• Quikchex may delete or archive data thereafter, unless retention is legally required
10.3. Backup copies may be retained for system continuity for limited periods but will not be used for any other purpose.
10.4. Aggregated or anonymized data may be retained indefinitely for analytics and product improvement.
- Assistance with Data Subject Requests
Where legally required, Quikchex shall assist the Customer in responding to:
- Access requests
• Correction or update requests
• Withdrawal of consent
• Data portability (if applicable)
• Deletion requests
Quikchex shall not respond directly to end users unless explicitly instructed by the Customer in writing.
- Audit Rights
12.1. The Customer may request information regarding Quikchex’s data security practices.
12.2. Formal audits may be conducted only:
- No more than once per year
• With at least 30 days’ prior written notice
• During business hours
• In a manner that does not disrupt operations
12.3. Customers shall not be given access to Quikchex’s proprietary systems, source code, internal infrastructure, or other clients’ data.
- Liability
Any liability of Quikchex arising under this DPA is subject to the liability limitations agreed in the main Agreement or Terms & Conditions.
In no event shall Quikchex’s aggregate liability exceed one month of Service Fees.
- Return or Deletion of Data
Upon termination:
- Quikchex will provide the Customer access to export or retrieve Personal Data
• After 30 days, Quikchex may delete or archive Personal Data, except where retention is legally required
Customer acknowledges that deleted data cannot be restored.
- Governing Law and Dispute Resolution
This DPA is governed by the laws of India.
Any disputes shall be resolved in accordance with the arbitration and jurisdiction clauses specified in the main Agreement or Terms & Conditions (Mumbai jurisdiction).
- Miscellaneous
• This DPA supersedes previous data processing terms between the parties.
• If any provision is held invalid, the remainder shall remain enforceable.
• Amendments must be in writing and mutually agreed.
• Electronic signatures are valid and binding.