Legal

Data Processing Agreement

GDPR-Compliant Data Processing Terms

Last updated: November 22, 2025

Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") forms part of the service agreement between Incresco Technology Solutions Private Limited ("Processor" or "Incresco") and the Client ("Controller") and governs the processing of personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

1. Definitions

In this DPA, the following terms have the meanings set out below:

  • "Controller" means the entity that determines the purposes and means of processing personal data
  • "Processor" means Incresco, which processes personal data on behalf of the Controller
  • "Personal Data" means any information relating to an identified or identifiable natural person
  • "Processing" means any operation performed on personal data
  • "Data Subject" means the individual to whom personal data relates
  • "Sub-processor" means any third party engaged by the Processor to process personal data
  • "GDPR" means Regulation (EU) 2016/679

2. Scope and Applicability

2.1 Scope of Processing

This DPA applies to all processing of personal data by Incresco on behalf of the Controller in connection with the provision of services.

2.2 Nature and Purpose of Processing

  • Nature: AI consulting, software development, cloud services, data analytics
  • Purpose: To provide professional services as outlined in the service agreement
  • Duration: For the term of the service agreement and as required for legal compliance

2.3 Categories of Data Subjects

  • Employees and contractors of the Controller
  • Customers and clients of the Controller
  • End users of Controller's products or services
  • Other individuals as specified in the service agreement

2.4 Types of Personal Data

  • Contact information (name, email, phone number)
  • Professional information (job title, company)
  • Technical data (IP addresses, device information)
  • Usage data and analytics
  • Other data as specified in the service agreement

3. Processor's Obligations

3.1 Processing Instructions

Incresco shall process personal data only on documented instructions from the Controller, including with regard to transfers of personal data to third countries or international organizations, unless required to do so by applicable law.

3.2 Confidentiality

Incresco shall ensure that persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

3.3 Security Measures

Incresco shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

  • Encryption of personal data in transit and at rest
  • Ability to ensure ongoing confidentiality, integrity, availability, and resilience of processing systems
  • Ability to restore availability and access to personal data in a timely manner in the event of an incident
  • Regular testing, assessment, and evaluation of the effectiveness of security measures
  • Access controls and authentication mechanisms
  • Secure development practices and code reviews

3.4 Sub-processing

Incresco may engage sub-processors to assist in providing services. The Controller provides general authorization for the engagement of sub-processors, subject to:

  • Incresco informing the Controller of any intended changes concerning the addition or replacement of sub-processors
  • The Controller having the opportunity to object to such changes within 30 days
  • Incresco imposing the same data protection obligations on sub-processors as set out in this DPA

3.5 Data Subject Rights

Incresco shall, to the extent possible, assist the Controller in responding to requests from data subjects to exercise their rights under GDPR, including:

  • Right of access
  • Right to rectification
  • Right to erasure
  • Right to restriction of processing
  • Right to data portability
  • Right to object

3.6 Assistance to Controller

Incresco shall assist the Controller in ensuring compliance with obligations under GDPR Articles 32 to 36, taking into account the nature of processing and information available to Incresco.

3.7 Data Breach Notification

Incresco shall notify the Controller without undue delay (and in any event within 48 hours) after becoming aware of a personal data breach affecting the Controller's data.

3.8 Deletion or Return of Data

At the Controller's choice, Incresco shall delete or return all personal data to the Controller after the end of the provision of services, and delete existing copies unless applicable law requires storage of the personal data.

3.9 Audit Rights

Incresco shall make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

4. Controller's Obligations

The Controller shall:

  • Ensure that processing instructions comply with applicable data protection laws
  • Have a legal basis for the processing of personal data
  • Inform Incresco of any restrictions on processing
  • Ensure that data subjects have been informed about the processing
  • Respond to data subject requests in a timely manner

5. International Data Transfers

Where Incresco transfers personal data outside the European Economic Area (EEA), it shall ensure that:

  • The transfer is to a country with an adequacy decision, or
  • Appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs), or
  • The Controller has provided explicit consent for the transfer

6. Sub-processors

Current sub-processors engaged by Incresco include:

  • Cloud Infrastructure Providers: AWS, Google Cloud Platform, Microsoft Azure
  • Analytics Services: Google Analytics (with IP anonymization)
  • Communication Tools: Email service providers, CRM systems

An up-to-date list of sub-processors is available upon request at dpo@increscotech.com

7. Liability and Indemnification

Each party's liability under this DPA shall be subject to the limitations and exclusions of liability set out in the main service agreement.

8. Term and Termination

This DPA shall remain in effect for the duration of the service agreement and shall automatically terminate upon termination of the service agreement, subject to the data deletion or return obligations.

9. Governing Law

This DPA shall be governed by the same law as the main service agreement. For GDPR purposes, the supervisory authority shall be determined based on the Controller's location.

10. Amendments

Incresco may amend this DPA from time to time to reflect changes in data protection laws or processing practices. Material changes will be communicated to the Controller with reasonable notice.

11. Contact Information

For questions or concerns regarding this DPA:

12. Acceptance

By engaging Incresco's services, the Controller acknowledges and agrees to the terms of this Data Processing Agreement. For a signed copy of this DPA, please contact our legal department.

Back to Home