Data Processing Agreement (Template)

Last updated: 30 September 2026

1. Parties & effective date

This Data Processing Agreement ("DPA") is entered into between:

• The Customer — [legal name of the campaign organization], of [registered/principal address] (the "Customer", "Controller" or "you"), the campaign organization that subscribes to and operates a tenant on the Vijetha platform for the constituency [constituency / area]; and
• Aravir Technologies Private Limited, a company incorporated in India (CIN U62011AP2026PTC126177), with its registered office at 2A, Yashoda Homes, Nellore, Andhra Pradesh 524003, India ("Aravir", "Vijetha", the "Processor" or "we"), the operator of the Vijetha voter-management platform.

This DPA has effect from [effective date] and forms part of, and is subject to, the Terms of Service and Privacy Policy between the parties (together, the "Agreement"). It governs the processing of personal data by Aravir on behalf of the Customer in the course of providing the Vijetha platform (the "Service").

2. Definitions

• "Applicable Law" means all laws and rules applicable to the processing of personal data under this DPA, including the Digital Personal Data Protection Act, 2023 ("DPDP Act") and any rules made under it, the Information Technology Act, 2000 and the rules made under it (including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011), and the directions, rules and codes of the Election Commission of India ("ECI"), including the Model Code of Conduct, as each is in force from time to time.
• "Personal Data" means any data about an individual who is identifiable by or in relation to such data, processed under this DPA.
• "Voter Data" means the electoral roll and voter records, and the campaign fields recorded against them, that the Customer or its Users upload to or generate within the Customer's tenant. Voter Data is a category of Personal Data.
• "Data Principal" / "Data Subject" means the individual to whom Personal Data relates (for example a voter, or a member of campaign staff).
• "Controller" means the person who, alone or with others, determines the purpose and means of processing Personal Data (under the DPDP Act, the "Data Fiduciary").
• "Processor" means the person who processes Personal Data on behalf of and under the instructions of a Controller (under the DPDP Act, the "Data Processor").
• "Sub-processor" means any third party engaged by Aravir to process Personal Data on the Customer's behalf in connection with the Service.
• "Processing" means any operation performed on Personal Data, whether or not by automated means, such as collection, recording, storage, use, disclosure, transmission, erasure or destruction.
• "Personal Data Breach" means any unauthorized processing of, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to, Personal Data that compromises its confidentiality, integrity or availability.
• "User" means an individual authorized by the Customer to access the Service (for example an administrator, coordinator or field worker).

3. Roles of the parties

For the Voter Data and other Personal Data that the Customer uploads to or generates within its tenant, the Customer is the Controller and Aravir is the Processor. Aravir processes such Personal Data only on the Customer's documented instructions and solely to provide the Service; it does not determine the purposes of that processing, does not use the data for its own purposes, does not sell it, and does not share it between tenants.

For account, authentication, billing and platform-operations data that Aravir determines the purposes and means of processing (as described in the Privacy Policy), Aravir acts as a Controller in its own right, and that processing is governed by the Privacy Policy rather than by this DPA.

Each party is responsible for complying with the obligations that Applicable Law places on it in its respective role.

4. Details of the processing

The subject-matter, duration, nature, purpose, categories of Data Subjects and categories of Personal Data are set out in Annex A and summarised here:

• Subject-matter & nature: hosting, storage, organization, display and synchronization of electoral and voter data, and related field-work records, through the Vijetha web console and Android/iOS field applications.
• Purpose: to provide the Service to the Customer for its legitimate constituency campaign, on the Customer's instructions.
• Duration: for the term of the Customer's subscription and any additional period expressly instructed by the Customer, subject to Section 13.
• Categories of Data Subjects: voters recorded in the Customer's tenant, and the Customer's campaign staff who hold accounts.
• Categories of Personal Data: voter name; EPIC number / voter ID; relation name; address and household grouping; age and gender; phone number (where present); caste and sub-caste; religion; party leaning and its strength; supporter flag; residence status; canvassing (campaigning) status; voting status on polling day; canvassing notes and edit history recorded by field staff; and, for staff accounts, name, mobile number, email and role.
• Sensitive categories: the parties acknowledge that some fields the product supports — in particular caste, sub-caste, religion and political leaning — are sensitive. The Customer decides, as Controller, whether to collect them and is responsible for having a lawful basis and for using them lawfully.

5. Controller (customer) warranties & instructions

The Customer represents, warrants and undertakes, for the duration of this DPA, that:

• It has lawfully obtained the source electoral rolls and any other data it uploads, and is entitled to have Aravir process that data to provide the Service;
• It has a valid lawful basis for the collection and the intended use of the Personal Data, and has obtained any consents, permissions or authorizations required under Applicable Law;
• For each dataset it uploads, it will record and maintain provenance — the source, the date obtained, the issuing authority (where applicable), the purpose of use, the retention period, and the internal approval — and will make that record available to Aravir on reasonable request;
• It complies, and will ensure its Users comply, with the rules and directions of the Election Commission of India and with the Model Code of Conduct, including the prohibitions on appeals to caste or communal/religious feelings, the restrictions on prohibited uses of voter data, and the campaign-silence-period rules;
• It will not instruct Aravir to process Personal Data in any manner that infringes Applicable Law, and it will keep its instructions within the scope of the Service;
• Its Users are authorized, its access controls within the tenant are appropriate, and it is responsible for the accuracy of the data it uploads and for keeping it up to date.

The Customer's complete and final instructions to Aravir are: (a) this DPA and the Agreement; (b) the Customer's configuration and use of the Service's features; and (c) any further written instructions the Customer gives. Aravir will inform the Customer if, in its opinion, an instruction infringes Applicable Law (without any obligation to give legal advice).

6. Processor obligations

Aravir undertakes that it will:

• Documented instructions: process Personal Data only on the Customer's documented instructions, including as to transfers, unless required to do otherwise by Applicable Law (in which case, where lawful, it will inform the Customer of that requirement before processing);
• Confidentiality: ensure that persons authorized to process the Personal Data are bound by confidentiality and access it only as needed to provide the Service;
• Security: implement and maintain the technical and organizational measures described in Section 7 and Annex C;
• Sub-processors: engage Sub-processors only in accordance with Section 8;
• Assistance: taking into account the nature of the processing, assist the Customer by appropriate measures in responding to Data-Subject requests (Section 9) and in meeting the Customer's own security, breach-notification and, where applicable, impact-assessment obligations;
• Breach notification: notify the Customer of a Personal Data Breach in accordance with Section 10;
• Deletion / return: return or delete Personal Data on termination in accordance with Section 13;
• Demonstrate compliance: make available to the Customer information reasonably necessary to demonstrate compliance with this DPA and allow for audits in accordance with Section 12;
• No independent use: not sell the Personal Data, not use it for advertising or profiling for its own purposes, and not disclose it except as permitted by this DPA or required by law.

7. Security measures

Aravir maintains reasonable security practices and procedures appropriate to the sensitivity of electoral data, including:

• Encryption of data in transit using TLS;
• An encrypted offline store in the mobile field app, protected by an app lock, holding only the subset of records assigned to the signed-in worker and erased on sign-out or revocation of access;
• OTP-based authentication with device binding, so account access is restricted to authorized devices, and credentials/OTP data are stored only in hashed form;
• Role-based access control (RBAC), so Users access only the data their role permits;
• Tenant isolation, so each campaign's data is logically segregated and not accessible to other tenants;
• Access controls, logging and monitoring on Aravir's systems.

A fuller description is set out in Annex C. Aravir may update the specific measures over time provided the overall level of protection is not reduced.

8. Sub-processors

The Customer provides a general authorization for Aravir to engage the Sub-processors listed in Annex B to process Personal Data in connection with the Service. Each Sub-processor is engaged only for the stated purpose and is bound by data-protection obligations no less protective than those in this DPA. Aravir remains responsible to the Customer for the performance of its Sub-processors' obligations.

Change notice: if Aravir intends to add or replace a Sub-processor, it will give the Customer prior notice (for example by email to the Customer's administrator or by an update to this page and Annex B). The Customer may object on reasonable data-protection grounds within a reasonable period of the notice; if the parties cannot resolve the objection, the Customer may, as its sole remedy, terminate the affected part of the Service in accordance with the Agreement.

9. Data-subject rights & assistance

Because the Customer is the Controller of the Voter Data, requests by Data Principals to access, correct, complete, update or erase their data, or to withdraw consent, are directed to and handled by the Customer. If Aravir receives such a request directly, it will, unless legally prohibited, promptly inform the Customer and will not respond to the request itself except on the Customer's documented instructions. Taking into account the nature of the processing, Aravir will provide reasonable assistance to enable the Customer to fulfil its obligations to respond to such requests.

10. Personal-data-breach notification

Aravir will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting the Customer's Personal Data. The notification will describe, to the extent known and as it becomes available, the nature of the breach, the categories and approximate number of records and Data Subjects affected, the likely consequences, and the measures taken or proposed to address it and mitigate its effects. Aravir will cooperate with the Customer and take reasonable steps to mitigate the breach. Each party remains responsible for making any notifications to the Data Protection Board of India, other authorities, or affected Data Principals that Applicable Law requires of it in its own role.

11. International transfers & data location

The Platform and its data are hosted on cloud infrastructure located in and served from India, and transactional email is handled through an India-based datacenter. Aravir will not transfer the Customer's Personal Data outside India except on the Customer's documented instructions or as permitted by Applicable Law, and subject to any restrictions the Central Government may notify under the DPDP Act.

12. Audit & inspection

On the Customer's reasonable written request, and no more than once in any twelve-month period (except where required by a supervisory authority or following a Personal Data Breach), Aravir will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Customer or an independent auditor it mandates. Audits will be conducted on reasonable prior notice, during business hours, in a manner that does not compromise the security or confidentiality of other customers' data, and subject to confidentiality. The Customer bears its own costs of an audit.

13. Return & deletion on termination

On expiry or termination of the Agreement, or earlier on the Customer's written instruction, Aravir will, at the Customer's choice, return or delete the Customer's Personal Data, and delete existing copies, within a reasonable period, unless Applicable Law requires continued storage. Backups are purged on Aravir's normal backup-rotation cycle. Aravir may retain a limited set of records where legally required (for example, invoices and transaction records for tax and accounting), retaining only what is necessary for that purpose and continuing to protect it under this DPA.

14. Liability, indemnity & precedence

The limitations and exclusions of liability, and the indemnity, set out in the Terms of Service apply to this DPA and to any claims arising under it, and the parties' aggregate liability under the Agreement and this DPA is subject to the limits in those Terms. In the event of a conflict between this DPA and the other parts of the Agreement, this DPA prevails on matters of data protection to the extent of the conflict; on all other matters, the Terms of Service prevail. The Privacy Policy continues to govern the processing for which Aravir is a Controller in its own right.

15. Governing law & jurisdiction

This DPA is governed by and construed in accordance with the laws of India. Subject to any applicable law, the competent courts at Nellore, Andhra Pradesh, India will have exclusive jurisdiction over any dispute arising out of or relating to this DPA.

16. Contact & Grievance Officer

Questions and notices under this DPA, and grievances regarding the processing of Personal Data, may be addressed to Aravir's Grievance Officer, Chandrasekhar Reddy Allareddy, at hello@vijetha.org (Aravir Technologies Private Limited, 2A, Yashoda Homes, Nellore, Andhra Pradesh 524003, India; phone +91 94406 98444). Aravir will acknowledge and endeavour to resolve grievances within the timelines prescribed by Applicable Law.

Aravir Technologies Private Limited
Registered office: 2A, Yashoda Homes, Nellore, Andhra Pradesh 524003, India
CIN: U62011AP2026PTC126177
Email: hello@vijetha.org  ·  Phone: +91 94406 98444

Annex A — Details of the processing

• Subject-matter: provision of the Vijetha voter-management platform (web console + Android/iOS field apps) to the Customer.
• Duration: the term of the Customer's subscription, plus any period expressly instructed by the Customer, subject to Section 13.
• Nature & purpose: hosting, storage, organization, display, synchronization and deletion of electoral and voter data and related field-work records, to enable the Customer's legitimate constituency campaign on the Customer's instructions.
• Categories of Data Subjects: voters in the Customer's constituency recorded in the tenant; the Customer's campaign staff (Users).
• Categories of Personal Data: name; EPIC / voter ID; relation name; address and household grouping; age and gender; phone number; caste and sub-caste; religion; party leaning and strength; supporter flag; residence status; canvassing status; voting status; canvassing notes and edit history; and, for staff, name, mobile number, email and role.
• Sensitive categories: caste, sub-caste, religion and political leaning, where the Customer chooses to record them.
• Frequency: continuous for the duration of the subscription.

Annex B — Sub-processors

• Razorpay — payment processing for subscription payments (card, UPI, netbanking). India.
• MSG91 — delivery of transactional SMS, specifically the one-time passwords (OTPs) used for login. India.
• Zoho (Zoho Mail, India datacenter) — delivery of transactional email, such as service notices and support correspondence. India.
• India-based cloud hosting infrastructure — hosting and storage of the Platform and its data, located in and served from India.

Aravir will give the Customer prior notice of any intended addition or replacement of a Sub-processor, as described in Section 8.

Annex C — Technical & organizational security measures

• Encryption in transit: TLS for all traffic between clients and the Service.
• Encrypted offline store: the mobile field app's offline database is encrypted at rest on the device, protected by an app lock, limited to the records assigned to the signed-in worker, and erased on sign-out or revocation.
• Authentication: OTP-based login with device binding; credentials and OTP data stored only in hashed form; operator console protected by TOTP-based two-factor authentication.
• Access control: role-based access control within each tenant, on least-privilege principles.
• Tenant isolation: each campaign's data is logically segregated and not accessible to other tenants.
• Logging & monitoring: sign-in events, access and error diagnostics are logged and monitored for security and troubleshooting.
• Data location: hosting, storage and transactional email are located in and served from India.
• Deletion: data is deleted or irreversibly anonymized on instruction or termination, subject to narrow legal-retention obligations, with backups purged on the normal rotation cycle.