Data Processing Agreement

1. Purpose

This Data Processing Agreement (DPA) forms part of the LoopNow Terms of Service and applies to the processing of personal data by LoopNow on behalf of the Customer (the controller) when the Customer uses the LoopNow service.

2. Scope and roles

LoopNow acts as the Data Processor. The Customer is the Data Controller. LoopNow will process personal data only on the documented instructions of the Customer, including with regard to transfers of personal data.

3. Sub-processors

LoopNow engages the sub-processors listed in our sub-processors page. We will notify customers of any new sub-processors at least 30 days in advance.

4. Security

LoopNow implements appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS 1.3) and at rest (AES-256), access controls, audit logging, and quarterly third-party penetration tests.

5. Data principal rights

LoopNow will assist the Customer in fulfilling data subject / data principal rights requests, including access, correction, erasure, and portability, in accordance with applicable law.

6. Breach notification

LoopNow will notify the Customer of a personal data breach within 48 hours of becoming aware of it.

7. International transfers

For transfers outside India, LoopNow relies on the EU Standard Contractual Clauses (SCCs) and equivalent mechanisms.

8. Termination

Upon termination, LoopNow will delete or return all personal data at the Customer's choice, unless retention is required by law.