Data Processing Agreement (DPA)

Product: Refund Sensor (refundsensor.com)
Operated by: Vasundhara Infotech LLP
Effective date: 1 June 2026
Last updated: 1 June 2026

This Data Processing Agreement (“DPA”) forms part of and is incorporated into the Terms of Use (the “Agreement”) between Vasundhara Infotech LLP (“Refund Sensor”, “Processor”) and the customer that has accepted the Agreement (“Customer”, “Controller”). Each a “party” and together the “parties”.

This DPA governs Refund Sensor's processing of Personal Data on the Customer's behalf in connection with the Service. Where the Customer's end users' personal data is processed through the Service, the Customer acts as the Controller / Data Fiduciary and Refund Sensor acts as the Processor / Data Processor.

If there is a conflict between this DPA and the Agreement on data-protection matters, this DPA prevails.

“Data Protection Laws” means all applicable laws relating to the processing of Personal Data, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR, the California Consumer Privacy Act as amended (“CCPA/CPRA”), and India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (“DPDP”), each as applicable.

“Personal Data”, “Controller”, “Processor”, “Data Subject”, “Processing”, and “Personal Data Breach” have the meanings given in the GDPR; under DPDP, “Controller” corresponds to “Data Fiduciary”, “Processor” to “Data Processor”, and “Data Subject” to “Data Principal”.

“Customer Personal Data” means Personal Data that Refund Sensor processes on the Customer's behalf under the Agreement, as described in Annex 1.

“Sub-processor” means any third party engaged by Refund Sensor to process Customer Personal Data.

• 2.1 The parties acknowledge that, with respect to Customer Personal Data, the Customer is the Controller and Refund Sensor is the Processor.
• 2.2 Refund Sensor will process Customer Personal Data only for the purposes of providing the Service and as described in Annex 1, and otherwise in accordance with the Customer's documented instructions, including those given through the Service's configuration and settings.
• 2.3 The Customer is responsible for ensuring it has a lawful basis and all necessary consents and notices to provide Customer Personal Data and to instruct Refund Sensor to process it.

Refund Sensor shall:

• 3.1 Instructions. Process Customer Personal Data only on the Customer's documented instructions, including regarding international transfers, unless required by law (in which case Refund Sensor will inform the Customer, unless legally prohibited).
• 3.2 Confidentiality. Ensure that personnel authorised to process Customer Personal Data are bound by appropriate confidentiality obligations.
• 3.3 Security. Implement and maintain appropriate technical and organisational measures as set out in Annex 2, taking into account the state of the art, costs, and the nature, scope, context, and purposes of processing, and the risk to Data Subjects. This includes the protections applied to platform credentials such as Apple .p8 keys (encryption at rest and in transit, restricted access, and no exposure to third parties).
• 3.4 Sub-processors. Engage Sub-processors only in accordance with Section 4.
• 3.5 Assistance with Data Subject requests. Taking into account the nature of the processing, assist the Customer by appropriate measures, insofar as possible, to respond to requests from Data Subjects exercising their rights under Data Protection Laws.
• 3.6 Assistance with compliance. Assist the Customer in ensuring compliance with its obligations regarding security, breach notification, data protection impact assessments, and prior consultation, taking into account the information available to Refund Sensor.
• 3.7 Breach notification. Notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and provide reasonably available information to help the Customer meet its own notification obligations (including under GDPR Articles 33–34 and the DPDP Rules, 2025).
• 3.8 Deletion or return. At the Customer's choice, delete or return all Customer Personal Data at the end of the provision of the Service, and delete existing copies unless retention is required by law. This includes deleting or rendering unusable any platform credentials, including .p8 keys, upon disconnection or termination.
• 3.9 Records and audits. Make available to the Customer information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates, subject to reasonable notice, confidentiality, and frequency limits, and not unreasonably disrupting Refund Sensor's operations.

• 4.1 The Customer provides general authorisation for Refund Sensor to engage Sub-processors. The current Sub-processors are listed in Annex 3 (and/or at refundsensor.com/subprocessors).
• 4.2 Refund Sensor will impose data-protection obligations on each Sub-processor that are substantially similar to those in this DPA, and remains responsible for each Sub-processor's performance.
• 4.3 Refund Sensor will give the Customer reasonable notice of any intended addition or replacement of a Sub-processor, giving the Customer the opportunity to object on reasonable data-protection grounds. If the parties cannot resolve a reasonable objection, the Customer may terminate the affected part of the Service.

• 5.1 Refund Sensor may transfer Customer Personal Data internationally to provide the Service, subject to appropriate safeguards under Data Protection Laws.
• 5.2 Where transfers from the EEA/UK occur, the parties agree that the applicable Standard Contractual Clauses (and the UK Addendum, where relevant) are incorporated by reference and apply, with Refund Sensor (or its relevant entity) acting as data importer.
• 5.3 For Customer Personal Data subject to DPDP, transfers outside India are permitted except to jurisdictions restricted by the Government of India, and Refund Sensor will comply with any such restrictions notified from time to time.

Where Refund Sensor processes Personal Information subject to the CCPA/CPRA as a “service provider”, Refund Sensor will not: (a) sell or share such information; (b) retain, use, or disclose it for any purpose other than performing the Service or as permitted by the CCPA; or (c) combine it with information from other sources except as permitted by the CCPA. Refund Sensor certifies that it understands and will comply with these restrictions.

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Agreement.

This DPA takes effect on the Effective Date and continues for as long as Refund Sensor processes Customer Personal Data under the Agreement. Sections that by their nature should survive (including Sections 3.8 and 7) survive termination.

This DPA is governed by the same governing law and dispute-resolution provisions as the Agreement (the laws of India; courts and arbitration seated at Surat, Gujarat), except to the extent Data Protection Laws require otherwise.

• Subject matter: Provision of the Refund Sensor Service (refund-request tracking and automated reply) to the Customer.
• Duration: For the term of the Agreement and any period required to return or delete data thereafter.
• Nature and purpose: Collecting, storing, organising, retrieving, using, and transmitting Personal Data to operate the Service, including connecting to the Customer's platform accounts, retrieving subscription/transaction/refund data, and sending automated replies configured by the Customer.
• Types of Personal Data: Customer account contacts (name, email, role); platform credentials provided by the Customer (e.g., Apple .p8 key, Key ID, Issuer ID); and end-user / refund-requester data retrieved from connected platforms (which may include identifiers, purchase and transaction details, refund reasons, and related communications).
• Categories of Data Subjects: The Customer's authorised users and the Customer's end users / app customers who submit or are associated with refund requests.
• Sensitive data: The Service is not intended to process special categories of data. The Customer should not submit such data unless agreed in writing.

Refund Sensor maintains measures including, as applicable:

• Encryption of platform credentials (including .p8 keys) and sensitive data at rest and in transit.
• Access control — least-privilege access, authentication, and restriction of credential access to authorised systems and personnel only.
• Network and application security — firewalls, secure configuration, and protection against common vulnerabilities.
• Logging and monitoring of access and activity for security and troubleshooting.
• Confidentiality obligations for personnel.
• Sub-processor management with contractual data-protection terms.
• Backup and resilience measures appropriate to the Service.
• Incident response procedures for detecting, investigating, and notifying breaches.
• Secure deletion of credentials and data on disconnection or termination.

• Paddle — Payment processing and subscription billing. Location: India.
• AWS — Hosting and storage of application data. Location: India.

This DPA is incorporated into and accepted as part of the Terms of Use. No separate signature is required for it to apply. If your organisation requires a signed copy, contact [email protected].