Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the SaaS Subscription Agreement between TradeNovaTech ("Data Processor") and the subscribing organization ("Data Controller"). This DPA governs the processing of personal data through the NovaHR platform in accordance with the Information Technology Act, 2000 and applicable Indian data protection laws.

1 Definitions

Data Controller: The Customer organization that determines the purposes of data processing
Data Processor: TradeNovaTech, which processes data on behalf of the Customer
Personal Data: Any information relating to an identifiable employee (name, email, phone, location, etc.)
Processing: Any operation performed on personal data (collection, storage, use, deletion)

2 Data Processed by NovaHR

Category	Data Types	Purpose
Employee Identity	Name, email, phone, employee ID	Account creation and identification
Attendance Data	Check-in/out times, GPS coordinates	Attendance tracking and verification
Leave Data	Leave type, dates, approval status	Leave management and reporting
HR Data	Designation, department, role, salary grade	Organizational management
Payment Data	Invoice details, payment ID (via Razorpay)	Billing and subscription management

3 Processor Obligations

TradeNovaTech as Data Processor agrees to:

Process personal data only on documented instructions from the Customer
Ensure persons authorized to process data are under confidentiality obligations
Implement appropriate technical and organizational security measures
Not engage sub-processors without prior authorization
Assist the Customer in responding to data subject requests
Delete or return all personal data upon termination of the Agreement
Provide all information necessary to demonstrate compliance

4 Controller Obligations

The Customer as Data Controller agrees to:

Ensure lawful basis for processing employee personal data
Inform employees about data collection and processing activities
Obtain necessary consents from employees where required
Ensure accuracy of data entered into NovaHR
Comply with applicable Indian labour and data protection laws

5 Security Measures

All data transmitted via SSL/TLS encryption
Data stored on secured VPS servers in India
MongoDB database with authentication and role-based access controls
GPS location data encrypted in transit
Regular automated backups
Access to production data restricted to authorized personnel only

6 Data Retention & Deletion

Active subscription: Data retained for duration of subscription
Post-termination: Data retained for 30 days before deletion
Customer may request data export before account deletion
Payment records retained for 7 years per Indian tax law
Deletion requests processed within 30 days of receipt

7 Data Breach Notification

TradeNovaTech will notify Customer of any confirmed data breach within 72 hours of discovery
Notification will include: nature of breach, data affected, measures taken
TradeNovaTech will cooperate with Customer in managing breach response
Breach notifications sent to Customer's registered email address

8 Sub-processors

TradeNovaTech currently uses the following sub-processors:

Sub-processor	Purpose	Location
Razorpay	Payment processing	India
Hostinger VPS	Data storage & hosting	India
SMTP Provider	Transactional emails	India

9 Governing Law

This DPA is governed by the laws of India, including the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Disputes shall be resolved in courts of Noida, Uttar Pradesh, India.

10 Contact

For data processing queries or to exercise data rights:

support@tradenovatech.com
Noida, Uttar Pradesh, India
UDYAM-UP-28-0225948