Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the agreement between Ovoform and the customer using the Service where Ovoform processes personal data on behalf of the customer.

1. Platform Operator

For purposes of this DPA, “Ovoform” means VelocionTech Private Limited, which owns and operates the Service.

2. Roles of the Parties

For personal data collected, stored, or processed through customer-created forms or workflows, the customer acts as the controller or business, and Ovoform acts as the processor or service provider, except to the extent Ovoform independently determines purposes and means for its own operational data.

3. Subject Matter and Purpose

Ovoform processes personal data only as necessary to provide, host, secure, maintain, support, and improve the Service; to authenticate users; to enable integrations; to provide analytics, exports, and automations; and to comply with law or enforce agreements.

4. Customer Instructions

The customer instructs Ovoform to process personal data as necessary to provide the Service in accordance with the customer’s configuration and documented use of the Service, the Terms of Service, this DPA, and any other written instructions expressly agreed by the parties.

5. Customer Responsibilities

The customer is solely responsible for:

• determining whether the Service is suitable for the data the customer chooses to process;
• providing all required notices and obtaining all required consents;
• ensuring that the collection and processing of personal data is lawful;
• responding to respondents or data subjects where required by law; and
• refraining from using the Service for restricted or regulated data unless the customer accepts full responsibility and risk.

6. Security Measures

Ovoform uses measures intended to protect personal data, including encryption in transit, access controls, and infrastructure monitoring. However, Ovoform does not guarantee absolute security, uninterrupted availability, or successful recovery from all incidents.

7. Subprocessors

Customer authorizes Ovoform to use third-party subprocessors to support the Service, subject to reasonable contractual obligations. A current list may be maintained in Ovoform’s Subprocessor Disclosure.

8. Deletion and Return

Subject to technical feasibility, backups, logs, legal obligations, and operational constraints, Ovoform may delete or make inaccessible customer data after account termination, request, or expiration of applicable retention periods. Ovoform does not guarantee recovery or restoration of deleted data.

9. Incident Notification

If Ovoform becomes aware of a confirmed security incident affecting personal data processed on behalf of a customer, Ovoform may provide notice within a commercially reasonable period, taking into account the nature of the incident, technical investigation, legal restrictions, and the information available at the time.

10. International Transfers

Customer acknowledges that personal data may be processed in India or other jurisdictions where Ovoform or its subprocessors operate.

11. Platform Role and Customer Risk Allocation

Ovoform acts as a technology platform and service provider. Customer remains solely responsible for the legality of its data collection practices, instructions, notices, consent mechanisms, and intended uses of personal data. Ovoform does not assume responsibility for misuse of the platform by the customer or third parties, and the customer bears the risk of determining whether its use of the Service is appropriate for its compliance obligations.

12. No HIPAA, GDPR, or SOC 2 Representation

Ovoform does not represent in this DPA that the Service is HIPAA compliant, GDPR compliant, or SOC 2 compliant. If the customer uses the Service for regulated or sensitive data, the customer assumes full responsibility and liability.

13. Liability

This DPA is subject to the disclaimers, exclusions, limitations of liability, and indemnities set forth in the Terms of Service, which apply to VelocionTech Private Limited and its related protected persons and entities.

14. Governing Law

This DPA shall be governed by the laws in force in Punjab, India, and disputes shall be resolved as set out in the Terms of Service.