Data Processing Agreement (DPA)

1. Scope & Applicability

This Data Processing Agreement ("DPA") governs the processing of customer personal data by Aarozi on behalf of the merchant ("Business") in connection with the Aarozi retention software and QR portal services.

2. Respective Roles

• Business (Data Controller): The merchant retains primary control over its customer records, defines loyalty rules, and determines communication schedules with its patrons.
• Aarozi (Data Processor): Aarozi processes customer personal data (such as names, mobile numbers, visit counts, and reward points) strictly according to the documented instructions of the merchant through their dashboard settings.

3. Obligations of Aarozi as Processor

Aarozi covenants to:

• Implement rigorous multi-tenant data isolation preventing unauthorized access between separate merchants.
• Maintain encryption of customer information in transit (HTTPS / TLS 1.3) and at rest.
• Engage only vetted infrastructure subprocessors (Supabase, Razorpay) subject to equivalent data protection standards.
• Notify the merchant without undue delay upon becoming aware of any confirmed personal data breach affecting their tenant records.
• Assist the merchant in fulfilling customer data access, correction, or deletion requests.

4. Data Deletion Upon Termination

Upon permanent cancellation and closure of the merchant's workspace, Aarozi will securely delete or return all customer personal data within 30 calendar days, preserving only such records as required by statutory accounting or tax laws.