Data Processing Agreement
Last Updated
13 August 2025 at 2:22:40 am
This Data Processing Agreement (“DPA”) is incorporated into and forms part of the Terms & Conditions (“Agreement”) between:
Controller: Any customer using the Processor’s services who processes Personal Data, and
Processor: Vardhman Infinity Private Limited, trading as Stream[ixel.
By using the services, the Controller agrees to this DPA, which applies where the Processor processes Personal Data on behalf of the Controller.
1. Subject Matter & Duration
1.1 This DPA governs the Processor’s processing of Personal Data on behalf of the Controller.
1.2 It remains in effect for as long as the Processor processes Personal Data for the Controller.
2. Nature & Purpose of Processing
2.1 The Processor processes Personal Data solely to provide streaming, analytics, and optimisation services, and related technical support.
2.2 The processing includes collection, storage, retrieval, transmission, and deletion, as necessary to fulfil the Agreement.
3. Categories of Data & Data Subjects
3.1 Data Subjects may include end-users, employees, or contractors of the Controller.
3.2 Personal Data may include:
Name, email address (if provided)
IP address, device/browser identifiers
Session data, cookies, timestamps
Usage analytics events and custom properties provided by the Controller
Other Personal Data submitted via the Service
Sensitive Personal Data is processed only if explicitly provided by the Controller and in compliance with applicable law.
4. Roles & Responsibilities
4.1 The Controller determines the purposes and means of processing.
4.2 The Processor acts only on documented instructions from the Controller.
4.3 The Processor ensures all authorised personnel are bound by confidentiality.
4.4 The Processor maintains records of all processing activities as required by law.
5. Security Measures
The Processor implements appropriate technical and organisational measures, including:
Encryption in transit and at rest
Access control and authentication
Security monitoring and incident response
Regular vulnerability testing
Disaster recovery and business continuity plans
6. Sub-Processors
6.1 The Controller authorises the Processor to engage sub-processors.
6.2 Sub-processors are bound by written agreements with data protection obligations equivalent to this DPA.
6.3 Current sub-processors include:
Mixpanel, Inc.
Role: Analytics and usage tracking
Data: IP address, device/browser identifiers, timestamps, session data, anonymised event data, and custom properties
Location: United States (EU data residency available and used)
Safeguards: Bound by Data Processing Agreement and Standard Contractual Clauses
Website: https://mixpanel.com
6.4 The Processor will notify the Controller of changes to sub-processors via the website or account notification.
7. International Data Transfers
The Processor ensures that any transfer of Personal Data outside the Controller’s jurisdiction is performed in compliance with applicable data protection laws, using safeguards such as Standard Contractual Clauses or equivalent.
8. Assistance to the Controller
The Processor will assist the Controller in meeting obligations relating to:
Responding to Data Subject rights requests
Conducting data protection impact assessments
Engaging with supervisory authorities
9. Personal Data Breach Notification
In case of a Personal Data Breach, the Processor will notify the Controller without undue delay and provide all information necessary for compliance with breach notification obligations.
10. Deletion or Return of Data
Upon termination of services, the Processor will delete or return all Personal Data as instructed by the Controller, unless retention is required by law.
11. Audits & Inspections
The Processor will make available all information necessary to demonstrate compliance with this DPA and allow for audits by the Controller or an appointed auditor.
12. Governing Law
This DPA is governed by the laws specified in the Terms of Serivce, and disputes shall be resolved under its jurisdiction terms.