STATIONRIDGES PRIVATE LIMITED

This Data Processing Agreement DPA defines a legally enforceable arrangement between Station Ridges, identified as the Data Processor, and the organization or individual agreeing to these terms, identified as the Data Controller. The Agreement regulates how Personal Data is handled while delivering payment related services.

Responsibilities of Each Party

The Data Controller determines the purpose, scope, and lawful basis for Personal Data processing and remains accountable for adherence to all relevant data protection regulations.

The Data Processor processes Personal Data only in accordance with written instructions provided by the Controller and solely for enabling payment operations.

Nature and Purpose of Processing

The Data Processor may process Personal Data only for activities including:

Initiation, authorization, and settlement of payment transactions
Know Your Customer verification and fraud risk prevention
Customer identity authentication including two factor verification
Transaction monitoring, reporting, and financial reconciliation
Compliance with regulatory requirements issued by RBI, and payment network authorities

Information Security Controls

The Data Processor shall apply appropriate technical and organizational safeguards including:

Compliance with industry standards for secure card data storage, transmission, and handling.
Encryption of Personal Data during transmission and storage
Multi level authentication controls for system access
Secure encryption key handling practices
Periodic vulnerability scanning and penetration testing

All personnel with access to Personal Data shall maintain confidentiality obligations and receive training on data protection and information security practices.

Data Subject Rights Support

The Data Processor shall provide reasonable assistance to help the Controller respond to Data Subject requests under applicable data protection laws including:

Access to Personal Data
Correction of inaccurate data
Deletion of Personal Data
Transfer of Personal Data
Restriction or objection to data processing

Engagement of Subprocessors

No Subprocessor shall be appointed without prior written approval from the Data Controller.
Each authorized Subprocessor must be bound by a contractual agreement enforcing data protection obligations equal to or stronger than obligations under this Agreement.

Personal Data Breach Reporting

The Data Processor shall inform the Data Controller within twenty four hours upon becoming aware of any Personal Data breach. The notification shall contain:

Description of the breach incident
Estimated number and type of impacted Data Subjects
Corrective actions taken to limit impact
Preventive measures planned for future risk reduction

Audit Rights and Compliance Review

The Data Controller may conduct audits with reasonable notice to verify compliance with obligations under this Agreement. The Data Processor will provide access to relevant documentation, including security policies and compliance records, as required.

Data Retention and Secure Disposal

Personal Data shall be retained only for the duration required to support payment processing obligations and statutory compliance requirements including retention rules issued by regulatory authorities.
Upon service termination, Personal Data shall be securely deleted or returned unless retention is legally mandated.

Regulatory and Legal Updates

The Data Processor shall notify the Data Controller without delay if regulatory or legal changes affect compliance capability under this Agreement.

Liability and Indemnity

Each party bears responsibility for damages resulting from violations of obligations under this Agreement. The Data Processor agrees to indemnify the Data Controller against penalties, losses, or claims arising from data protection failures.

Governing Law and Jurisdiction

This Agreement shall be governed under Indian law. All disputes shall fall under the exclusive jurisdiction of courts located within India.

Agreement Modifications

Any revisions to this Agreement shall be documented in writing and executed with authorization from both parties.

Acceptance Confirmation

By entering into this Agreement, both parties confirm awareness, understanding, and acceptance of all terms outlined within this Data Processing Agreement.