Data Processing Agreement (DPA)

1. PURPOSE

This Data Processing Agreement (“DPA”) governs the processing of personal data by Mohit Lakhera, sole proprietor of Adsyntra AI (“Adsyntra”, “Processor”, “we”, “us” or “our”) on behalf of the Client (“Client”, “Controller/Fiduciary” or “you”), where Adsyntra processes personal data in connection with Services provided under the applicable Client Service Agreement / Master Service Agreement (“MSA”) and Statement of Work (“SOW”).

This DPA forms part of the MSA where the Services involve processing personal data on behalf of the Client.

The Parties intend this DPA to establish practical requirements relating to:

• processing instructions;
• confidentiality;
• security;
• subprocessors;
• personal-data incidents;
• assistance with data-subject requests;
• international processing;
• retention and deletion; and
• other data-protection responsibilities.

This DPA shall be interpreted consistently with applicable data-protection and privacy laws.

2. APPLICABLE LAW

Depending on the nature, location and circumstances of the processing, applicable privacy and data-protection laws may include:

• the Digital Personal Data Protection Act, 2023 (“DPDP Act”);
• the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”);
• applicable Indian information-technology and cybersecurity requirements;
• privacy and data-protection laws applicable to international Clients or Data Principals; and
• other mandatory laws applicable to the specific engagement.

The Parties acknowledge that the DPDP Act and DPDP Rules have a phased commencement framework. This DPA is intended to establish contractual safeguards that can operate alongside applicable law and be updated when mandatory requirements become applicable.

Nothing in this DPA shall be interpreted as excluding or limiting any legal right or obligation that cannot legally be excluded or limited.

3. DEFINITIONS

Unless otherwise defined in this DPA, terms such as:

• “personal data”;
• “Data Principal”;
• “Data Fiduciary”;
• “Data Processor”;
• “processing”; and
• “consent”

shall have the meaning assigned to them under applicable law.

For contractual purposes, “Personal Data” means information relating to an identified or identifiable individual that Adsyntra processes for or on behalf of the Client.

4. ROLES OF THE PARTIES

4.1 Client as Data Fiduciary / Controller

Where the Client determines the purposes and means of processing Personal Data, the Client is responsible for determining the lawful basis, purpose, notices, permissions, instructions and other legal requirements applicable to that processing.

The Client is responsible for ensuring that it has the necessary authority to provide Personal Data to Adsyntra.

4.2 Adsyntra as Data Processor / Service Provider

Where Adsyntra processes Personal Data solely on behalf of the Client in order to provide contracted Services, Adsyntra shall process such Personal Data according to the Client's documented instructions and this DPA.

4.3 Independent Processing

Adsyntra may separately process certain information for its own legitimate business purposes, such as:

• billing;
• accounting;
• legal compliance;
• security;
• fraud prevention;
• contract administration;
• dispute resolution;
• service administration; and
• other purposes for which Adsyntra independently determines the lawful purpose and means.

Such processing may be governed by Adsyntra's Privacy Policy and applicable law rather than being treated as processing solely on behalf of the Client.

5. PROCESSING INSTRUCTIONS

Adsyntra shall process Client Personal Data:

1. to provide the Services;
2. according to the MSA and applicable SOW;
3. according to documented instructions reasonably provided by the Client;
4. to maintain and secure systems;
5. to troubleshoot and support the Services;
6. to comply with applicable law; and
7. for other purposes expressly authorised in writing by the Client.

Adsyntra shall not intentionally use Client Personal Data for unrelated purposes outside the agreed Services except where:

• required by law;
• necessary for security or fraud prevention;
• expressly authorised by the Client; or
• Adsyntra is independently acting as a Data Fiduciary/Controller for the relevant processing.

6. CLIENT'S RESPONSIBILITIES

The Client shall:

1. ensure that its collection and use of Personal Data is lawful;
2. provide required privacy notices;
3. obtain consent where legally required;
4. maintain appropriate records where required;
5. provide lawful and documented instructions;
6. ensure that instructions do not require Adsyntra to violate applicable law;
7. ensure that Personal Data supplied to Adsyntra is reasonably accurate and relevant;
8. respond to Data Principal requests where the Client is responsible for doing so;
9. determine appropriate retention periods for Client-controlled Personal Data;
10. ensure that its products, offers and customer communications comply with applicable law;
11. ensure that it has appropriate rights to use and share customer/lead information with Adsyntra;
12. notify Adsyntra of restrictions affecting processing; and
13. promptly notify Adsyntra if any instruction becomes unlawful.

7. CATEGORIES OF DATA

Depending on the Services, Adsyntra may process the following categories of Personal Data:

Identity Information

• name;
• username;
• profile information;
• company/organisation information.

Contact Information

• phone number;
• email address;
• postal/business address;
• social-media identifiers.

Lead Information

• enquiry;
• business type;
• website;
• approximate business/revenue information;
• advertising budget;
• requirements;
• customer preferences;
• lead source.

Communication Information

• WhatsApp conversations;
• Instagram conversations;
• email communications;
• chatbot conversations;
• enquiry forms;
• customer-service interactions.

Technical/Online Information

Where included within the Client's systems:

• IP address;
• browser/device information;
• cookie identifiers;
• analytics identifiers;
• campaign identifiers;
• website interaction information.

CRM and Sales Information

Depending on the Client's systems:

• lead status;
• sales stage;
• notes;
• appointment information;
• customer interactions;
• campaign attribution information.

The exact data processed shall depend on the relevant SOW and connected systems.

8. SPECIAL CATEGORIES / SENSITIVE INFORMATION

Unless expressly agreed in writing, the Client should not provide Adsyntra with highly sensitive or specially regulated personal information that is unnecessary for the Services.

Examples may include:

• financial-account credentials;
• passwords;
• authentication secrets;
• government identity numbers;
• health information;
• biometric information;
• highly sensitive personal records.

If a project legitimately requires such information, the Parties should document the purpose, security requirements, lawful basis, retention and handling arrangements before processing begins.

9. CATEGORIES OF DATA SUBJECTS

Depending on the engagement, Data Subjects may include:

• Client customers;
• prospective customers;
• leads;
• website visitors;
• social-media users;
• subscribers;
• employees;
• contractors;
• business contacts;
• event attendees; and
• other individuals whose Personal Data is supplied by the Client.

10. PROCESSING PURPOSES

Personal Data may be processed for purposes including:

• lead generation;
• lead qualification;
• customer communication;
• advertising;
• remarketing;
• CRM management;
• appointment scheduling;
• marketing automation;
• customer support;
• AI-agent communication;
• analytics;
• conversion tracking;
• reporting;
• campaign optimisation;
• sales follow-up;
• workflow automation;
• website functionality;
• technical support; and
• other purposes specified in the SOW.

11. DURATION OF PROCESSING

Processing shall continue for the duration reasonably necessary to perform the applicable Services and related contractual obligations.

Following expiry or termination of the Services, Personal Data shall be handled according to:

• the MSA;
• this DPA;
• Client instructions;
• applicable law;
• backup/technical requirements; and
• legitimate legal, accounting, security or dispute-resolution requirements.

12. CONFIDENTIALITY

Adsyntra shall ensure that persons authorised to process Client Personal Data are subject to appropriate confidentiality obligations.

Adsyntra shall not knowingly disclose Client Personal Data to unauthorised persons except where disclosure is:

• authorised by the Client;
• necessary for an approved subprocessor;
• required by law;
• necessary to protect security or prevent fraud; or
• otherwise permitted under this DPA or applicable law.

13. SECURITY MEASURES

Adsyntra shall maintain reasonable technical and organisational safeguards appropriate to the nature and risks of the Personal Data processed.

Depending on the Services, such measures may include:

Access Controls

• role-based access;
• least-privilege principles;
• restricted administrative access;
• account authentication controls.

Credential Protection

• avoidance of unnecessary password sharing;
• secure credential handling;
• use of authorised account invitations where available;
• access revocation when no longer required.

System Security

• reasonable device security;
• software/security updates;
• access monitoring where technically available;
• reasonable backup and recovery practices.

Data Protection

• reasonable protection against unauthorised access;
• controlled access to Client systems;
• secure transmission where technically available;
• reasonable measures against accidental loss.

Operational Security

• confidentiality obligations;
• access limitation;
• incident-response procedures;
• reasonable security awareness.

The specific controls implemented may vary depending on the nature, size and technical architecture of the engagement.

Adsyntra does not guarantee that any system or transmission method is completely secure.

14. CLIENT SYSTEM SECURITY

The Client remains responsible for security measures within systems that it controls.

This includes, where applicable:

• CRM accounts;
• Meta Business Manager;
• Google accounts;
• website hosting;
• email accounts;
• WhatsApp Business;
• customer databases;
• internal devices;
• employee accounts;
• third-party subscriptions.

The Client should use appropriate authentication and role-based permissions.

Adsyntra shall not be responsible for security incidents caused solely by the Client's failure to maintain reasonable security of systems under its control, except to the extent caused by Adsyntra's own breach or other liability under applicable law.

15. SUBPROCESSORS

The Client authorises Adsyntra to use third-party service providers where reasonably necessary to provide the Services.

Potential categories include:

• cloud hosting providers;
• CRM providers;
• advertising platforms;
• analytics providers;
• automation platforms;
• AI providers;
• messaging providers;
• email providers;
• website/hosting providers;
• payment/service administration providers;
• security providers; and
• other technology providers.

Where appropriate, Adsyntra shall require relevant service providers to maintain contractual or technical safeguards appropriate to the services they provide.

Adsyntra remains responsible for its contractual obligations concerning subprocessors to the extent required by applicable law.

16. AI SERVICE PROVIDERS

Where AI systems are used, Personal Data may be processed through an AI provider or API connected to the Client's workflow.

Depending on the specific system, this may include:

• names;
• phone numbers;
• email addresses;
• enquiries;
• conversation history;
• lead information;
• customer questions;
• business information; and
• other information submitted through the relevant workflow.

The specific AI provider and configuration may vary by Client and project.

Where an AI provider is used as a subprocessor, Adsyntra shall seek to use commercially reasonable contractual and technical safeguards appropriate to the relevant service.

The Client acknowledges that AI providers operate independently and may have their own terms, security architecture and data-processing arrangements.

17. INTERNATIONAL PROCESSING

Because Adsyntra may serve international Clients and may use globally available technology platforms, Personal Data may be processed or accessed across jurisdictions where permitted by applicable law.

Where applicable law imposes requirements concerning:

• cross-border transfers;
• data localisation;
• contractual safeguards;
• transfer mechanisms;
• security requirements; or
• government restrictions,

the Parties shall cooperate reasonably to satisfy those requirements.

The Client shall inform Adsyntra of any specific localisation or transfer restriction applicable to its data before processing begins.

18. DATA SUBJECT / DATA PRINCIPAL REQUESTS

Depending on applicable law and the Parties' roles, Data Principals may have rights relating to their Personal Data.

Where Adsyntra receives a request that relates to Personal Data processed solely on behalf of the Client,

Adsyntra may:

• forward the request to the Client;
• assist the Client where reasonably necessary;
• take action according to the Client's documented instructions; or
• respond directly where required by applicable law.

Adsyntra shall not independently disclose Client-controlled Personal Data to a requester merely because the requester asks for it, unless legally required or authorised.

The Client remains primarily responsible for responding to requests where it acts as the Data Fiduciary/ Controller.

19. ASSISTANCE WITH DATA RIGHTS

Taking into account the nature of the processing, Adsyntra shall provide reasonable assistance to the Client with:

• access requests;
• correction requests;
• deletion requests;
• consent withdrawal;
• data-export requests;
• complaints;
• restriction requests where applicable;
• other legally applicable Data Principal rights.

Where assistance requires substantial technical work outside the agreed Services, the Parties may agree reasonable additional fees, unless the applicable law requires the assistance to be provided without such charge.

20. PERSONAL DATA BREACH / SECURITY INCIDENT

For purposes of this DPA, a “Personal Data Breach” means a security incident resulting in accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to Personal Data processed under this DPA, where applicable law treats the incident as a breach.

If Adsyntra becomes aware of a Personal Data Breach materially affecting Client Personal Data, Adsyntra shall, where legally permitted and reasonably practicable:

1. notify the Client without undue delay;
2. provide reasonably available information about the incident;
3. describe known categories of affected information;
4. describe known or reasonably suspected impacts;
5. describe reasonable mitigation measures taken or proposed; and
6. reasonably cooperate with the Client's legally required response.

Initial notification may contain incomplete information if the investigation is ongoing. Additional information may be provided as it becomes reasonably available.

21. INCIDENT RESPONSE

Where an incident occurs, Adsyntra may take reasonable steps to:

• contain the incident;
• secure affected systems;
• revoke compromised access;
• investigate the cause;
• preserve relevant evidence;
• restore affected services;
• prevent recurrence; and
• cooperate with the Client.

The Client shall cooperate with Adsyntra where Client-controlled systems, credentials or infrastructure are involved.

Neither Party shall make public statements about a security incident that specifically identifies the other Party without reasonable consultation, except where legally required.

22. REGULATORY AND DATA-PROTECTION REQUESTS

Where legally required, the Parties shall reasonably cooperate regarding requests from:

• regulatory authorities;
• data-protection authorities;
• courts;
• law-enforcement authorities; or
• other competent governmental bodies.

Where legally permitted, a Party receiving such a request concerning the other Party's Personal Data shall notify the other Party before disclosure.

Nothing requires a Party to delay or refuse a legally binding governmental request.

23. DATA RETENTION AND DELETION

Adsyntra shall not intentionally retain Client Personal Data indefinitely.

Following completion or termination of the applicable Services, the Client may request deletion or return of Client Personal Data, subject to:

• applicable law;
• legal retention requirements;
• accounting requirements;
• dispute-resolution requirements;
• security requirements;
• backup systems;
• technical limitations; and
• the MSA.

Where deletion is technically impracticable from backup systems, such data may remain securely isolated until overwritten or otherwise deleted according to applicable retention practices.

24. DATA RETURN

Where technically and commercially practicable, Adsyntra may return Client Data in a commonly used export format where the relevant platform permits such export.

The Client acknowledges that some third-party platforms may:

• restrict exports;
• retain records;
• limit APIs;
• impose export charges;
• delete data according to their own policies; or
• prevent direct transfer.

Adsyntra is not responsible for third-party restrictions outside its reasonable control.

25. AUDITS AND COMPLIANCE INFORMATION

Where reasonably necessary to demonstrate compliance with applicable data-protection obligations, Adsyntra may provide the Client with reasonable information about its relevant data-protection and security practices.

Any audit shall:

• be reasonably scoped;
• occur during normal business hours;
• avoid unnecessary disruption;
• respect confidentiality;
• avoid exposing information concerning other clients; and
• not require disclosure of proprietary security information beyond what is reasonably necessary.

Unless otherwise required by applicable law, the Client shall bear its own audit costs.

26. DATA MINIMISATION

The Client should provide only Personal Data reasonably necessary for the agreed Services.

Adsyntra may request clarification or recommend removal of unnecessary information where it becomes aware that data appears excessive for the stated purpose.

27. ACCURACY

The Client remains responsible for the accuracy of Personal Data supplied to Adsyntra.

Adsyntra may correct, update, delete or otherwise modify Personal Data only:

• according to Client instructions;
• as part of the agreed Services;
• for technical/security purposes; or
• where required by law.

28. MARKETING COMMUNICATIONS

Where Adsyntra sends or automates:

• WhatsApp messages;
• emails;
• SMS;
• Instagram messages;
• remarketing communications; or
• other promotional communications on behalf of the Client, the Client remains responsible for determining whether the relevant communication is lawful and whether appropriate consent, notice, opt-out or other requirements apply.

Adsyntra may implement reasonable technical controls within the agreed scope, but does not independently guarantee regulatory compliance of the Client's marketing programme unless expressly contracted to provide such compliance services.

29. TRACKING AND COOKIES

Where Adsyntra implements tracking technologies such as:

• Meta Pixel;
• Google Analytics;
• Google Tag Manager;
• conversion APIs;
• cookies;
• remarketing tags; or
• similar technologies,

the Client remains responsible for determining the notices, consent mechanisms and legal basis required for its website and audience.

Adsyntra shall configure such technologies according to the agreed scope and Client instructions.

30. CHILDREN'S DATA

Unless expressly agreed and legally permitted, the Services are not designed to intentionally collect or process children's Personal Data.

The Client shall notify Adsyntra if the engagement involves services directed at children or materially involves children's Personal Data.

Additional safeguards may be required depending on applicable law.

31. GOVERNMENT OR LAW-ENFORCEMENT REQUESTS

If Adsyntra is legally required to disclose Client Personal Data to a governmental or law-enforcement authority, Adsyntra may make the disclosure.

Where legally permitted, Adsyntra shall provide reasonable notice to the Client.

Adsyntra may challenge or limit a request where it reasonably considers this appropriate and legally permissible, but is not required to do so.

32. CONFIDENTIALITY

Personal Data processed under this DPA shall be treated as confidential.

The confidentiality obligations contained in the MSA shall apply to Personal Data and remain effective after termination for so long as required by the MSA or applicable law.

33. LIABILITY

The liability provisions of the MSA shall apply to this DPA unless the Parties expressly agree otherwise in writing.

Nothing in this DPA is intended to exclude liability that cannot legally be excluded.

Where applicable law imposes mandatory liability or remedies concerning Personal Data, those requirements shall prevail.

34. CLIENT INSTRUCTIONS

The Client shall ensure that all processing instructions provided to Adsyntra are:

• lawful;
• reasonably clear;
• within the scope of the Services; and
• consistent with this DPA.

If Adsyntra reasonably believes that an instruction may violate applicable law, Adsyntra may notify the Client and may suspend the affected processing until the issue is clarified or resolved, where reasonably necessary.

35. CHANGES TO PROCESSING

The Client shall notify Adsyntra before materially changing the intended use of Personal Data where such change affects Adsyntra's processing responsibilities.

Material changes may include:

• new categories of Personal Data;
• new categories of Data Subjects;
• new countries;
• new processing purposes;
• new sensitive/high-risk information;
• materially expanded AI processing; or
• new connected systems.

Additional safeguards or contractual terms may be required for material changes.

36. ORDER OF PRECEDENCE

If there is a conflict:

1. mandatory applicable law shall prevail;
2. a specifically agreed data-processing amendment shall prevail;
3. this DPA shall govern data-processing matters;
4. the MSA shall govern general commercial matters; and
5. the applicable SOW shall govern project-specific commercial scope.

A SOW shall not override this DPA's data-protection obligations unless the relevant change is expressly stated and legally permissible.

37. SUBPROCESSOR CHANGES

Adsyntra may periodically add or replace subprocessors where reasonably necessary to provide or improve the Services.

Where applicable law requires prior notice or an objection mechanism, Adsyntra shall provide such notice and follow the legally required process.

The Client may raise reasonable data-protection concerns regarding a proposed subprocessor.

The Parties shall work in good faith to address material concerns.

38. TERMINATION OF DATA PROCESSING

Upon termination or expiry of the relevant Services, Adsyntra shall cease processing Client Personal Data except where:

• continued processing is required by law;
• required for legitimate legal claims;
• required for accounting or recordkeeping;
• necessary for security/fraud prevention; or
• otherwise authorised by the Client or applicable law.

39. INTERNATIONAL CLIENTS

Where the Client is located outside India, the Parties acknowledge that additional privacy laws may apply.

Depending on the Client and Data Subjects, these may include laws governing:

• data protection;
• electronic communications;
• cookies;
• marketing;
• cross-border transfers;
• consumer privacy;
• children's privacy; or
• sector-specific information.

Where legally required, the Parties may execute additional contractual mechanisms, including jurisdiction-specific data-processing terms or transfer clauses.

This DPA does not by itself guarantee compliance with every privacy law applicable to an international Client.

40. DPA CONTACT

All privacy/data-processing requests relating to Adsyntra should be sent to:

Email: official@wolfsmedia.in

The Client shall provide its designated privacy/data-protection contact where applicable:

Client Contact: [NAME]

Email: [EMAIL]

Phone: [PHONE]

41. TERM

This DPA shall remain effective for as long as Adsyntra processes Client Personal Data under the applicable MSA/SOW.

Provisions concerning:

• confidentiality;
• security;
• data retention;
• deletion;
• liability;
• regulatory cooperation; and
• other provisions intended to survive

shall survive termination to the extent applicable.

42. AMENDMENTS

This DPA may be updated where reasonably necessary due to:

• changes in applicable law;
• regulatory requirements;
• changes in Services;
• changes in technology;
• changes in subprocessors;
• security requirements; or
• material changes in processing activities.

Material amendments shall be communicated and accepted where required by the MSA or applicable law.

43. SEVERABILITY

If any provision of this DPA is held invalid or unenforceable, the remaining provisions shall continue in effect to the extent legally permissible.

44. ELECTRONIC ACCEPTANCE

This DPA may be accepted through:

• physical signature;
• electronic signature;
• email acceptance;
• online acceptance;
• checkbox acceptance;
• proposal acceptance;
• platform-based acceptance; or
• another legally recognised electronic method.

Such acceptance shall constitute evidence of the Parties' agreement to this DPA, subject to applicable law.

45. SIGNATURES

SERVICE PROVIDER

Mohit Lakhera Sole Proprietor — Adsyntra AI

Signature: ________

Date: ______

Email: official@wolfsmedia.in

CLIENT

Legal Name: ______

Authorised Representative: ______

Designation: ______

Signature: ________

Date: ______

Email: ______

ANNEXURE A — PROCESSING DETAILS

A. Subject Matter

Processing of Personal Data required to provide the Services specified in the applicable MSA/SOW.

B. Duration

For the duration of the applicable Services, subject to post-termination retention requirements.

C. Nature of Processing

Processing may include:

• collection through Client systems;
• access;
• organisation;
• storage;
• retrieval;
• analysis;
• segmentation;
• transmission;
• automation;
• AI-assisted processing;
• communication;
• reporting;
• campaign optimisation;
• CRM processing;
• deletion; and
• other activities reasonably necessary for the Services.

D. Purpose

The purposes shall be limited to those specified in the applicable MSA/SOW and Client instructions.

E. Data Subjects

Potentially:

• leads;
• prospects;
• customers;
• subscribers;
• website visitors;
• social-media users;
• employees;
• contractors;
• business contacts; and
• other individuals whose Personal Data is lawfully provided by the Client.

F. Personal Data Categories

Potentially:

• name;
• email;
• phone;
• address;
• business information;
• enquiry information;
• communication history;
• CRM information;
• campaign information;
• website/technical information;
• appointment information; and
• other categories expressly agreed.

G. Special/Sensitive Data

None unless expressly agreed in writing and legally permissible.

H. Processing Locations

India and/or other jurisdictions where the relevant authorised technology providers operate, subject to applicable law and contractual requirements.

ANNEXURE B — AUTHORISED PROCESSING SYSTEMS

The Client may authorise Adsyntra to access and process Personal Data through systems such as:

• Meta Business Manager;
• Meta Ads Manager;
• Instagram;
• WhatsApp Business;
• Google Ads;
• Google Analytics;
• Google Tag Manager;
• CRM systems;
• website/CMS;
• cloud storage;
• email platforms;
• automation platforms;
• AI platforms;
• analytics systems;
• customer databases; and
• other systems identified in the applicable SOW.

The exact platforms shall depend on the Client's project.

ANNEXURE C — CLIENT PROCESSING INSTRUCTIONS

Client Name: [CLIENT]

Primary Processing Purpose: [PURPOSE]

Authorised Data Categories: [DATA]

Authorised Data Subjects: [DATA SUBJECTS]

Authorised Systems: [SYSTEMS]

Authorised Countries/Jurisdictions: [JURISDICTIONS]

Special Restrictions: [RESTRICTIONS]

Retention Instructions: [INSTRUCTIONS]

Deletion/Return Instructions on Termination: [INSTRUCTIONS]

Client Data-Protection Contact: [NAME / EMAIL]

Additional Requirements: [DETAILS]

ANNEXURE D — SUBPROCESSOR REGISTER

The following categories of subprocessors may be used depending on the Services:

The actual providers used for a particular Client may be identified separately where required.

ANNEXURE E — DATA INCIDENT CONTACT

Adsyntra Privacy/Data Contact: Mohit Lakhera

Email: official@wolfsmedia.in

Client Incident Contact:

Name: [NAME]

Email: [EMAIL]

Phone: [PHONE]

Preferred Urgent Contact Method: [EMAIL / PHONE / OTHER]

END OF DATA PROCESSING AGREEMENT