Last updated: 15 October 2026 | Effective date: 15 October 2026 | Version 1.0
This Data Processing Addendum ("DPA") forms part of the Terms of Use (or any signed agreement) between Celeritio Software Pvt. Ltd. ("Celeritio", "Processor") and the customer ("Customer", "Fiduciary"). It applies where Celeritio processes personal data contained in Customer Content on the Customer's behalf through DataFrugal.
It is written to meet the contract requirement in section 8(2) of India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and, for customers to whom it applies, Article 28 of the EU/UK GDPR. "Data Fiduciary" and "Controller", and "Data Processor" and "Processor", are used interchangeably.
The Customer is the Data Fiduciary / Controller for personal data in Customer Content and determines the purposes and means of processing it. Celeritio is the Data Processor for that data.
Celeritio is the Data Fiduciary / Controller for account, billing, support and website data, which is governed by the Privacy Policy rather than this DPA.
Celeritio will process Customer Content only to provide and support the service, and on the Customer's documented instructions, which are given through the Terms, this DPA and the Customer's use and configuration of the service. Celeritio will not sell Customer Content, use it for advertising, or use it to train machine learning models.
DataFrugal does not open, index, scan or analyse the contents of files. Celeritio staff access Customer Content only where necessary for support or operations, and such access is restricted and logged.
If Celeritio believes an instruction breaches applicable data protection law, it will inform the Customer.
| Subject matter | Provision of cloud backup, retention, governance and audit services |
|---|---|
| Duration | The term of the subscription, plus the retention periods in section 9 |
| Nature and purpose | Storage, retention, access control, sharing as directed by the Customer, recovery, and audit logging |
| Types of personal data | Determined by the Customer. Whatever is contained in uploaded files, plus file metadata (names, sizes, dates, labels, ownership, sharing) and access records |
| Categories of Data Principals | Determined by the Customer — typically its employees, contractors, customers, patients or clients |
| Special category / children's data | Only if the Customer uploads it. Celeritio cannot detect it, as it does not read file contents |
The Customer warrants that it will:
Celeritio treats Customer Content as confidential, and personnel with access are bound by confidentiality obligations that survive the end of their engagement. Access is limited to those who need it.
Celeritio maintains the measures in Annex B. In summary:
DataFrugal is listed on the CSA STAR Registry at CSA STAR Level 1. Celeritio does not currently hold ISO 27001, SOC 2 or HIPAA attestations. The Customer is responsible for determining whether the service meets the regulatory requirements applicable to it.
On reasonable written request, and not more than once in any 12 months unless required by a regulator or following a breach, Celeritio will provide information reasonably necessary to demonstrate compliance with this DPA, including its security documentation and the audit reports the service itself produces. Any on-site or third-party audit must be agreed in advance, conducted under confidentiality and during business hours, and is at the Customer's cost.
The Customer authorises Celeritio to engage the sub-processors in Annex A. Celeritio imposes data protection obligations on each of them no less protective than this DPA, and remains responsible for their performance.
Celeritio will give the Customer at least 30 days' notice, by email to the registered administrative contact, before adding or replacing a sub-processor that processes Customer Content. If the Customer reasonably objects on data protection grounds within that period, the parties will discuss in good faith; if no resolution is reached, the Customer may terminate the affected subscription without penalty, with a pro-rata refund of prepaid fees for the unused period.
The service gives the Customer direct control over Customer Content, so the Customer can usually fulfil access, correction and erasure requests itself. Where it cannot, Celeritio will provide reasonable assistance, taking into account the nature of the processing. If a Data Principal contacts Celeritio directly about Customer Content, Celeritio will refer them to the Customer rather than respond on its behalf.
The Customer should plan around these limits, which are stated plainly rather than discovered later:
The Customer may export Customer Content at any time while the subscription is active, through the web application, the API or df-agent. On termination or expiry, Celeritio deletes Customer Content from object storage, subject to the limits in section 9.2 and to the timetable in section 8 of the Terms of Use, which also applies where an account is terminated for non-payment or breach. Celeritio retains billing and tax records for the period required by law.
Celeritio will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Content, and in any event within the time required by applicable law, so that the Customer can meet its own notification obligations. The notice will describe, so far as known, the nature of the breach, the categories and approximate volume of data affected, the likely consequences, and the measures taken or proposed. Celeritio will assist the Customer with its notifications to the Data Protection Board of India, a supervisory authority, or affected individuals.
Business organisations select a storage provider and region when the organisation is created, and Customer Content is stored in that region. Support and operations may involve access from India. Where personal data is transferred across borders, Celeritio relies on the mechanisms available under applicable law, including transfers permitted under section 16 of the DPDP Act and, where GDPR applies, Standard Contractual Clauses with appropriate safeguards.
Each party's liability under this DPA is subject to the limitations in the Terms of Use or the signed agreement between the parties. This DPA takes effect when the Customer begins using the service and continues while Celeritio processes Customer Content. If this DPA conflicts with the Terms of Use on the processing of personal data, this DPA prevails.
Grievance Officer, Celeritio Software Pvt. Ltd. — legal@celeritio.com, Office 3/4, Vrundawan Commercial Complex, D.P. Road, Kothrud, Pune – 411038, Maharashtra, India. For a countersigned copy of this DPA, contact legal@celeritio.com.
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services, Inc. | Object storage, hosting and compute | Region selected by the Customer (for example Mumbai, Singapore, Virginia) |
| Wasabi Technologies, Inc. | Object storage | Region selected by the Customer; shared storage for individual accounts |
| Microsoft Azure | Deployment, monitoring and marketplace billing where used | As configured |
| Cashfree Payments India Pvt. Ltd. | Payment processing (billing data only) | India |
| Google LLC | Support and contact forms; marketing website analytics (no Customer Content) | United States / global |
| Area | Measure |
|---|---|
| Access control | Role-based access control with defined roles; organisation-scoped isolation; owner-only sharing with no re-sharing by recipients and no public links; optional IP allowlisting for direct storage access (business organisations) |
| Authentication | Email and password with verification, or Google / Microsoft sign-in; machine identities with scoped, rotatable, revocable secrets for automation |
| Encryption | HTTPS in transit; encryption at rest in object storage; optional customer-supplied key material imported into a dedicated key, with full create / rotate / delete lifecycle logging |
| Integrity and retention | WORM retention using object lock in governance mode; retention extendable but reducible only through dual-approval Break Glass requiring two separate System Administrators; version history retained |
| Logging and monitoring | Audit records of sign-ins, downloads (including denied, blocked and failed attempts), permission changes, configuration, account and billing changes, encryption key lifecycle, and audit searches and exports. Downloads are refused if the audit record cannot be written. Folder listing and metadata search are not currently recorded. |
| Audit retention | At least 1 year live and searchable, held in calendar-quarter partitions that are currently retained rather than deleted, so history in practice extends beyond the committed year. Where records are archived, a SHA-256 checksum is recorded; retrieval for investigation is available on request and is not instantaneous. |
| Content handling | No file preview, indexing, scanning or content analysis; metadata-only operations |
| Resilience | Managed object storage with provider-level durability; routine backups of platform databases |
| Personnel | Access limited to staff who need it; confidentiality obligations; access through controlled administrative paths |
Celeritio may update these measures as the service evolves, provided the overall level of protection is not reduced.