Version: 2026-04-19 (v1.0) Issuing entity: Sumatak Technologies LLP (“Processor”, operating Gamyata) Status: Template — execute by signing the cover page and exchanging counter-signed copies with the Controller.
This Data Processing Agreement (the “DPA”) is entered into between:
trust@gamyata.com (and, for privacy matters,
privacy@gamyata.com).This DPA is incorporated into and forms part of the parties’ Master Subscription Agreement, Order Form, or equivalent commercial agreement (the “Principal Agreement”). In the event of a conflict between this DPA and the Principal Agreement on matters of personal data processing, this DPA prevails.
Capitalised terms not defined here have the meaning given to them in:
“Personal Data”, “Processing”, “Controller”, “Processor”, “Sub-processor”, “Data Subject”, “Special Categories of Personal Data” carry their GDPR meaning. “Personal Information” carries its CCPA/CPRA meaning where the Controller’s processing falls under that statute.
| Item | Description |
|---|---|
| Subject matter | Provision of the Gamyata accessibility auditing service (scanning Controller-designated URLs, generating WCAG conformance reports, retaining issue tracking and remediation history). |
| Nature of processing | Storage, structured analysis, report generation, evidence retention, transmission to Controller users and authorised sub-processors. |
| Purpose | Performing the Principal Agreement; fulfilling Controller’s accessibility-compliance obligations under ADA, EAA, Section 508, IS 17802 and equivalents. |
| Duration | Term of the Principal Agreement, plus retention periods set out in §11. |
Data subjects. The Controller’s authorised users (administrators, auditors, developers, designers); end-users of Controller’s tested websites only to the extent personal data appears in scanned page snapshots, screenshots, or DOM captures.
Personal data categories.
Special categories. Processor does not solicit special categories of personal data. If they appear incidentally in scan content, both parties will minimise retention and Controller will instruct Processor to delete the affected scan on request.
In its capacity as Processor, Sumatak Technologies LLP shall:
Process on documented instructions — Process Personal Data only on the Controller’s documented instructions, including with regard to transfers to a third country, unless required to do so by Union or Member State law to which Processor is subject.
Confidentiality — Ensure that personnel authorised to process the Personal Data are bound by written confidentiality obligations.
Security measures — Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including those described in Annex A (Technical and Organisational Measures).
Sub-processors — Engage sub-processors only under §6.
Data subject rights — Assist the Controller, by appropriate technical and organisational measures, in fulfilling its obligation to respond to requests for exercising the Data Subject’s rights laid down in Chapter III GDPR.
Security incident assistance — Assist the Controller in ensuring compliance with Articles 32–36 GDPR (security, breach notification, DPIA, prior consultation), taking into account the nature of processing and information available to Processor.
Return or deletion — At the Controller’s choice, return or delete all Personal Data after the end of the provision of services, unless Union or Member State law requires retention. Default: deletion within 60 days, with audit log retained for the period in §11.
Audit cooperation — Make available to the Controller all information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller, on the terms of §10.
The Controller authorises Processor to engage the following sub-processors as of the Effective Date. The current list is also published at https://gamyata.com/trust.
| Sub-processor | Service | Region(s) of processing |
|---|---|---|
| Logto | Authentication & identity | EU |
| Amazon Web Services | Compute, storage, networking | ap-south-1 (Mumbai), eu-west-1 (Dublin) |
| Razorpay | Payment processing | India |
| Anthropic | Large-language-model inference for AI agents | United States (zero-retention agreement) |
| OpenAI | Large-language-model inference for AI agents | United States (zero-retention agreement) |
| Sentry | Error monitoring (PII scrubbing applied at ingest) | EU |
| PostHog | Product analytics (opt-in only) | EU |
Processor will give the Controller at least 30 days’ prior written notice of the addition or replacement of a sub-processor (via the trust page, release notes, or e-mail). The Controller may object on reasonable data-protection grounds within that notice period; if the parties cannot resolve the objection, the Controller may terminate the affected portion of the Principal Agreement.
Processor remains fully liable to the Controller for the acts and omissions of its sub-processors with respect to Personal Data.
Transfers from the EU/EEA, UK, or Switzerland to India. The parties incorporate, by reference, the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 (“EU SCCs”), Module 2 (Controller-to-Processor), with:
Transfers from the UK are made under the UK International Data Transfer Addendum to the EU SCCs (issued by the ICO), with this DPA acting as the underlying agreement.
Transfers from Switzerland are made under the EU SCCs as adapted by the Federal Data Protection and Information Commissioner’s guidance.
Schrems II supplementary measures. Processor implements the supplementary measures described in Annex A (encryption in transit and at rest, named-engineer access logging, government-access-request transparency) to ensure transferred data receives an essentially equivalent level of protection.
Processor shall notify the Controller of a Personal Data Breach affecting the Controller’s Personal Data without undue delay and in any event within 72 hours of becoming aware of it. The notification will:
If the full information is not yet available, the initial notification will identify what is known and Processor will provide updates as the investigation progresses.
Processor shall, taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller’s obligation to respond to requests for exercising the data subject’s rights laid down in Chapter III GDPR (information, access, rectification, erasure, restriction, portability, objection, decisions based on automated processing).
If a data subject contacts Processor directly with such a request, Processor will, without undue delay, forward the request to the Controller and confirm to the data subject that the request has been forwarded.
Once per twelve-month period, on at least 30 days’ prior written notice, the Controller (or an independent auditor mandated by the Controller and agreed by the parties — agreement not unreasonably withheld) may audit Processor’s compliance with this DPA. The audit:
The Controller bears the costs of the audit unless it reveals a material breach of this DPA, in which case Processor bears the reasonable costs.
On termination of the Principal Agreement, or earlier on Controller’s written request:
On request, Processor will issue a written certificate of deletion.
If applicable Union, Member State, or Indian law requires Processor to retain specific Personal Data, Processor will inform the Controller of the retention requirement and the basis for it.
The liability of each party under or in connection with this DPA is subject to the liability cap and limitations set out in the Principal Agreement. Nothing in this DPA limits or excludes liability for (a) death or personal injury caused by negligence, (b) fraud or fraudulent misrepresentation, or (c) any other liability that cannot be limited or excluded by law.
This DPA is governed by the law specified in the Principal Agreement, except that the EU SCCs are governed as set out in §7. Disputes are subject to the jurisdiction agreed in the Principal Agreement, except that the EU SCCs supersede that choice for matters falling within their scope.
A summary; current details live at https://gamyata.com/security.
Sumatak Technologies LLP — Authorised Signatory:
Name: _____________________________________
Title: _____________________________________
Date: _____________________________________
Signature: _____________________________________Controller — Authorised Signatory:
Name: _____________________________________
Title: _____________________________________
Date: _____________________________________
Signature: _____________________________________Compliance officer note (template only — flagged for legal-counsel review). This DPA template is provided for buyer pre-procurement review and is not executed unless and until both parties sign Annex B. Specific clauses — particularly governing law, dispute resolution forum, liability cap reference, and the EU SCC modules — should be tailored per deal by Legal Counsel before execution. Items currently flagged for Legal Counsel review on first execution: §7 (SCC module annex completion), §10 (audit notice period for regulated-industry buyers), §12 (liability cap reference once Master Subscription Agreement is finalised).