MIF-CHECKOUT Back to home

Data Processing Addendum

Last updated: —

This Data Processing Addendum ("DPA") forms part of the agreement between the merchant ("Data Fiduciary" or "Controller") and the site operator("Data Processor") and governs the processing of Personal Data by the site operator on behalf of the merchant. It is designed to comply with the Digital Personal Data Protection Act, 2023 (India) and, where applicable, the GDPR.

1. Roles

In respect of Shopper Personal Data collected via MIF-CHECKOUT, the merchant is the Data Fiduciary and the site operator is the Data Processor. Where the site operator maintains a cross-store shopper network for one-click checkout, the site operator additionally acts as a joint Data Fiduciary for the limited purpose of maintaining the network profile with the shopper's explicit consent.

2. Subject matter & duration

Subject matter: processing of Shopper Personal Data (name, phone, email, addresses, order metadata) to enable checkout, order sync, fraud prevention, cart-recovery messaging and analytics. Duration: for the term of the service agreement and any statutory retention period thereafter.

3. Instructions

the site operator processes Personal Data only on the merchant's documented instructions, unless required by Indian law. The merchant's configuration in the merchant dashboard (COD rules, retargeting toggles, WhatsApp templates) constitutes such documented instructions.

4. Sub-processors

The merchant authorises the site operator to engage the sub-processors listed in Section 6 of the Privacy Policy. Any addition or replacement will be notified via the merchant dashboard with at least 15 days' prior notice; the merchant may object on reasonable grounds.

5. Security measures

  • TLS 1.2+ for all data in transit.
  • AES-256 encryption at rest for sensitive fields (tokens, secrets).
  • Role-based access control and mandatory MFA for administrative access.
  • Audit logs retained for at least 12 months.
  • Annual third-party vulnerability assessment.
  • Written security policies and background-verified personnel.

6. Personal data breach

the site operator shall notify the merchant of any confirmed personal data breach affecting the merchant's Shopper Data without undue delay and in any case within 72 hours of becoming aware. the site operator shall independently report notifiable breaches to the Data Protection Board of India as required by law.

7. Data-principal rights

the site operator shall assist the merchant in responding to requests from shoppers to access, correct, erase or port their Personal Data, within the timeframes prescribed by the DPDP Act, 2023.

8. Cross-border transfers

The merchant acknowledges and consents to the transfers described in the Privacy Policy. Such transfers are covered by data-processing agreements with each sub-processor. The merchant will obtain shopper consent for such transfers via the checkout consent checkbox provided by MIF-CHECKOUT.

9. Deletion / return

On termination of the service agreement, the site operator will, at the merchant's written option, delete or return all Personal Data within 30 days, save to the extent retention is required by Indian law (e.g. GST records).

10. Audits

On reasonable notice (not more than once per calendar year, unless triggered by a breach), the merchant may audit the site operator's compliance with this DPA by receiving current certifications, penetration-test summaries and written responses to a security questionnaire.

11. Liability

Each party's liability under this DPA is subject to the limitation of liability set out in the underlying service agreement / Terms of Service.

12. Order of precedence

In the event of conflict between this DPA and the underlying service agreement, this DPA prevails on data-protection matters.

Merchants who require a signed copy of this DPA on letterhead may request one at the Data Protection Officer email listed on our Contact page.